Mercurial > hg > nginx-site

annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 589:764fbac1b8b4

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Added document revision.
author Ruslan Ermilov <ru@nginx.com>
date Tue, 17 Jul 2012 05:02:15 +0000
parents be54c443235a
children 2eb83e89b239
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1 <?xml version="1.0"?>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
3 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
4 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
5 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
6 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
7
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 <module name="Module ngx_http_ssl_module"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 link="/en/docs/http/ngx_http_ssl_module.html"
589
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
12 lang="en"
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
13 rev="1">
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 <section id="summary">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 The <literal>ngx_http_ssl_module</literal> module provides the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 necessary support for HTTPS.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 This module is not built by default, it should be enabled with the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24 <literal>--with-http_ssl_module</literal>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 configuration parameter.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26 <note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 This module requires the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28 <link url="http://www.openssl.org">OpenSSL</link> library.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
29 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 <section id="example" name="Example Configuration">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 To reduce the processor load it is recommended to
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 <list type="bullet">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 set the number of worker processes equal to the number of processors,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 enable keep-alive connections,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50 enable shared session cache,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54 disable built-in session cache,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 and possibly increase the session lifetime (by default, 5 minutes):
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
63 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64 <emphasis>worker_processes 2;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 http {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 listen 443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72 <emphasis>keepalive_timeout 70;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74 ssl on;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 ssl_certificate /usr/local/nginx/conf/cert.pem;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 ssl_certificate_key /usr/local/nginx/conf/cert.key;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 <emphasis>ssl_session_timeout 10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 <section id="directives" name="Directives">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 <directive name="ssl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 Enables the HTTPS protocol for the given virtual server.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105 <directive name="ssl_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112 Specifies a file with a certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 for the given virtual server.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114 If intermediate certificates should be specified in addition
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 to a primary certificate, they should be specified in the same file
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116 in the following order: the primary certificate comes first, then
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 the intermediate certificates.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 A secret key in the PEM format may be placed in the same file.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 It should be kept in mind that due to the HTTPS protocol limitations
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123 virtual servers should listen on different IP addresses:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 listen 192.168.1.1:443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 server_name one.example.com;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 ssl_certificate /usr/local/nginx/conf/one.example.com.cert;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 listen 192.168.1.2:443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 server_name two.example.com;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 ssl_certificate /usr/local/nginx/conf/two.example.com.cert;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 otherwise
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 <link doc="configuring_https_servers.xml"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 id="name_based_https_servers">the first server’s certificate</link>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 will be issued for the second site.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 <directive name="ssl_certificate_key">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 Specifies a file with a secret key in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 for the given virtual server.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 <directive name="ssl_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 <syntax><value>ciphers</value></syntax>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
164 <default>HIGH:!aNULL:!MD5</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 Specifies the enabled ciphers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170 The ciphers are specified in the format understood by the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 OpenSSL library, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 <example>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
173 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178 The full list can be viewed using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 “<command>openssl ciphers</command>” command.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
182 <para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
183 <note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
184 The previous versions of nginx used
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
185 <link doc="configuring_https_servers.xml" id="compatibility">different</link>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
186 ciphers by default.
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
187 </note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
188 </para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
189
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
190 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 <directive name="ssl_client_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200 Specifies a file with CA certificates in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 used for client certificate verification.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
202 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 <directive name="ssl_crl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 <appeared-in>0.8.7</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215 Specifies a file with revoked certificates (CRL)
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 in the PEM format, used to client certificate verification.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
218
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222 <directive name="ssl_dhparam">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
226 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227 <appeared-in>0.7.2</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 Specifies a file with DH parameters for EDH ciphers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
232
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
233 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
234
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236 <directive name="ssl_prefer_server_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
237 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
239 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
240 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
241
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
242 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
243 Specifies that server ciphers should be preferred over client
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244 ciphers when using the SSLv3 and TLS protocols.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
246
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250 <directive name="ssl_protocols">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 [<literal>SSLv2</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 [<literal>SSLv3</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 [<literal>TLSv1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255 [<literal>TLSv1.1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 [<literal>TLSv1.2</literal>]</syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257 <default>SSLv3 TLSv1 TLSv1.1 TLSv1.2</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
258 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262 Enables the specified protocols.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 The parameters <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> work
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264 only when using the OpenSSL library version 1.0.1 and higher.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 <note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266 The parameters <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> are
393
b83d332fbdaa Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents: 384
diff changeset
267 supported starting from versions 1.1.13 and 1.0.12
b83d332fbdaa Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents: 384
diff changeset
268 so when using OpenSSL version 1.0.1
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269 and higher on older nginx versions these protocols will work but could not
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 be disabled.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277 <directive name="ssl_session_cache">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 <literal>off</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 <literal>none</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281 [<literal>builtin</literal>[:<value>size</value>]]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283 <default>none</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 Sets types and sizes of caches that store session parameters.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289 A cache can be any of the following types:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 <tag-name><literal>off</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 the use of session cache is strictly prohibited:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295 nginx explicitly tells a client that sessions may not be reused.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298 <tag-name><literal>none</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 the use of session cache is gently disallowed:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301 nginx tells a client that sessions may be reused, but does not
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302 actually do that.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
305 <tag-name><literal>builtin</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
307 a cache built in OpenSSL; used by one worker process only.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
308 The cache size is specified in sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309 If size is not given, it is equal to 20480 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 Use of the built-in cache can cause memory fragmentation.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313 <tag-name><literal>shared</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315 shared between all worker processes.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316 The cache size is specified in bytes; one megabyte can store
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
317 about 4000 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318 Each shared cache should have an arbitrary name.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319 A cache with the same name can be used in several virtual servers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
323 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
324
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326 Both cache types can be used simultaneously, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
327 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
328 ssl_session_cache builtin:1000 shared:SSL:10m;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
330 but using only shared cache without the built-in cache should
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
331 be more efficient.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
332 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 <directive name="ssl_session_timeout">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 <syntax><value>time</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339 <default>5m</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
342
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344 Specifies a time during which a client may reuse the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345 session parameters stored in a cache.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 <directive name="ssl_verify_client">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 <literal>on</literal> | <literal>off</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 <literal>optional</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
355 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360 Enables the client certificate verification.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361 The <literal>optional</literal> parameter (0.8.7+) requests the client
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362 certificate and verifies it if it was present.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363 The result of verification is stored in the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364 <var>$ssl_client_verify</var> variable.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 <directive name="ssl_verify_depth">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371 <syntax><value>number</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 <default>1</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 Sets a verification depth in the client certificates chain.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 <section id="errors" name="Error Processing">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
387 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 The <literal>ngx_http_ssl_module</literal> module supports several
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 non-standard error codes that can be used for redirects using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 <link doc="ngx_http_core_module.xml" id="error_page"/> directive:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393 <tag-name>495</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395 an error has occurred during the client certificate verification;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398 <tag-name>496</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400 a client did not present the required certificate;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 <tag-name>497</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 a regular request was sent to the HTTPS port.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412 A redirection happens after the request was fully parsed and
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
413 variables such as <var>$request_uri</var>,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 <var>$uri</var>, <var>$args</var> and others were made available.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420 <section id="variables" name="Embedded Variables">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
421
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
422 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423 The <literal>ngx_http_ssl_module</literal> module supports
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 several embedded variables:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427 <tag-name><var>$ssl_cipher</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 returns the string of ciphers used
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433 <tag-name><var>$ssl_client_cert</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
436 for an established SSL connection, with each line except the first
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437 prepended with the tab character;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438 this is intended for the use in the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
440 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
441
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
442 <tag-name><var>$ssl_client_raw_cert</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
447
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448 <tag-name><var>$ssl_client_serial</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450 returns the serial number of the client certificate
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454 <tag-name><var>$ssl_client_s_dn</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456 returns the “subject DN” string of the client certificate
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 <tag-name><var>$ssl_client_i_dn</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462 returns the “issuer DN” string of the client certificate
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
463 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
464 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
465
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
466 <tag-name><var>$ssl_client_verify</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468 returns the result of client certificate verification:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469 “<literal>SUCCESS</literal>”, “<literal>FAILED</literal>”, and
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
470 “<literal>NONE</literal>” if a certificate was not present;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
471 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
472
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473 <tag-name><var>$ssl_protocol</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475 returns the protocol of an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
477
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478 <tag-name><var>$ssl_session_id</var></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480 returns the session identifier of an established SSL connection.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
482
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
483 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
484 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 </module>