Mercurial > hg > nginx-site
annotate xml/cn/docs/http/configuring_https_servers.xml @ 623:7158aa1ec520
Added special server name '$hostname' description.
author | Vladimir Homutov <vl@nginx.com> |
---|---|
date | Fri, 10 Aug 2012 09:35:38 +0000 |
parents | 130fad6dc1b4 |
children | 9934338f83af |
rev | line source |
---|---|
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
2 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
3 <article name="配置HTTPS服务器" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
4 link="/cn/docs/http/configuring_https_servers.html" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
5 lang="cn" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
6 author="Igor Sysoev" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
7 editor="Brian Mercer"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 <section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
11 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
12 配置HTTPS主机,必须在server配置块中打开SSL协议,还需要指定服务器端证书和密钥文件的位置: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
13 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
17 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
18 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
19 ssl_certificate www.nginx.com.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
20 ssl_certificate_key www.nginx.com.key; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
21 ssl_protocols SSLv3 TLSv1; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
22 ssl_ciphers HIGH:!aNULL:!MD5; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
23 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
24 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
25 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
26 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
27 服务器证书是公开的,会被传送到所有连接到服务器的客户端。而私钥不是公开的,需要存放在访问受限的文件中,当然,nginx主进程必须有读取密钥的权限。还有一种情况,私钥和证书存放在同一个文件中: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
28 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
29 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
30 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
31 ssl_certificate www.nginx.com.cert; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
32 ssl_certificate_key www.nginx.com.cert; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
33 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
34 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
35 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
36 这种情况下,证书文件同样得设置访问限制。当然,虽然证书和密钥存放在同一个文件,只有证书会发送给客户端,密钥不会发送。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
37 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
38 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
39 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
40 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
41 <literal>ssl_protocols</literal>和<literal>ssl_ciphers</literal>指令可以用来强制用户连接只能引入SSL/TLS那些强壮的协议版本和强大的加密算法。从1.0.5版本开始,nginx默认使用<literal>ssl_protocols SSLv3 TLSv1</literal>和<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>,所以只有在之前的版本,明确地配置它们才是有意义的。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
42 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
43 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
44 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
45 CBC模式的加密算法容易受到一些攻击,尤其是BEAST攻击(参见<link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>)。可以通过下面配置调整为优先使用RC4-SHA加密算法: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
46 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
47 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
48 ssl_ciphers RC4:HIGH:!aNULL:!MD5; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
49 ssl_prefer_server_ciphers on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
50 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
51 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
52 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
53 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
54 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
55 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
56 <section id="optimization" name="HTTPS服务器优化"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
57 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
58 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
59 SSL操作需要消耗CPU资源,所以在多处理器的系统,需要启动多个工作进程,而且数量需要不少于可用CPU的个数。最消耗CPU资源的SSL操作是SSL握手,有两种方法可以将每个客户端的握手操作数量降到最低:第一种是保持客户端长连接,在一个SSL连接发送多个请求,第二种是在并发的连接或者后续的连接中重用SSL会话参数,这样可以避免SSL握手的操作。会话缓存用于保存SSL会话,这些缓存在工作进程间共享,可以使用<literal>ssl_session_cache</literal>指令进行配置。1M缓存可以存放大约4000个会话。默认的缓存超时是5分钟,可以使用<literal>ssl_session_timeout</literal>来修改。下面是一个针对4核系统的配置优化的例子,使用10M的共享会话缓存: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
60 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
61 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
62 <b>worker_processes 4</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
63 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
64 http { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
65 <b>ssl_session_cache shared:SSL:10m</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
66 <b>ssl_session_timeout 10m</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
67 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
68 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
69 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
70 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
71 <b>keepalive_timeout 70</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
72 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
73 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
74 ssl_certificate www.nginx.com.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
75 ssl_certificate_key www.nginx.com.key; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
76 ssl_protocols SSLv3 TLSv1; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
77 ssl_ciphers HIGH:!aNULL:!MD5; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
78 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
79 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
80 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
81 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 <section id="chains" name="SSL证书链"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 有些浏览器不接受那些众所周知的证书认证机构签署的证书,而另外一些浏览器却接受它们。这是由于证书签发使用了一些中间认证机构,这些中间机构被众所周知的证书认证机构授权代为签发证书,但是它们自己却不被广泛认知,所以有些客户端不予识别。针对这种情况,证书认证机构提供一个证书链的包裹,用来声明众所周知的认证机构和自己的关系,需要将这个证书链包裹与服务器证书合并成一个文件。在这个文件里,服务器证书需要出现在认证方证书链的前面: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
89 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
90 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 $ cat www.nginx.com.crt bundle.crt > www.nginx.com.chained.crt |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 这个文件需要使用<literal>ssl_certificate</literal>指令来引用: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
95 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
97 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
98 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
99 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
100 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
101 ssl_certificate www.nginx.com.chained.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
102 ssl_certificate_key www.nginx.com.key; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
103 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
104 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
105 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
106 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
107 如果服务器证书和认证方证书链合并时顺序弄错了,nginx就不能正常启动,而且会显示下面的错误信息: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
108 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
109 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
110 SSL_CTX_use_PrivateKey_file(" ... /www.nginx.com.key") failed |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
111 (SSL: error:0B080074:x509 certificate routines: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
112 X509_check_private_key:key values mismatch) |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
113 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
114 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
115 因为nginx首先需要用私钥去解密服务器证书,而遇到的却是认证方的证书。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
116 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
117 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
118 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
119 浏览器通常会将那些被受信的认证机构认证的中间认证机构保存下来,那么这些浏览器以后在遇到使用这些中间认证机构但不包含证书链的情况时,因为已经保存了这些中间认证机构的信息,所以不会报错。可以使用<command>openssl</command>命令行工具来确认服务器发送了完整的证书链: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
120 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
121 $ openssl s_client -connect www.godaddy.com:443 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
122 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
123 Certificate chain |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
124 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
125 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
126 /OU=MIS Department/<b>CN=www.GoDaddy.com</b> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
127 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b) |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
128 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
129 /OU=http://certificates.godaddy.com/repository |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
130 /CN=Go Daddy Secure Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
131 /serialNumber=07969287 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
132 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
133 /OU=http://certificates.godaddy.com/repository |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
134 /CN=Go Daddy Secure Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
135 /serialNumber=07969287 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
136 i:/C=US/O=The Go Daddy Group, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
137 /OU=Go Daddy Class 2 Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
138 2 s:/C=US/O=The Go Daddy Group, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
139 /OU=Go Daddy Class 2 Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
140 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 /OU=ValiCert Class 2 Policy Validation Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 /CN=http://www.valicert.com//emailAddress=info@valicert.com |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
143 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
145 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
146 在这个例子中,www.GoDaddy.com的服务器证书(#0)的受签者(“s”)是被签发机构(“i”)签名的,而这个签发机构又是证书(#1)的受签者,接着证书(#1)的签发机构又是证书(#2)的受签者,最后证书(#2)是被众所周知的签发机构ValiCert, Inc签发。ValiCert, Inc的证书内嵌在浏览器中,被浏览器自动识别。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
147 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
150 如果没有加入认证方证书链,那只能看到服务器证书(#0)。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
151 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
152 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
153 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
154 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
155 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
156 <section id="single_http_https_server" name="统一的HTTP/HTTPS主机"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
157 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
158 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
159 从开始就将HTTP主机和HTTPS主机分开配置是很好一个很好的实践。虽然它们的功能现在看来是一样的,但是这个情况将来可能会有很大变化,那么合在一起的配置就有问题了。如果HTTP和HTTPS主机配置相同,而又不考虑将来重写配置的话,可以用一个主机配置统一处理HTTP和HTTPS请求。方法是删除<literal>ssl on</literal>的配置项,并在*:443端口添加参数<literal>ssl</literal>: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
160 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
161 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
162 listen 80; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
163 listen 443 ssl; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
164 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
165 ssl_certificate www.nginx.com.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
166 ssl_certificate_key www.nginx.com.key; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
167 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
168 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
169 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
170 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
171 <note> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
172 在0.8.21版本以前,只有添加了<literal>default</literal>参数的监听端口才能添加<literal>ssl</literal>参数: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
173 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
174 listen 443 default ssl; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
175 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
176 </note> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
177 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
178 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
179 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
180 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
181 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
182 <section id="name_based_https_servers" name="基于名字的HTTPS主机"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
183 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
184 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
185 在同一个IP上配置多个HTTPS主机,会出现问题: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
186 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
187 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
188 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
189 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
190 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
191 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
192 ssl_certificate www.nginx.com.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
193 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
194 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
195 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
196 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
197 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
198 server_name www.nginx.org; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
199 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
200 ssl_certificate www.nginx.org.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
201 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
202 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
203 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
204 |
593
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
558
diff
changeset
|
205 使用上面的配置,不论浏览器请求哪个主机,都只会收到默认主机的证书,比方说就是<literal>www.nginx.com</literal>。这是由SSL协议本身的行为引起的。因为SSL规定在建立SSL连接以后,才能发送HTTP请求,所以nginx建立SSL连接时不知道所请求主机的名字,因此,它只会返回默认主机的证书。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
206 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
207 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
208 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
209 最古老的也是最稳定的解决方法就是每个HTTPS主机使用不同的IP地址: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
210 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
211 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
212 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
213 listen 192.168.1.1:443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 ssl_certificate www.nginx.com.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
217 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
218 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
219 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
220 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
221 listen 192.168.1.2:443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
222 server_name www.nginx.org; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
223 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
224 ssl_certificate www.nginx.org.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
225 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
226 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
227 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
228 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
229 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
230 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
231 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
232 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
233 <section id="certificate_with_several_names" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
234 name="带有多个主机名的SSL证书"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
235 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
236 <para> |
593
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
558
diff
changeset
|
237 也有其他一些方法可以实现多个HTTPS主机共享一个IP地址,但都有不足。其中一种方法是使用在“SubjectAltName”字段中存放多个名字的证书,比如<literal>www.nginx.com</literal>和<literal>www.nginx.org</literal>。这种方法的限制是“SubjectAltName”字段的长度。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
238 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
239 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
240 <para> |
593
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
558
diff
changeset
|
241 另一种方式是使用主机名中含有通配符的证书,比如<literal>*.nginx.org</literal>。这个证书匹配<literal>www.nginx.org</literal>,但是不匹配<literal>nginx.org</literal>和<literal>www.sub.nginx.org</literal>。这两种方法可以结合在一起——使用在“SubjectAltName”字段中存放的多个名字的证书,这些名字既可以是确切的名字,也可以是通配符,比如<literal>nginx.org</literal>和<literal>*.nginx.org</literal>。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
242 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
243 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
244 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
245 最好将带有多个名字的证书和它的密钥文件配置在http配置块中,这样可以只保存一份内容拷贝,所有主机的配置都从中继承: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
246 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
247 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
248 ssl_certificate common.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
249 ssl_certificate_key common.key; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
250 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
251 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
253 server_name www.nginx.com; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
254 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
257 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
258 server { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
259 listen 443; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 server_name www.nginx.org; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 ssl on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
264 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
265 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
266 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
267 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
268 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
269 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
270 <section id="sni" name="主机名指示"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
271 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
272 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
273 在一个IP上运行多个HTTPS主机的更通用的方案是<link url="http://en.wikipedia.org/wiki/Server_Name_Indication">TLSv1.1 主机名指示扩展</link>(SNI,RFC3546),它允许浏览器和服务器进行SSL握手时,将请求的主机名传递服务器,因此服务器可以知道使用哪一个证书来服务这个连接。但SNI只得到有限的浏览器的支持。下面列举支持SNI的浏览器最低版本和平台信息: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
274 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
275 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
277 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
278 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
279 Opera 8.0; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
280 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
281 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 MSIE 7.0(仅在Windows Vista操作系统及后续操作系统); |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
285 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
286 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
287 Firefox 2.0和使用Mozilla平台1.8.1版本的其他浏览器; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
288 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
289 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
290 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
291 Safari 3.2.1(Windows版需要最低Vista操作系统); |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
292 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
293 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
294 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
295 Chrome(Windows版需要最低Vista操作系统)。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
296 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
299 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
300 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
301 为了在nginx中使用SNI,那么无论是在编译nginx时使用的OpenSSL类库,还是在运行nginx时使用的OpenSSL运行库,都必须支持SNI。从0.9.8f版本开始,OpenSSL通过<nobr>“--enable-tlsext”</nobr>配置选项加入SNI支持,从0.9.8j版本开始,此选项成为默认选项。当nginx被编译成支持SNI时,在使用“-V”选项运行时会显示如下信息: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
302 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
303 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
304 $ nginx -V |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
305 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
306 TLS SNI support enabled |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
307 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
308 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
309 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
310 但是,当开启SNI支持的nginx被动态链接到不支持SNI的OpenSSL库上时,nginx会显示如下警告: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
311 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
312 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
313 nginx was built with SNI support, however, now it is linked |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
314 dynamically to an OpenSSL library which has no tlsext support, |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
315 therefore SNI is not available |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
316 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
317 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
318 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
319 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
320 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
321 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
322 <section id="compatibility" name="兼容性"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
323 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
324 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
325 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
326 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
327 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
328 从0.8.21和0.7.62版本开始,使用“-V”选项运行nginx时,将显示SNI支持状态信息。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
329 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
330 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
331 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
332 从0.7.14版本开始,<literal>listen</literal>指令支持<literal>ssl</literal>参数。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
333 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
334 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
335 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
336 从0.5.32版本开始,支持SNI。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
337 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
338 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
339 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
340 从0.5.6版本开始,支持SSL会话缓存,并可在工作进程间共享。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
342 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
343 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
344 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
345 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
346 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
347 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
348 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
349 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
350 0.7.65、0.8.19及以后版本,默认SSL协议是SSLv3和TLSv1。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
351 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
352 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
353 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
354 0.7.64、0.8.18及以前版本,默认SSL协议是SSLv2、SSLv3和TLSv1。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
355 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
356 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
357 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
358 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
359 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
360 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
361 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
362 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
363 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
364 1.0.5及以后版本,默认SSL密码算法是<literal>HIGH:!aNULL:!MD5</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
365 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
366 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
367 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
368 0.7.65、0.8.20及以后版本,默认SSL密码算法是<literal>HIGH:!ADH:!MD5</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
369 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
370 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
371 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
372 0.8.19版本,默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
373 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
374 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
375 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
376 0.7.64、0.8.18及以前版本,默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
377 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
378 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
379 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
380 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
381 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
382 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
383 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
384 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
385 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
386 </article> |