Mercurial > hg > nginx-site

annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 2350:8e35f3af574b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Documented the "data:" syntax for ssl_certificate and key.
author Yaroslav Zhuravlev <yar@nginx.com>
date Tue, 26 Mar 2019 17:09:15 +0300
parents dbe55598d3f6
children d323beea61ec
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1 <?xml version="1.0"?>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
3 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
4 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
5 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
6 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
7
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 <module name="Module ngx_http_ssl_module"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 link="/en/docs/http/ngx_http_ssl_module.html"
589
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
12 lang="en"
2350
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
13 rev="46">
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 <section id="summary">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 The <literal>ngx_http_ssl_module</literal> module provides the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 necessary support for HTTPS.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 This module is not built by default, it should be enabled with the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24 <literal>--with-http_ssl_module</literal>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 configuration parameter.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26 <note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 This module requires the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28 <link url="http://www.openssl.org">OpenSSL</link> library.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
29 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 <section id="example" name="Example Configuration">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 To reduce the processor load it is recommended to
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 <list type="bullet">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 <listitem>
2068
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
42 set the number of
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
43 <link doc="../ngx_core_module.xml" id="worker_processes">worker processes</link>
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
44 equal to the number of processors,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 <listitem>
2068
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
48 enable
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
49 <link doc="ngx_http_core_module.xml" id="keepalive_timeout">keep-alive</link>
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
50 connections,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 <listitem>
2068
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
54 enable the <link id="ssl_session_cache_shared">shared</link> session cache,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 <listitem>
2068
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
58 disable the <link id="ssl_session_cache_builtin">built-in</link> session cache,
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
59 </listitem>
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
60
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
61 <listitem>
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
62 and possibly increase the session <link id="ssl_session_timeout">lifetime</link>
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
63 (by default, 5 minutes):
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 <example>
817
4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents: 801
diff changeset
69 <emphasis>worker_processes auto;</emphasis>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 http {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
76 listen 443 ssl;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 <emphasis>keepalive_timeout 70;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78
1411
8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents: 1239
diff changeset
79 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 ssl_certificate /usr/local/nginx/conf/cert.pem;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 ssl_certificate_key /usr/local/nginx/conf/cert.key;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 <emphasis>ssl_session_timeout 10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 <section id="directives" name="Directives">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 <directive name="ssl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102 <para>
2168
3535437f97d2 Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2162
diff changeset
103 This directive was made obsolete in version 1.15.0.
3535437f97d2 Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2162
diff changeset
104 The <literal>ssl</literal> parameter
3535437f97d2 Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2162
diff changeset
105 of the <link doc="ngx_http_core_module.xml" id="listen"/> directive
3535437f97d2 Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2162
diff changeset
106 should be used instead.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111
1039
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
112 <directive name="ssl_buffer_size">
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
113 <syntax><value>size</value></syntax>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
114 <default>16k</default>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
115 <context>http</context>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
116 <context>server</context>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
117 <appeared-in>1.5.9</appeared-in>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
118
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
119 <para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
120 Sets the size of the buffer used for sending data.
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
121 </para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
122
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
123 <para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
124 By default, the buffer size is 16k, which corresponds to minimal
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
125 overhead when sending big responses.
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
126 To minimize Time To First Byte it may be beneficial to use smaller values,
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
127 for example:
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
128 <example>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
129 ssl_buffer_size 4k;
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
130 </example>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
131 </para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
132
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
133 </directive>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
134
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
135
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 <directive name="ssl_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
143 Specifies a <value>file</value> with the certificate in the PEM format
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144 for the given virtual server.
1457
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
145 If intermediate certificates should be specified in addition to a primary
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
146 certificate, they should be specified in the same file in the following
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
147 order: the primary certificate comes first, then the intermediate certificates.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 A secret key in the PEM format may be placed in the same file.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 <para>
1726
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
152 Since version 1.11.0,
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
153 this directive can be specified multiple times
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
154 to load certificates of different types, for example, RSA and ECDSA:
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
155 <example>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
156 server {
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
157 listen 443 ssl;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
158 server_name example.com;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
159
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
160 ssl_certificate example.com.rsa.crt;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
161 ssl_certificate_key example.com.rsa.key;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
162
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
163 ssl_certificate example.com.ecdsa.crt;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
164 ssl_certificate_key example.com.ecdsa.key;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
165
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
166 ...
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
167 }
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
168 </example>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
169 <note>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
170 Only OpenSSL 1.0.2 or higher supports separate
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
171 <link doc="configuring_https_servers.xml" id="chains">certificate chains</link>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
172 for different certificates.
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
173 With older versions, only one certificate chain can be used.
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
174 </note>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
175 </para>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
176
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
177 <para>
2334
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
178 Since version 1.15.9, variables can be used in the <value>file</value> name
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
179 when using OpenSSL 1.0.2 or higher:
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
180 <example>
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
181 ssl_certificate $ssl_server_name.crt;
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
182 ssl_certificate_key $ssl_server_name.key;
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
183 </example>
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
184 Note that using variables implies that
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
185 a certificate will be loaded for each SSL handshake,
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
186 and this may have a negative impact on performance.
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
187 </para>
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
188
2350
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
189 <para id="ssl_certificate_data">
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
190 The value
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
191 <literal>data</literal>:<value>$variable</value>
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
192 can be specified instead of the <value>file</value> (1.15.10),
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
193 which loads a certificate from a variable
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
194 without using intermediate files.
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
195 Note that inappropriate use of this syntax may have its security implications,
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
196 such as writing secret key data to
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
197 <link doc="../ngx_core_module.xml" id="error_log">error log</link>.
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
198 </para>
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
199
2334
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
200 <para>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 It should be kept in mind that due to the HTTPS protocol limitations
2040
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2027
diff changeset
202 for maximum interoperability virtual servers should listen on
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2027
diff changeset
203 <link doc="configuring_https_servers.xml" id="name_based_https_servers">different
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2027
diff changeset
204 IP addresses</link>.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 <directive name="ssl_certificate_key">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
217 Specifies a <value>file</value> with the secret key in the PEM format
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
218 for the given virtual server.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220
1456
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
221 <para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
222 The value
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
223 <literal>engine</literal>:<value>name</value>:<value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
224 can be specified instead of the <value>file</value> (1.7.9),
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
225 which loads a secret key with a specified <value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
226 from the OpenSSL engine <value>name</value>.
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
227 </para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
228
2350
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
229 <para id="ssl_certificate_key_data">
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
230 The value
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
231 <literal>data</literal>:<value>$variable</value>
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
232 can be specified instead of the <value>file</value> (1.15.10),
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
233 which loads a secret key from a variable without using intermediate files.
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
234 Note that inappropriate use of this syntax may have its security implications,
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
235 such as writing secret key data to
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
236 <link doc="../ngx_core_module.xml" id="error_log">error log</link>.
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
237 </para>
8e35f3af574b Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2334
diff changeset
238
2334
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
239 <para>
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
240 Since version 1.15.9, variables can be used in the <value>file</value> name
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
241 when using OpenSSL 1.0.2 or higher.
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
242 </para>
dbe55598d3f6 Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2296
diff changeset
243
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
246
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247 <directive name="ssl_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248 <syntax><value>ciphers</value></syntax>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
249 <default>HIGH:!aNULL:!MD5</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 Specifies the enabled ciphers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255 The ciphers are specified in the format understood by the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 OpenSSL library, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257 <example>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
258 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 The full list can be viewed using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264 “<command>openssl ciphers</command>” command.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
267 <para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
268 <note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
269 The previous versions of nginx used
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
270 <link doc="configuring_https_servers.xml" id="compatibility">different</link>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
271 ciphers by default.
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
272 </note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
273 </para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
274
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 <directive name="ssl_client_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
285 Specifies a <value>file</value> with trusted CA certificates in the PEM format
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
286 used to <link id="ssl_verify_client">verify</link> client certificates and
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
287 OCSP responses if <link id="ssl_stapling"/> is enabled.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
288 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
289
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
290 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
291 The list of certificates will be sent to clients.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
292 If this is not desired, the <link id="ssl_trusted_certificate"/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
293 directive can be used.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299 <directive name="ssl_crl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 <appeared-in>0.8.7</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
305
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
307 Specifies a <value>file</value> with revoked certificates (CRL)
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
308 in the PEM format used to <link id="ssl_verify_client">verify</link>
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
309 client certificates.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315 <directive name="ssl_dhparam">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
317 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 <appeared-in>0.7.2</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 <para>
1706
6f5497797cde Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents: 1499
diff changeset
323 Specifies a <value>file</value> with DH parameters for DHE ciphers.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
324 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325
2296
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
326 <para>
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
327 By default no parameters are set,
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
328 and therefore DHE ciphers will not be used.
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
329 <note>
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
330 Prior to version 1.11.0, builtin parameters were used by default.
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
331 </note>
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
332 </para>
e2e71f9477a8 Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2241
diff changeset
333
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336
2219
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
337 <directive name="ssl_early_data">
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
338 <syntax><literal>on</literal> | <literal>off</literal></syntax>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
339 <default>off</default>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
340 <context>http</context>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
341 <context>server</context>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
342 <appeared-in>1.15.3</appeared-in>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
343
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
344 <para>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
345 Enables or disables TLS 1.3
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
346 <link url="https://tools.ietf.org/html/rfc8446#section-2.3">early data</link>.
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
347 <note>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
348 Requests sent within early data are subject to
2238
0761b770a94e RFC8470.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2234
diff changeset
349 <link url="https://tools.ietf.org/html/rfc8470">replay attacks</link>.
2234
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
350 To protect against such attacks at the application layer,
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
351 the <link id="var_ssl_early_data">$ssl_early_data</link> variable
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
352 should be used.
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
353 </note>
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
354
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
355 <example>
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
356 proxy_set_header Early-Data $ssl_early_data;
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
357 </example>
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
358
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
359 <note>
2241
b7ac730b96f3 Documented TLS 1.3 early data support with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2238
diff changeset
360 The directive is supported when using OpenSSL 1.1.1 or higher (1.15.4) and
b7ac730b96f3 Documented TLS 1.3 early data support with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2238
diff changeset
361 <link url="https://boringssl.googlesource.com/boringssl/">BoringSSL</link>.
2219
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
362 </note>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
363 </para>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
364
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
365 </directive>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
366
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
367
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
368 <directive name="ssl_ecdh_curve">
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
369 <syntax><value>curve</value></syntax>
1711
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
370 <default>auto</default>
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
371 <context>http</context>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
372 <context>server</context>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
373 <appeared-in>1.1.0</appeared-in>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
374 <appeared-in>1.0.6</appeared-in>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
375
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
376 <para>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
377 Specifies a <value>curve</value> for ECDHE ciphers.
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
378 </para>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
379
1711
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
380 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
381 When using OpenSSL 1.0.2 or higher,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
382 it is possible to specify multiple curves (1.11.0), for example:
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
383 <example>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
384 ssl_ecdh_curve prime256v1:secp384r1;
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
385 </example>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
386 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
387
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
388 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
389 The special value <literal>auto</literal> (1.11.0) instructs nginx to use
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
390 a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
391 or <literal>prime256v1</literal> with older versions.
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
392 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
393
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
394 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
395 <note>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
396 Prior to version 1.11.0,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
397 the <literal>prime256v1</literal> curve was used by default.
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
398 </note>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
399 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
400
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
401 </directive>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
402
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
403
1239
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
404 <directive name="ssl_password_file">
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
405 <syntax><value>file</value></syntax>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
406 <default/>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
407 <context>http</context>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
408 <context>server</context>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
409 <appeared-in>1.7.3</appeared-in>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
410
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
411 <para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
412 Specifies a <value>file</value> with passphrases for
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
413 <link id="ssl_certificate_key">secret keys</link>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
414 where each passphrase is specified on a separate line.
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
415 Passphrases are tried in turn when loading the key.
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
416 </para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
417
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
418 <para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
419 Example:
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
420 <example>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
421 http {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
422 ssl_password_file /etc/keys/global.pass;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
423 ...
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
424
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
425 server {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
426 server_name www1.example.com;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
427 ssl_certificate_key /etc/keys/first.key;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
428 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
429
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
430 server {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
431 server_name www2.example.com;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
432
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
433 # named pipe can also be used instead of a file
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
434 ssl_password_file /etc/keys/fifo;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
435 ssl_certificate_key /etc/keys/second.key;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
436 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
437 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
438 </example>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
439 </para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
440
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
441 </directive>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
442
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
443
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 <directive name="ssl_prefer_server_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
447 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 Specifies that server ciphers should be preferred over client
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 ciphers when using the SSLv3 and TLS protocols.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 <directive name="ssl_protocols">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 [<literal>SSLv2</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461 [<literal>SSLv3</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462 [<literal>TLSv1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
463 [<literal>TLSv1.1</literal>]
1978
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
464 [<literal>TLSv1.2</literal>]
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
465 [<literal>TLSv1.3</literal>]</syntax>
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1457
diff changeset
466 <default>TLSv1 TLSv1.1 TLSv1.2</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
470 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
471 Enables the specified protocols.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
472 <note>
1978
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
473 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
474 (1.1.13, 1.0.12) work only when OpenSSL 1.0.1 or higher is used.
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
475 </note>
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
476 <note>
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
477 The <literal>TLSv1.3</literal> parameter (1.13.0) works only when
8f1a568a8bbf Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1923
diff changeset
478 OpenSSL 1.1.1 built with TLSv1.3 support is used.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
482 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
483
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
484
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485 <directive name="ssl_session_cache">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487 <literal>off</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 <literal>none</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
489 [<literal>builtin</literal>[:<value>size</value>]]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
491 <default>none</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
492 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
494
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
496 Sets the types and sizes of caches that store session parameters.
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
497 A cache can be of any of the following types:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
498 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
499
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
500 <tag-name><literal>off</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
501 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
502 the use of a session cache is strictly prohibited:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
503 nginx explicitly tells a client that sessions may not be reused.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
504 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
505
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
506 <tag-name><literal>none</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
507 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
508 the use of a session cache is gently disallowed:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
509 nginx tells a client that sessions may be reused, but does not
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
510 actually store session parameters in the cache.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
511 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
512
2068
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
513 <tag-name id="ssl_session_cache_builtin"><literal>builtin</literal></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
514 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
515 a cache built in OpenSSL; used by one worker process only.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
516 The cache size is specified in sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
517 If size is not given, it is equal to 20480 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
518 Use of the built-in cache can cause memory fragmentation.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
519 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
520
2068
3d9e7993c201 Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
521 <tag-name id="ssl_session_cache_shared"><literal>shared</literal></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
522 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
523 a cache shared between all worker processes.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
524 The cache size is specified in bytes; one megabyte can store
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
525 about 4000 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
526 Each shared cache should have an arbitrary name.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
527 A cache with the same name can be used in several virtual servers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
528 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
529
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
530 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
531 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
532
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
533 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
534 Both cache types can be used simultaneously, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
535 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
536 ssl_session_cache builtin:1000 shared:SSL:10m;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
537 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
538 but using only shared cache without the built-in cache should
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
539 be more efficient.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
540 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
541
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
542 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
543
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
544
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
545 <directive name="ssl_session_ticket_key">
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
546 <syntax><value>file</value></syntax>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
547 <default/>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
548 <context>http</context>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
549 <context>server</context>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
550 <appeared-in>1.5.7</appeared-in>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
551
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
552 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
553 Sets a <value>file</value> with the secret key used to encrypt
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
554 and decrypt TLS session tickets.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
555 The directive is necessary if the same key has to be shared between
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
556 multiple servers.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
557 By default, a randomly generated key is used.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
558 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
559
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
560 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
561 If several keys are specified, only the first key is
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
562 used to encrypt TLS session tickets.
1144
ac131944d349 Changed infinitive to gerund after "allow".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1072
diff changeset
563 This allows configuring key rotation, for example:
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
564 <example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
565 ssl_session_ticket_key current.key;
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
566 ssl_session_ticket_key previous.key;
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
567 </example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
568 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
569
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
570 <para>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
571 The <value>file</value> must contain 80 or 48 bytes
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
572 of random data and can be created using the following command:
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
573 <example>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
574 openssl rand 80 > ticket.key
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
575 </example>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
576 Depending on the file size either AES256 (for 80-byte keys, 1.11.8)
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
577 or AES128 (for 48-byte keys) is used for encryption.
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
578 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
579
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
580 </directive>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
581
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
582
1055
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
583 <directive name="ssl_session_tickets">
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
584 <syntax><literal>on</literal> | <literal>off</literal></syntax>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
585 <default>on</default>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
586 <context>http</context>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
587 <context>server</context>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
588 <appeared-in>1.5.9</appeared-in>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
589
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
590 <para>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
591 Enables or disables session resumption through
1923
66a30a380fba Fixed links to tools.ietf.org.
Ruslan Ermilov <ru@nginx.com>
parents: 1877
diff changeset
592 <link url="https://tools.ietf.org/html/rfc5077">TLS session tickets</link>.
1055
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
593 </para>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
594
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
595 </directive>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
596
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
597
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
598 <directive name="ssl_session_timeout">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
599 <syntax><value>time</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
600 <default>5m</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
601 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
602 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
603
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
604 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
605 Specifies a time during which a client may reuse the
1785
3fa0944ddc6a Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
606 session parameters.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
607 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
608
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
609 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
610
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
611
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
612 <directive name="ssl_stapling">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
613 <syntax><literal>on</literal> | <literal>off</literal></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
614 <default>off</default>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
615 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
616 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
617 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
618
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
619 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
620 Enables or disables
2162
aa5d65fe4916 Updated link to TLS Certificate Status Request extension reference.
Sergey Kandaurov <pluknet@nginx.com>
parents: 2068
diff changeset
621 <link url="https://tools.ietf.org/html/rfc6066#section-8">stapling
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
622 of OCSP responses</link> by the server.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
623 Example:
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
624 <example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
625 ssl_stapling on;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
626 resolver 192.0.2.1;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
627 </example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
628 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
629
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
630 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
631 For the OCSP stapling to work, the certificate of the server certificate
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
632 issuer should be known.
712
2c9e8facc761 Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents: 696
diff changeset
633 If the <link id="ssl_certificate"/> file does
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
634 not contain intermediate certificates,
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
635 the certificate of the server certificate issuer should be
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
636 present in the
712
2c9e8facc761 Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents: 696
diff changeset
637 <link id="ssl_trusted_certificate"/> file.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
638 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
639
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
640 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
641 For a resolution of the OCSP responder hostname,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
642 the <link doc="ngx_http_core_module.xml" id="resolver"/> directive
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
643 should also be specified.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
644 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
645
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
646 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
647
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
648
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
649 <directive name="ssl_stapling_file">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
650 <syntax><value>file</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
651 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
652 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
653 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
654 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
655
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
656 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
657 When set, the stapled OCSP response will be taken from the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
658 specified <value>file</value> instead of querying
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
659 the OCSP responder specified in the server certificate.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
660 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
661
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
662 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
663 The file should be in the DER format as produced by the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
664 “<literal>openssl ocsp</literal>” command.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
665 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
666
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
667 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
668
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
669
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
670 <directive name="ssl_stapling_responder">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
671 <syntax><value>url</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
672 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
673 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
674 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
675 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
676
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
677 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
678 Overrides the URL of the OCSP responder specified in the
1923
66a30a380fba Fixed links to tools.ietf.org.
Ruslan Ermilov <ru@nginx.com>
parents: 1877
diff changeset
679 “<link url="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
680 Information Access</link>” certificate extension.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
681 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
682
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
683 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
684 Only “<literal>http://</literal>” OCSP responders are supported:
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
685 <example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
686 ssl_stapling_responder http://ocsp.example.com/;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
687 </example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
688 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
689
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
690 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
691
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
692
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
693 <directive name="ssl_stapling_verify">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
694 <syntax><literal>on</literal> | <literal>off</literal></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
695 <default>off</default>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
696 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
697 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
698 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
699
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
700 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
701 Enables or disables verification of OCSP responses by the server.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
702 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
703
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
704 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
705 For verification to work, the certificate of the server certificate
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
706 issuer, the root certificate, and all intermediate certificates
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
707 should be configured as trusted using the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
708 <link id="ssl_trusted_certificate"/> directive.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
709 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
710
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
711 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
712
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
713
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
714 <directive name="ssl_trusted_certificate">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
715 <syntax><value>file</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
716 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
717 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
718 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
719 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
720
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
721 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
722 Specifies a <value>file</value> with trusted CA certificates in the PEM format
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
723 used to <link id="ssl_verify_client">verify</link> client certificates and
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
724 OCSP responses if <link id="ssl_stapling"/> is enabled.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
725 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
726
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
727 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
728 In contrast to the certificate set by <link id="ssl_client_certificate"/>,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
729 the list of these certificates will not be sent to clients.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
730 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
731
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
732 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
733
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
734
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
735 <directive name="ssl_verify_client">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
736 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
737 <literal>on</literal> | <literal>off</literal> |
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
738 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
739 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
740 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
741 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
742
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
743 <para>
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
744 Enables verification of client certificates.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
745 The verification result is stored in the
1871
5f156621b8b5 Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1870
diff changeset
746 <link id="var_ssl_client_verify">$ssl_client_verify</link> variable.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
747 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
748
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
749 <para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
750 The <literal>optional</literal> parameter (0.8.7+) requests the client
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
751 certificate and verifies it if the certificate is present.
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
752 </para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
753
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
754 <para>
763
cd581dbdaf76 The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents: 717
diff changeset
755 The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5)
cd581dbdaf76 The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents: 717
diff changeset
756 requests the client
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
757 certificate but does not require it to be signed by a trusted CA certificate.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
758 This is intended for the use in cases when a service that is external to nginx
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
759 performs the actual certificate verification.
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
760 The contents of the certificate is accessible through the
1871
5f156621b8b5 Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1870
diff changeset
761 <link id="var_ssl_client_cert">$ssl_client_cert</link> variable.
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
762 </para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
763
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
764 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
765
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
766
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
767 <directive name="ssl_verify_depth">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
768 <syntax><value>number</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
769 <default>1</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
770 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
771 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
772
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
773 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
774 Sets the verification depth in the client certificates chain.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
775 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
776
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
777 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
778
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
779 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
780
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
781
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
782 <section id="errors" name="Error Processing">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
783
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
784 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
785 The <literal>ngx_http_ssl_module</literal> module supports several
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
786 non-standard error codes that can be used for redirects using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
787 <link doc="ngx_http_core_module.xml" id="error_page"/> directive:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
788 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
789
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
790 <tag-name>495</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
791 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
792 an error has occurred during the client certificate verification;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
793 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
794
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
795 <tag-name>496</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
796 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
797 a client has not presented the required certificate;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
798 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
799
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
800 <tag-name>497</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
801 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
802 a regular request has been sent to the HTTPS port.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
803 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
804
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
805 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
806 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
807
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
808 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
809 The redirection happens after the request is fully parsed and
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
810 the variables, such as <var>$request_uri</var>,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
811 <var>$uri</var>, <var>$args</var> and others, are available.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
812 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
813
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
814 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
815
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
816
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
817 <section id="variables" name="Embedded Variables">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
818
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
819 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
820 The <literal>ngx_http_ssl_module</literal> module supports
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
821 several embedded variables:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
822 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
823
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
824 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
825 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
826 returns the string of ciphers used
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
827 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
828 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
829
1857
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
830 <tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
831 <tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
832 returns the list of ciphers supported by the client (1.11.7).
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
833 Known ciphers are listed by names, unknown are shown in hexadecimal,
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
834 for example:
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
835 <example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
836 AES128-SHA:AES256-SHA:0x00ff
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
837 </example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
838 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
839 The variable is fully supported only when using OpenSSL version 1.0.2 or higher.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
840 With older versions, the variable is available
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
841 only for new sessions and lists only known ciphers.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
842 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
843 </tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
844
2027
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
845 <tag-name id="var_ssl_client_escaped_cert"><var>$ssl_client_escaped_cert</var></tag-name>
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
846 <tag-desc>
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
847 returns the client certificate in the PEM format (urlencoded)
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
848 for an established SSL connection (1.13.5);
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
849 </tag-desc>
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
850
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
851 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
852 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
853 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
854 for an established SSL connection, with each line except the first
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
855 prepended with the tab character;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
856 this is intended for the use in the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
857 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive;
2027
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
858 <note>
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
859 The variable is deprecated,
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
860 the <var>$ssl_client_escaped_cert</var> variable should be used instead.
dabca59da4ce Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1978
diff changeset
861 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
862 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
863
1201
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
864 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
865 <tag-desc>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
866 returns the SHA1 fingerprint of the client certificate
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
867 for an established SSL connection (1.7.1);
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
868 </tag-desc>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
869
1870
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
870 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
871 <tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
872 returns the “issuer DN” string of the client certificate
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
873 for an established SSL connection according to
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
874 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
875 </tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
876
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
877 <tag-name id="var_ssl_client_i_dn_legacy"><var>$ssl_client_i_dn_legacy</var></tag-name>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
878 <tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
879 returns the “issuer DN” string of the client certificate
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
880 for an established SSL connection;
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
881 <note>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
882 Prior to version 1.11.6, the variable name was <var>$ssl_client_i_dn</var>.
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
883 </note>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
884 </tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
885
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
886 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var>
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
887 </tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
888 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
889 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
890 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
891 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
892
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
893 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
894 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
895 returns the “subject DN” string of the client certificate
1824
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
896 for an established SSL connection according to
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
897 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
898 </tag-desc>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
899
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
900 <tag-name id="var_ssl_client_s_dn_legacy"><var>$ssl_client_s_dn_legacy</var></tag-name>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
901 <tag-desc>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
902 returns the “subject DN” string of the client certificate
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
903 for an established SSL connection;
1824
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
904 <note>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
905 Prior to version 1.11.6, the variable name was <var>$ssl_client_s_dn</var>.
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
906 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
907 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
908
1870
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
909 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
910 <tag-desc>
1870
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
911 returns the serial number of the client certificate
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
912 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
913 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
914
1855
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
915 <tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
916 <tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
917 returns the end date of the client certificate (1.11.7);
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
918 </tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
919
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
920 <tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
921 <tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
922 returns the number of days
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
923 until the client certificate expires (1.11.7);
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
924 </tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
925
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
926 <tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
927 <tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
928 returns the start date of the client certificate (1.11.7);
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
929 </tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
930
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
931 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
932 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
933 returns the result of client certificate verification:
1856
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
934 “<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”,
1863
fef4ab2d990c Removed unnecessary version for "FAILED:reason" in $ssl_client_verify.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
935 and “<literal>NONE</literal>” if a certificate was not present;
1856
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
936 <note>
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
937 Prior to version 1.11.7, the “<literal>FAILED</literal>” result
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
938 did not contain the <value>reason</value> string.
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
939 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
940 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
941
1857
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
942 <tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
943 <tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
944 returns the list of curves supported by the client (1.11.7).
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
945 Known curves are listed by names, unknown are shown in hexadecimal,
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
946 for example:
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
947 <example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
948 0x001d:prime256v1:secp521r1:secp384r1
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
949 </example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
950 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
951 The variable is supported only when using OpenSSL version 1.0.2 or higher.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
952 With older versions, the variable value will be an empty string.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
953 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
954 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
955 The variable is available only for new sessions.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
956 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
957 </tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
958
2219
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
959 <tag-name id="var_ssl_early_data"><var>$ssl_early_data</var></tag-name>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
960 <tag-desc>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
961 returns “<literal>1</literal>” if
2234
20a189bdb15f Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2219
diff changeset
962 TLS 1.3 <link id="ssl_early_data">early data</link> is used
2219
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
963 and the handshake is not complete, otherwise “” (1.15.3).
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
964 </tag-desc>
f1e12641fc8a Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2168
diff changeset
965
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
966 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
967 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
968 returns the protocol of an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
969 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
970
1167
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
971 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
972 <tag-desc>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
973 returns the server name requested through
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
974 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
975 (1.7.0);
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
976 </tag-desc>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
977
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
978 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
979 <tag-desc>
1072
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
980 returns the session identifier of an established SSL connection;
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
981 </tag-desc>
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
982
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
983 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name>
1072
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
984 <tag-desc>
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
985 returns “<literal>r</literal>” if an SSL session was reused,
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
986 or “<literal>.</literal>” otherwise (1.5.11).
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
987 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
988
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
989 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
990 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
991
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
992 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
993
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
994 </module>