Mercurial > hg > nginx-site

annotate xml/cn/docs/http/configuring_https_servers.xml @ 720:9934338f83af

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Updated the Chinese documentation.
author Ruslan Ermilov <ru@nginx.com>
date Thu, 11 Oct 2012 10:23:05 +0000
parents 130fad6dc1b4
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
1 <!--
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
2 Copyright (C) Igor Sysoev
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
3 Copyright (C) Nginx, Inc.
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
4 -->
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
5
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <article name="配置HTTPS服务器"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 link="/cn/docs/http/configuring_https_servers.html"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 lang="cn"
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
11 rev="3"
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
12 translator="cfsego"
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13 author="Igor Sysoev"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14 editor="Brian Mercer">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16 <section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 配置HTTPS主机，必须在server配置块中打开SSL协议，还需要指定服务器端证书和密钥文件的位置：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
23 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
24 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
25 ssl <b>on</b>;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
26 ssl_certificate <b>www.example.com.crt</b>;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
27 ssl_certificate_key <b>www.example.com.key</b>;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
28 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
29 ssl_ciphers HIGH:!aNULL:!MD5;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
34 服务器证书是公开的，会被传送到每一个连接到服务器的客户端。而私钥不是公开的，需要存放在访问受限的文件中，当然，nginx主进程必须有读取密钥的权限。私钥和证书可以存放在同一个文件中：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 <programlisting>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
37 ssl_certificate www.example.com.cert;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
38 ssl_certificate_key www.example.com.cert;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 这种情况下，证书文件同样得设置访问限制。当然，虽然证书和密钥存放在同一个文件，只有证书会发送给客户端，密钥不会发送。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
45 <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/>和<link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>指令可以用来强制用户连接只能引入SSL/TLS那些强壮的协议版本和强大的加密算法。从1.0.5版本开始，nginx默认使用“<literal>ssl_protocols SSLv3 TLSv1</literal>”和“<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”，所以只有在之前的版本，明确地配置它们才是有意义的。从1.1.13和1.0.12版本开始，nginx默认使用“<literal>ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2</literal>”。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 CBC模式的加密算法容易受到一些攻击，尤其是BEAST攻击（参见<link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>）。可以通过下面配置调整为优先使用RC4-SHA加密算法：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52 ssl_ciphers RC4:HIGH:!aNULL:!MD5;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 ssl_prefer_server_ciphers on;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60 <section id="optimization" name="HTTPS服务器优化">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
63 SSL操作需要消耗CPU资源，所以在多处理器的系统，需要启动多个工作进程，而且数量需要不少于可用CPU的个数。最消耗CPU资源的SSL操作是SSL握手，有两种方法可以将每个客户端的握手操作数量降到最低：第一种是保持客户端长连接，在一个SSL连接发送多个请求，第二种是在并发的连接或者后续的连接中重用SSL会话参数，这样可以避免SSL握手的操作。会话缓存用于保存SSL会话，这些缓存在工作进程间共享，可以使用<link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>指令进行配置。1M缓存可以存放大约4000个会话。默认的缓存超时是5分钟，可以使用<link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>加大它。下面是一个针对4核系统的配置优化的例子，使用10M的共享会话缓存：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 <b>worker_processes 4</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 http {
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69 <b>ssl_session_cache shared:SSL:10m</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70 <b>ssl_session_timeout 10m</b>;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
73 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
74 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
75 <b>keepalive_timeout 70</b>;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
77 ssl on;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
78 ssl_certificate www.example.com.crt;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
79 ssl_certificate_key www.example.com.key;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
80 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
81 ssl_ciphers HIGH:!aNULL:!MD5;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 <section id="chains" name="SSL证书链">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 有些浏览器不接受那些众所周知的证书认证机构签署的证书，而另外一些浏览器却接受它们。这是由于证书签发使用了一些中间认证机构，这些中间机构被众所周知的证书认证机构授权代为签发证书，但是它们自己却不被广泛认知，所以有些客户端不予识别。针对这种情况，证书认证机构提供一个证书链的包裹，用来声明众所周知的认证机构和自己的关系，需要将这个证书链包裹与服务器证书合并成一个文件。在这个文件里，服务器证书需要出现在认证方证书链的前面：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 <programlisting>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
95 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
98 这个文件需要使用<link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>指令来引用：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
102 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
103 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
104 ssl on;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
105 ssl_certificate www.example.com.chained.crt;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
106 ssl_certificate_key www.example.com.key;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 如果服务器证书和认证方证书链合并时顺序弄错了，nginx就不能正常启动，而且会显示下面的错误信息：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 <programlisting>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
114 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 (SSL: error:0B080074:x509 certificate routines:
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116 X509_check_private_key:key values mismatch)
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 因为nginx首先需要用私钥去解密服务器证书，而遇到的却是认证方的证书。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123 浏览器通常会将那些被受信的认证机构认证的中间认证机构保存下来，那么这些浏览器以后在遇到使用这些中间认证机构但不包含证书链的情况时，因为已经保存了这些中间认证机构的信息，所以不会报错。可以使用<command>openssl</command>命令行工具来确认服务器发送了完整的证书链：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 $ openssl s_client -connect www.godaddy.com:443
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 Certificate chain
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 /OU=http://certificates.godaddy.com/repository
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 /CN=Go Daddy Secure Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 /serialNumber=07969287
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 /OU=http://certificates.godaddy.com/repository
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 /CN=Go Daddy Secure Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 /serialNumber=07969287
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 i:/C=US/O=The Go Daddy Group, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 /OU=Go Daddy Class 2 Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 2 s:/C=US/O=The Go Daddy Group, Inc.
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 /OU=Go Daddy Class 2 Certification Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 /OU=ValiCert Class 2 Policy Validation Authority
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 /CN=http://www.valicert.com//emailAddress=info@valicert.com
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
150 在这个例子中，www.GoDaddy.com的服务器证书（#0）的受签者（“s”）是被签发机构（“i”）签名的，而这个签发机构又是证书（#1）的受签者，接着证书（#1）的签发机构又是证书（#2）的受签者，最后证书（#2）是被众所周知的签发机构ValiCert, Inc签发。ValiCert, Inc的证书内嵌在浏览器中，被浏览器自动识别（这段话神似英国诗《在Jack盖的房子里》里面的内容）。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
154 如果没有加入认证方证书链，就只会显示服务器证书（#0）。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
160 <section id="single_http_https_server" name="合并HTTP/HTTPS主机">
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
163 如果HTTP和HTTPS虚拟主机的功能是一致的，可以配置一个虚拟主机，既处理HTTP请求，又处理HTTPS请求。
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
164 配置的方法是删除<literal>ssl on</literal>的指令，并在*:443端口添加参数<literal>ssl</literal>：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
167 listen 80;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
168 listen 443 ssl;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
169 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
170 ssl_certificate www.example.com.crt;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
171 ssl_certificate_key www.example.com.key;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 <note>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 在0.8.21版本以前，只有添加了<literal>default</literal>参数的监听端口才能添加<literal>ssl</literal>参数：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178 <programlisting>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
179 listen 443 default ssl;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181 </note>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
182 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
186
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
187 <section id="name_based_https_servers" name="基于名字的HTTPS主机">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
188
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
189 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
190 如果在同一个IP上配置多个HTTPS主机，会出现一个很普遍的问题：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
194 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
195 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
196 ssl on;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
197 ssl_certificate www.example.com.crt;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
202 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
203 server_name www.example.org;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
204 ssl on;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
205 ssl_certificate www.example.org.crt;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
210 使用上面的配置，不论浏览器请求哪个主机，都只会收到默认主机<literal>www.example.com</literal>的证书。这是由SSL协议本身的行为引起的——先建立SSL连接，再发送HTTP请求，所以nginx建立SSL连接时不知道所请求主机的名字，因此，它只会返回默认主机的证书。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 最古老的也是最稳定的解决方法就是每个HTTPS主机使用不同的IP地址：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
218 listen 192.168.1.1:443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
219 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
220 ssl on;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
221 ssl_certificate www.example.com.crt;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
226 listen 192.168.1.2:443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
227 server_name www.example.org;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
228 ssl on;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
229 ssl_certificate www.example.org.crt;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
232 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
233 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
234
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
237
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238 <section id="certificate_with_several_names"
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
239 name="带有多个主机名的SSL证书">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
240
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
241 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
242 也有其他一些方法可以实现多个HTTPS主机共享一个IP地址，但都有不足。其中一种方法是使用在“SubjectAltName”字段中存放多个名字的证书，比如<literal>www.example.com</literal>和<literal>www.example.org</literal>。但是，“SubjectAltName”字段的长度有限制。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
243 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
246 另一种方式是使用主机名中含有通配符的证书，比如<literal>*.example.org</literal>。这个证书匹配<literal>www.example.org</literal>，但是不匹配<literal>example.org</literal>和<literal>www.sub.example.org</literal>。这两种方法可以结合在一起——使用在“SubjectAltName”字段中存放的多个名字的证书，这些名字既可以是确切的名字，也可以是通配符，比如<literal>example.org</literal>和<literal>*.example.org</literal>。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
250 最好将带有多个名字的证书和它的密钥文件配置在<i>http</i>配置块中，这样可以只保存一份内容拷贝，所有主机的配置都从中继承：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 ssl_certificate common.crt;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 ssl_certificate_key common.key;
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
257 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
258 server_name www.example.com;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
259 ssl on;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 server {
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
264 listen 443;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
265 server_name www.example.org;
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
266 ssl on;
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
267 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268 }
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275 <section id="sni" name="主机名指示">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277 <para>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
278 在一个IP上运行多个HTTPS主机的更通用的方案是<link url="http://en.wikipedia.org/wiki/Server_Name_Indication">TLS主机名指示扩展</link>（SNI，RFC6066），它允许浏览器和服务器进行SSL握手时，将请求的主机名传递给服务器，因此服务器可以知道使用哪一个证书来服务这个连接。但SNI只得到有限的浏览器的支持。下面列举支持SNI的浏览器最低版本和平台信息：
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
281 <para>
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285 Opera 8.0；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289 MSIE 7.0（仅在Windows Vista操作系统及后续操作系统）；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293 Firefox 2.0和使用Mozilla平台1.8.1版本的其他浏览器；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297 Safari 3.2.1（Windows版需要最低Vista操作系统）；
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301 Chrome（Windows版需要最低Vista操作系统）。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 </list>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
305 <note>
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
306 通过SNI只能传递域名，但是，当请求中包含可读的IP地址时，某些浏览器将服务器的IP地址作为服务器的名字进行了传送。这是一个错误，大家不应该依赖于这个。
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
307 </note>
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
308 </para>
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311 为了在nginx中使用SNI，那么无论是在编译nginx时使用的OpenSSL类库，还是在运行nginx时使用的OpenSSL运行库，都必须支持SNI。从0.9.8f版本开始，OpenSSL通过<nobr>&ldquo;--enable-tlsext&rdquo;</nobr>配置选项加入SNI支持，从0.9.8j版本开始，此选项成为默认选项。当nginx被编译成支持SNI时，在使用“-V”选项运行时会显示如下信息：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314 $ nginx -V
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316 TLS SNI support enabled
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
317 ...
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 但是，当开启SNI支持的nginx被动态链接到不支持SNI的OpenSSL库上时，nginx会显示如下警告：
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 <programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
323 nginx was built with SNI support, however, now it is linked
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
324 dynamically to an OpenSSL library which has no tlsext support,
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 therefore SNI is not available
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326 </programlisting>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
327 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
328
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
330
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
331
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
332 <section id="compatibility" name="兼容性">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 从0.8.21和0.7.62版本开始，使用“-V”选项运行nginx时，将显示SNI支持状态信息。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341 <listitem>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
342 从0.7.14版本开始，<link doc="ngx_http_core_module.xml" id="listen"/>指令支持<literal>ssl</literal>参数。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346 从0.5.32版本开始，支持SNI。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350 从0.5.6版本开始，支持SSL会话缓存，并可在工作进程间共享。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
355
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359 <listitem>
720
9934338f83af Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
360 0.7.65、0.8.19及以后版本，默认SSL协议是SSLv3、TLSv1、TLSc1.1和TLSv1.2（如果OpenSSL库支持）。
558
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364 0.7.64、0.8.18及以前版本，默认SSL协议是SSLv2、SSLv3和TLSv1。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 <para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371 <list type="bullet">
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374 1.0.5及以后版本，默认SSL密码算法是<literal>HIGH:!aNULL:!MD5</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 0.7.65、0.8.20及以后版本，默认SSL密码算法是<literal>HIGH:!ADH:!MD5</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 0.8.19版本，默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 <listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386 0.7.64、0.8.18及以前版本，默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>。
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
387 </listitem>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 </list>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 </para>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393 </section>
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395
149f54c158f0 Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 </article>