Mercurial > hg > nginx-site
annotate xml/ru/docs/http/ngx_http_ssl_module.xml @ 1721:737c86e8b316
Clarified meaning of the $request_id variable.
author | Yaroslav Zhuravlev <yar@nginx.com> |
---|---|
date | Mon, 06 Jun 2016 12:25:16 +0300 |
parents | 38fb3e6b71e8 |
children | 67b5aac350e4 |
rev | line source |
---|---|
222
bfe3eff81d04
Removed redundant encoding specification.
Ruslan Ermilov <ru@nginx.com>
parents:
110
diff
changeset
|
1 <?xml version="1.0"?> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
2 |
580
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
3 <!-- |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
4 Copyright (C) Igor Sysoev |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
5 Copyright (C) Nginx, Inc. |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
6 --> |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
7 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
9 |
379 | 10 <module name="Модуль ngx_http_ssl_module" |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
11 link="/ru/docs/http/ngx_http_ssl_module.html" |
589 | 12 lang="ru" |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
13 rev="21"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
14 |
110
40eec261c2a6
Added proper support for anonymous sections, notably for the summary.
Ruslan Ermilov <ru@nginx.com>
parents:
106
diff
changeset
|
15 <section id="summary"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
16 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
17 <para> |
379 | 18 Модуль <literal>ngx_http_ssl_module</literal> обеспечивает работу |
19 по протоколу HTTPS. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
20 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
21 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
22 <para> |
379 | 23 По умолчанию этот модуль не собирается, его сборку необходимо |
24 разрешить с помощью конфигурационного параметра | |
271 | 25 <literal>--with-http_ssl_module</literal>. |
379 | 26 <note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
27 Для сборки и работы этого модуля нужна библиотека |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
28 <link url="http://www.openssl.org">OpenSSL</link>. |
379 | 29 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
30 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
31 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
32 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
33 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
34 |
379 | 35 <section id="example" name="Пример конфигурации"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
36 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
37 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
38 Для уменьшения загрузки процессора рекомендуется |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
39 <list type="bullet"> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
40 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
41 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
42 установить число рабочих процессов равным числу процессоров, |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
43 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
44 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
45 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
46 разрешить keep-alive соединения, |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
47 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
48 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
49 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
50 включить разделяемый кэш сессий, |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
51 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
52 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
53 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
54 выключить встроенный кэш сессий |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
55 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
56 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
57 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
58 и, возможно, увеличить время жизни сессии (по умолчанию 5 минут): |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
59 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
60 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
61 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
62 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
63 <example> |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
64 <emphasis>worker_processes auto;</emphasis> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
65 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
66 http { |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
67 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
68 ... |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
69 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
70 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
71 listen 443 ssl; |
379 | 72 <emphasis>keepalive_timeout 70;</emphasis> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
73 |
1411
8fe28c6edaa1
Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents:
1239
diff
changeset
|
74 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; |
379 | 75 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
76 ssl_certificate /usr/local/nginx/conf/cert.pem; | |
77 ssl_certificate_key /usr/local/nginx/conf/cert.key; | |
78 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> | |
79 <emphasis>ssl_session_timeout 10m;</emphasis> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
80 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
81 ... |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
82 } |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
83 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
84 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
85 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
86 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
87 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
88 |
379 | 89 <section id="directives" name="Директивы"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
90 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
91 <directive name="ssl"> |
271 | 92 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
93 <default>off</default> |
379 | 94 <context>http</context> |
95 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
96 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
97 <para> |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
98 Включает протокол HTTPS для данного виртуального сервера. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
99 <note> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
100 Вместо этой директивы рекомендуется использовать параметр |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
101 <literal>ssl</literal> директивы |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
102 <link doc="ngx_http_core_module.xml" id="listen"/>. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
103 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
104 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
105 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
106 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
107 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
108 |
1039
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
109 <directive name="ssl_buffer_size"> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
110 <syntax><value>size</value></syntax> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
111 <default>16k</default> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
112 <context>http</context> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
113 <context>server</context> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
114 <appeared-in>1.5.9</appeared-in> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
115 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
116 <para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
117 Задаёт размер буфера, используемого при отправке данных. |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
118 </para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
119 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
120 <para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
121 По умолчанию размер буфера равен 16k, что соответствует минимальным |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
122 накладным расходам при передаче больших ответов. |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
123 С целью минимизации времени получения начала ответа (Time To First Byte) |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
124 может быть полезно использовать меньшие значения, |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
125 например: |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
126 <example> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
127 ssl_buffer_size 4k; |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
128 </example> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
129 </para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
130 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
131 </directive> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
132 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
133 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
134 <directive name="ssl_certificate"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
135 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
136 <default/> |
379 | 137 <context>http</context> |
138 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
139 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
140 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
141 Указывает <value>файл</value> с сертификатом в формате PEM |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
142 для данного виртуального сервера. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
143 Если вместе с основным сертификатом нужно указать промежуточные, |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
144 то они должны находиться в этом же файле в следующем порядке: сначала |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
145 основной сертификат, а затем промежуточные. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
146 В этом же файле может находиться секретный ключ в формате PEM. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
147 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
148 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
149 <para> |
280 | 150 Нужно иметь в виду, что из-за ограничения протокола HTTPS |
379 | 151 виртуальные серверы должны слушать на разных IP-адресах: |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
152 <example> |
379 | 153 server { |
154 listen 192.168.1.1:443; | |
155 server_name one.example.com; | |
156 ssl_certificate /usr/local/nginx/conf/one.example.com.cert; | |
157 ... | |
158 } | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
159 |
379 | 160 server { |
161 listen 192.168.1.2:443; | |
162 server_name two.example.com; | |
163 ssl_certificate /usr/local/nginx/conf/two.example.com.cert; | |
164 ... | |
165 } | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
166 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
167 иначе для второго сайта будет выдаваться |
379 | 168 <link doc="configuring_https_servers.xml" |
169 id="name_based_https_servers">сертификат первого сервера</link>. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
170 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
171 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
172 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
173 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
174 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
175 <directive name="ssl_certificate_key"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
176 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
177 <default/> |
379 | 178 <context>http</context> |
179 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
180 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
181 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
182 Указывает <value>файл</value> с секретным ключом в формате PEM |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
183 для данного виртуального сервера. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
184 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
185 |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
186 <para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
187 Вместо <value>файла</value> можно указать значение |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
188 <literal>engine</literal>:<value>имя</value>:<value>id</value> (1.7.9), |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
189 которое загружает ключ с указанным <value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
190 из OpenSSL engine с заданным <value>именем</value>. |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
191 </para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
192 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
193 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
194 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
195 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
196 <directive name="ssl_ciphers"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
197 <syntax><value>шифры</value></syntax> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
198 <default>HIGH:!aNULL:!MD5</default> |
379 | 199 <context>http</context> |
200 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
201 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
202 <para> |
379 | 203 Описывает разрешённые шифры. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
204 Шифры задаются в формате, поддерживаемом библиотекой |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
205 OpenSSL, например: |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
206 <example> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
207 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
208 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
209 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
210 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
211 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
212 Полный список можно посмотреть с помощью команды |
271 | 213 “<command>openssl ciphers</command>”. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
214 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
215 |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
216 <para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
217 <note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
218 В предыдущих версиях nginx по умолчанию использовались |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
219 <link doc="configuring_https_servers.xml" id="compatibility">другие</link> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
220 шифры. |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
221 </note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
222 </para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
223 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
224 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
225 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
226 |
379 | 227 <directive name="ssl_client_certificate"> |
228 <syntax><value>файл</value></syntax> | |
229 <default/> | |
230 <context>http</context> | |
231 <context>server</context> | |
232 | |
233 <para> | |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
234 Указывает <value>файл</value> с доверенными сертификатами CA в формате |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
235 PEM, которые используются для |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
236 <link id="ssl_verify_client">проверки</link> клиентских сертификатов и |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
237 ответов OCSP, если включён <link id="ssl_stapling"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
238 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
239 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
240 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
241 Список сертификатов будет отправляться клиентам. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
242 Если это нежелательно, можно воспользоваться директивой |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
243 <link id="ssl_trusted_certificate"/>. |
379 | 244 </para> |
245 | |
246 </directive> | |
247 | |
248 | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
249 <directive name="ssl_crl"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
250 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
251 <default/> |
379 | 252 <context>http</context> |
253 <context>server</context> | |
254 <appeared-in>0.8.7</appeared-in> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
255 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
256 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
257 Указывает <value>файл</value> с отозванными сертификатами (CRL) |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
258 в формате PEM, используемыми для |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
259 <link id="ssl_verify_client">проверки</link> клиентских сертификатов. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
260 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
261 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
262 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
263 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
264 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
265 <directive name="ssl_dhparam"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
266 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
267 <default/> |
379 | 268 <context>http</context> |
269 <context>server</context> | |
270 <appeared-in>0.7.2</appeared-in> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
271 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
272 <para> |
1706
6f5497797cde
Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents:
1522
diff
changeset
|
273 Указывает <value>файл</value> с параметрами для DHE-шифров. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
274 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
275 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
276 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
277 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
278 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
279 <directive name="ssl_ecdh_curve"> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
280 <syntax><value>кривая</value></syntax> |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
281 <default>auto</default> |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
282 <context>http</context> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
283 <context>server</context> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
284 <appeared-in>1.1.0</appeared-in> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
285 <appeared-in>1.0.6</appeared-in> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
286 |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
287 <para> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
288 Задаёт кривую для ECDHE-шифров. |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
289 </para> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
290 |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
291 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
292 При использовании OpenSSL 1.0.2 и выше |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
293 можно указывать несколько кривых (1.11.0), например: |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
294 <example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
295 ssl_ecdh_curve prime256v1:secp384r1; |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
296 </example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
297 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
298 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
299 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
300 Специальное значение <literal>auto</literal> (1.11.0) соответствует |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
301 встроенному в библиотеку OpenSSL списку кривых для OpenSSL 1.0.2 и выше, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
302 или <literal>prime256v1</literal> для более старых версий. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
303 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
304 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
305 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
306 <note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
307 До версии 1.11.0 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
308 по умолчанию использовалась кривая <literal>prime256v1</literal>. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
309 </note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
310 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
311 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
312 </directive> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
313 |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
314 |
1239
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
315 <directive name="ssl_password_file"> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
316 <syntax><value>файл</value></syntax> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
317 <default/> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
318 <context>http</context> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
319 <context>server</context> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
320 <appeared-in>1.7.3</appeared-in> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
321 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
322 <para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
323 Задаёт <value>файл</value> с паролями от |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
324 <link id="ssl_certificate_key">секретных ключей</link>, |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
325 где каждый пароль указан на отдельной строке. |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
326 Пароли применяются по очереди в момент загрузки ключа. |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
327 </para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
328 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
329 <para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
330 Пример: |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
331 <example> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
332 http { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
333 ssl_password_file /etc/keys/global.pass; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
334 ... |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
335 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
336 server { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
337 server_name www1.example.com; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
338 ssl_certificate_key /etc/keys/first.key; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
339 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
340 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
341 server { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
342 server_name www2.example.com; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
343 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
344 # вместо файла можно указать именованный канал |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
345 ssl_password_file /etc/keys/fifo; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
346 ssl_certificate_key /etc/keys/second.key; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
347 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
348 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
349 </example> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
350 </para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
351 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
352 </directive> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
353 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
354 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
355 <directive name="ssl_prefer_server_ciphers"> |
271 | 356 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
357 <default>off</default> |
379 | 358 <context>http</context> |
359 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
360 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
361 <para> |
379 | 362 Указывает, чтобы при использовании протоколов SSLv3 и TLS |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
363 серверные шифры были более приоритетны, чем клиентские. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
364 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
365 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
366 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
367 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
368 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
369 <directive name="ssl_protocols"> |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
370 <syntax> |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
371 [<literal>SSLv2</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
372 [<literal>SSLv3</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
373 [<literal>TLSv1</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
374 [<literal>TLSv1.1</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
375 [<literal>TLSv1.2</literal>]</syntax> |
1499
3687cc9a3592
Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1456
diff
changeset
|
376 <default>TLSv1 TLSv1.1 TLSv1.2</default> |
379 | 377 <context>http</context> |
378 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
379 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
380 <para> |
379 | 381 Разрешает указанные протоколы. |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
382 Параметры <literal>TLSv1.1</literal> и <literal>TLSv1.2</literal> работают |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
383 только при использовании библиотеки OpenSSL версии 1.0.1 и выше. |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
384 <note> |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
385 Параметры <literal>TLSv1.1</literal> и <literal>TLSv1.2</literal> поддерживаются |
393
b83d332fbdaa
Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents:
383
diff
changeset
|
386 только начиная с версий 1.1.13 и 1.0.12, |
b83d332fbdaa
Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents:
383
diff
changeset
|
387 поэтому при использовании OpenSSL версии 1.0.1 |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
388 и выше на старых версиях nginx эти протоколы работать будут, однако их нельзя |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
389 будет отключить. |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
390 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
391 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
392 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
393 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
394 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
395 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
396 <directive name="ssl_session_cache"> |
271 | 397 <syntax> |
379 | 398 <literal>off</literal> | |
399 <literal>none</literal> | | |
400 [<literal>builtin</literal>[:<value>размер</value>]] | |
401 [<literal>shared</literal>:<value>название</value>:<value>размер</value>]</syntax> | |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
402 <default>none</default> |
379 | 403 <context>http</context> |
404 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
405 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
406 <para> |
379 | 407 Задаёт тип и размеры кэшей для хранения параметров сессий. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
408 Тип кэша может быть следующим: |
379 | 409 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
410 |
379 | 411 <tag-name><literal>off</literal></tag-name> |
412 <tag-desc> | |
413 жёсткое запрещение использования кэша сессий: | |
1522
ee91c95fca48
Corrected Russian translation of the ssl_session_cache directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
414 nginx явно сообщает клиенту, что сессии не могут использоваться повторно. |
379 | 415 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
416 |
379 | 417 <tag-name><literal>none</literal></tag-name> |
418 <tag-desc> | |
419 мягкое запрещение использования кэша сессий: | |
1522
ee91c95fca48
Corrected Russian translation of the ssl_session_cache directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
420 nginx сообщает клиенту, что сессии могут использоваться повторно, но |
966 | 421 на самом деле не хранит параметры сессии в кэше. |
379 | 422 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
423 |
379 | 424 <tag-name><literal>builtin</literal></tag-name> |
425 <tag-desc> | |
426 встроенный в OpenSSL кэш, используется в рамках только одного рабочего процесса. | |
427 Размер кэша задаётся в сессиях. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
428 Если размер не задан, то он равен 20480 сессиям. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
429 Использование встроенного кэша может вести к фрагментации памяти. |
379 | 430 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
431 |
379 | 432 <tag-name><literal>shared</literal></tag-name> |
433 <tag-desc> | |
966 | 434 кэш, разделяемый между всеми рабочими процессами. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
435 Размер кэша задаётся в байтах, в 1 мегабайт может поместиться |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
436 около 4000 сессий. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
437 У каждого разделяемого кэша должно быть произвольное название. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
438 Кэш с одинаковым названием может использоваться в нескольких |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
439 виртуальных серверах. |
379 | 440 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
441 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
442 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
443 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
444 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
445 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
446 Можно использовать одновременно оба типа кэша, например: |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
447 <example> |
379 | 448 ssl_session_cache builtin:1000 shared:SSL:10m; |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
449 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
450 однако использование только разделяемого кэша без встроенного должно |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
451 быть более эффективным. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
452 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
453 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
454 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
455 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
456 |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
457 <directive name="ssl_session_ticket_key"> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
458 <syntax><value>файл</value></syntax> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
459 <default/> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
460 <context>http</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
461 <context>server</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
462 <appeared-in>1.5.7</appeared-in> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
463 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
464 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
465 Задаёт <value>файл</value> с секретным ключом, применяемым при шифровании и |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
466 расшифровании TLS session tickets. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
467 Директива необходима, если один и тот же ключ нужно использовать |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
468 на нескольких серверах. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
469 По умолчанию используется случайно сгенерированный ключ. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
470 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
471 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
472 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
473 Если указано несколько ключей, то только первый ключ |
1020 | 474 используется для шифрования TLS session tickets. |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
475 Это позволяет настроить ротацию ключей, например: |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
476 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
477 ssl_session_ticket_key current.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
478 ssl_session_ticket_key previous.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
479 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
480 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
481 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
482 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
483 <value>Файл</value> должен содержать 48 байт случайных данных и может быть |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
484 создан следующей командой: |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
485 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
486 openssl rand 48 > ticket.key |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
487 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
488 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
489 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
490 </directive> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
491 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
492 |
1055
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
493 <directive name="ssl_session_tickets"> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
494 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
495 <default>on</default> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
496 <context>http</context> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
497 <context>server</context> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
498 <appeared-in>1.5.9</appeared-in> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
499 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
500 <para> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
501 Разрешает или запрещает возобновление сессий при помощи |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
502 <link url="http://tools.ietf.org/html/rfc5077">TLS session tickets</link>. |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
503 </para> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
504 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
505 </directive> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
506 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
507 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
508 <directive name="ssl_session_timeout"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
509 <syntax><value>время</value></syntax> |
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
510 <default>5m</default> |
379 | 511 <context>http</context> |
512 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
513 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
514 <para> |
379 | 515 Задаёт время, в течение которого клиент может повторно |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
516 использовать параметры сессии, хранящейся в кэше. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
517 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
518 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
519 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
520 |
379 | 521 |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
522 <directive name="ssl_stapling"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
523 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
524 <default>off</default> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
525 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
526 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
527 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
528 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
529 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
530 Разрешает или запрещает |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
531 <link url="http://tools.ietf.org/html/rfc4366#section-3.6">прикрепление |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
532 OCSP-ответов</link> сервером. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
533 Пример: |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
534 <example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
535 ssl_stapling on; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
536 resolver 192.0.2.1; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
537 </example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
538 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
539 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
540 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
541 Для работы OCSP stapling’а должен быть известен сертификат издателя |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
542 сертификата сервера. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
543 Если в заданном директивой <link id="ssl_certificate"/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
544 файле не содержится промежуточных сертификатов, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
545 то сертификат издателя сертификата сервера следует поместить в файл, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
546 заданный директивой <link id="ssl_trusted_certificate"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
547 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
548 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
549 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
550 Для преобразования имени хоста OCSP responder’а в адрес необходимо |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
551 дополнительно задать директиву |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
552 <link doc="ngx_http_core_module.xml" id="resolver"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
553 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
554 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
555 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
556 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
557 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
558 <directive name="ssl_stapling_file"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
559 <syntax><value>файл</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
560 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
561 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
562 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
563 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
564 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
565 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
566 Если задано, то вместо опроса OCSP responder’а, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
567 указанного в сертификате сервера, |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
568 ответ берётся из указанного <value>файла</value>. |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
569 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
570 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
571 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
572 Ответ должен быть в формате DER и может быть сгенерирован командой |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
573 “<literal>openssl ocsp</literal>”. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
574 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
575 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
576 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
577 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
578 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
579 <directive name="ssl_stapling_responder"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
580 <syntax><value>url</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
581 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
582 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
583 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
584 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
585 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
586 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
587 Переопределяет URL OCSP responder’а, указанный в расширении сертификата |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
588 “<link url="http://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
589 Information Access</link>”. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
590 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
591 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
592 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
593 Поддерживаются только “<literal>http://</literal>” OCSP responder’ы: |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
594 <example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
595 ssl_stapling_responder http://ocsp.example.com/; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
596 </example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
597 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
598 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
599 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
600 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
601 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
602 <directive name="ssl_stapling_verify"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
603 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
604 <default>off</default> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
605 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
606 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
607 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
608 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
609 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
610 Разрешает или запрещает проверку сервером ответов OCSP. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
611 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
612 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
613 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
614 Для работоспособности проверки сертификат издателя сертификата сервера, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
615 корневой сертификат и все промежуточные сертификаты должны быть указаны |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
616 как доверенные с помощью директивы |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
617 <link id="ssl_trusted_certificate"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
618 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
619 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
620 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
621 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
622 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
623 <directive name="ssl_trusted_certificate"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
624 <syntax><value>файл</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
625 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
626 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
627 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
628 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
629 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
630 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
631 Задаёт <value>файл</value> с доверенными сертификатами CA в формате PEM, |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
632 которые используются для <link id="ssl_verify_client">проверки</link> |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
633 клиентских сертификатов и ответов OCSP, |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
634 если включён <link id="ssl_stapling"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
635 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
636 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
637 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
638 В отличие от <link id="ssl_client_certificate"/>, список этих сертификатов |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
639 не будет отправляться клиентам. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
640 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
641 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
642 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
643 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
644 |
379 | 645 <directive name="ssl_verify_client"> |
646 <syntax> | |
647 <literal>on</literal> | <literal>off</literal> | | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
648 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
379 | 649 <default>off</default> |
650 <context>http</context> | |
651 <context>server</context> | |
652 | |
653 <para> | |
654 Разрешает проверку клиентских сертификатов. | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
655 Результат проверки доступен через переменную |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
656 <var>$ssl_client_verify</var>. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
657 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
658 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
659 <para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
660 Параметр <literal>optional</literal> (0.8.7+) запрашивает клиентский |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
661 сертификат, и если сертификат был предоставлен, проверяет его. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
662 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
663 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
664 <para> |
763
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
665 Параметр <literal>optional_no_ca</literal> (1.3.8, 1.2.5) |
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
666 запрашивает сертификат |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
667 клиента, но не требует, чтобы он был подписан доверенным сертификатом CA. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
668 Это предназначено для случаев, когда фактическая проверка сертификата |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
669 осуществляется внешним по отношению к nginx’у сервисом. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
670 Содержимое сертификата доступно через переменную |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
671 <var>$ssl_client_cert</var>. |
379 | 672 </para> |
673 | |
674 </directive> | |
675 | |
676 | |
677 <directive name="ssl_verify_depth"> | |
678 <syntax><value>число</value></syntax> | |
679 <default>1</default> | |
680 <context>http</context> | |
681 <context>server</context> | |
682 | |
683 <para> | |
684 Устанавливает глубину проверки в цепочке клиентских сертификатов. | |
685 </para> | |
686 | |
687 </directive> | |
688 | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
689 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
690 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
691 |
379 | 692 <section id="errors" name="Обработка ошибок"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
693 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
694 <para> |
379 | 695 Модуль <literal>ngx_http_ssl_module</literal> поддерживает несколько |
696 нестандартных кодов ошибок, которые можно использовать для | |
697 перенаправления с помощью директивы | |
106
56457a474903
If text of the link is not provided, the @id is used.
Ruslan Ermilov <ru@nginx.com>
parents:
102
diff
changeset
|
698 <link doc="ngx_http_core_module.xml" id="error_page"/>: |
379 | 699 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
700 |
379 | 701 <tag-name>495</tag-name> |
702 <tag-desc> | |
703 при проверке клиентского сертификата произошла ошибка; | |
704 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
705 |
379 | 706 <tag-name>496</tag-name> |
707 <tag-desc> | |
708 клиент не предоставил требуемый сертификат; | |
709 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
710 |
379 | 711 <tag-name>497</tag-name> |
712 <tag-desc> | |
713 обычный запрос был послан на порт HTTPS. | |
714 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
715 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
716 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
717 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
718 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
719 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
720 Перенаправление делается после того, как запрос полностью разобран |
379 | 721 и доступны такие переменные, как <var>$request_uri</var>, |
966 | 722 <var>$uri</var>, <var>$args</var> и другие переменные. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
723 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
724 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
725 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
726 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
727 |
379 | 728 <section id="variables" name="Встроенные переменные"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
729 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
730 <para> |
379 | 731 Модуль <literal>ngx_http_ssl_module</literal> поддерживает |
732 несколько встроенных переменных: | |
733 <list type="tag"> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
734 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
735 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name> |
379 | 736 <tag-desc> |
737 возвращает строку используемых шифров для установленного SSL-соединения; | |
738 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
739 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
740 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name> |
379 | 741 <tag-desc> |
742 возвращает клиентский сертификат | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
743 для установленного SSL-соединения в формате PEM |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
744 перед каждой строкой которого, кроме первой, вставляется символ табуляции; |
383
a73fa21add8a
Removed a misleading sentence.
Ruslan Ermilov <ru@nginx.com>
parents:
379
diff
changeset
|
745 предназначена для использования в директиве |
379 | 746 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/>; |
747 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
748 |
1201
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
749 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
750 <tag-desc> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
751 возвращает SHA1-отпечаток клиентского сертификата |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
752 для установленного SSL-соединения (1.7.1); |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
753 </tag-desc> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
754 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
755 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var> |
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
756 </tag-name> |
379 | 757 <tag-desc> |
758 возвращает клиентский сертификат | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
759 для установленного SSL-соединения в формате PEM; |
379 | 760 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
761 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
762 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name> |
379 | 763 <tag-desc> |
764 возвращает серийный номер клиентского сертификата | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
765 для установленного SSL-соединения; |
379 | 766 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
767 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
768 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name> |
379 | 769 <tag-desc> |
770 возвращает строку “subject DN” клиентского сертификата | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
771 для установленного SSL-соединения; |
379 | 772 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
773 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
774 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name> |
379 | 775 <tag-desc> |
776 возвращает строку “issuer DN” клиентского сертификата | |
777 для установленного SSL-соединения; | |
778 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
779 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
780 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name> |
379 | 781 <tag-desc> |
782 возвращает результат проверки клиентского сертификата: | |
783 “<literal>SUCCESS</literal>”, “<literal>FAILED</literal>” и, | |
784 если сертификат не был предоставлен — “<literal>NONE</literal>”; | |
785 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
786 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
787 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name> |
379 | 788 <tag-desc> |
789 возвращает протокол установленного SSL-соединения; | |
790 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
791 |
1167
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
792 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
793 <tag-desc> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
794 возвращает имя сервера, запрошенное через |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
795 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
796 (1.7.0); |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
797 </tag-desc> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
798 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
799 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name> |
379 | 800 <tag-desc> |
1072
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
801 возвращает идентификатор сессии установленного SSL-соединения; |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
802 </tag-desc> |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
803 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
804 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name> |
1072
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
805 <tag-desc> |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
806 возвращает “<literal>r</literal>”, если сессия была использована повторно, |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
807 иначе “<literal>.</literal>” (1.5.11). |
379 | 808 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
809 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
810 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
811 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
812 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
813 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
814 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
815 </module> |