Mercurial > hg > nginx-site

annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 1878:127ae107e5a9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Removed clause about shared memory and Windows versions with ASLR. Starting with nginx 1.9.0 shared memory can be used on Windows versions with address space layout randomization.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 26 Dec 2016 19:38:06 +0300
parents aa29a64a5e9d
children 66a30a380fba
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1 <?xml version="1.0"?>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
3 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
4 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
5 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
6 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
7
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 <module name="Module ngx_http_ssl_module"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 link="/en/docs/http/ngx_http_ssl_module.html"
589
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
12 lang="en"
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
13 rev="32">
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 <section id="summary">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 The <literal>ngx_http_ssl_module</literal> module provides the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 necessary support for HTTPS.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 This module is not built by default, it should be enabled with the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24 <literal>--with-http_ssl_module</literal>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 configuration parameter.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26 <note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 This module requires the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28 <link url="http://www.openssl.org">OpenSSL</link> library.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
29 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 <section id="example" name="Example Configuration">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 To reduce the processor load it is recommended to
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 <list type="bullet">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 set the number of worker processes equal to the number of processors,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 enable keep-alive connections,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 <listitem>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
50 enable the shared session cache,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 <listitem>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
54 disable the built-in session cache,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 and possibly increase the session lifetime (by default, 5 minutes):
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
63 <example>
817
4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents: 801
diff changeset
64 <emphasis>worker_processes auto;</emphasis>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 http {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
71 listen 443 ssl;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72 <emphasis>keepalive_timeout 70;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73
1411
8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents: 1239
diff changeset
74 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 ssl_certificate /usr/local/nginx/conf/cert.pem;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 ssl_certificate_key /usr/local/nginx/conf/cert.key;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 <emphasis>ssl_session_timeout 10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 <section id="directives" name="Directives">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 <directive name="ssl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 Enables the HTTPS protocol for the given virtual server.
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
99 <note>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
100 It is recommended to use the <literal>ssl</literal> parameter of the
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
101 <link doc="ngx_http_core_module.xml" id="listen"/> directive instead
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
102 of this directive.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
103 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108
1039
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
109 <directive name="ssl_buffer_size">
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
110 <syntax><value>size</value></syntax>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
111 <default>16k</default>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
112 <context>http</context>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
113 <context>server</context>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
114 <appeared-in>1.5.9</appeared-in>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
115
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
116 <para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
117 Sets the size of the buffer used for sending data.
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
118 </para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
119
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
120 <para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
121 By default, the buffer size is 16k, which corresponds to minimal
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
122 overhead when sending big responses.
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
123 To minimize Time To First Byte it may be beneficial to use smaller values,
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
124 for example:
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
125 <example>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
126 ssl_buffer_size 4k;
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
127 </example>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
128 </para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
129
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
130 </directive>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
131
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
132
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 <directive name="ssl_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
140 Specifies a <value>file</value> with the certificate in the PEM format
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 for the given virtual server.
1457
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
142 If intermediate certificates should be specified in addition to a primary
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
143 certificate, they should be specified in the same file in the following
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
144 order: the primary certificate comes first, then the intermediate certificates.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 A secret key in the PEM format may be placed in the same file.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 <para>
1726
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
149 Since version 1.11.0,
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
150 this directive can be specified multiple times
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
151 to load certificates of different types, for example, RSA and ECDSA:
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
152 <example>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
153 server {
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
154 listen 443 ssl;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
155 server_name example.com;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
156
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
157 ssl_certificate example.com.rsa.crt;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
158 ssl_certificate_key example.com.rsa.key;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
159
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
160 ssl_certificate example.com.ecdsa.crt;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
161 ssl_certificate_key example.com.ecdsa.key;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
162
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
163 ...
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
164 }
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
165 </example>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
166 <note>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
167 Only OpenSSL 1.0.2 or higher supports separate
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
168 <link doc="configuring_https_servers.xml" id="chains">certificate chains</link>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
169 for different certificates.
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
170 With older versions, only one certificate chain can be used.
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
171 </note>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
172 </para>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
173
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1725
diff changeset
174 <para>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 It should be kept in mind that due to the HTTPS protocol limitations
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 virtual servers should listen on different IP addresses:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 listen 192.168.1.1:443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180 server_name one.example.com;
1725
67b5aac350e4 Example in ssl_certificate description updated.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
181 ssl_certificate one.example.com.crt;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
182 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
186 listen 192.168.1.2:443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
187 server_name two.example.com;
1725
67b5aac350e4 Example in ssl_certificate description updated.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
188 ssl_certificate two.example.com.crt;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
189 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
190 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192 otherwise
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 <link doc="configuring_https_servers.xml"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 id="name_based_https_servers">the first server’s certificate</link>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195 will be issued for the second site.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 <directive name="ssl_certificate_key">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
202 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
208 Specifies a <value>file</value> with the secret key in the PEM format
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 for the given virtual server.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211
1456
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
212 <para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
213 The value
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
214 <literal>engine</literal>:<value>name</value>:<value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
215 can be specified instead of the <value>file</value> (1.7.9),
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
216 which loads a secret key with a specified <value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
217 from the OpenSSL engine <value>name</value>.
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
218 </para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
219
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223 <directive name="ssl_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 <syntax><value>ciphers</value></syntax>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
225 <default>HIGH:!aNULL:!MD5</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
226 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 Specifies the enabled ciphers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231 The ciphers are specified in the format understood by the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
232 OpenSSL library, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
233 <example>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
234 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
237
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
239 The full list can be viewed using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
240 “<command>openssl ciphers</command>” command.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
241 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
242
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
243 <para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
244 <note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
245 The previous versions of nginx used
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
246 <link doc="configuring_https_servers.xml" id="compatibility">different</link>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
247 ciphers by default.
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
248 </note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
249 </para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
250
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 <directive name="ssl_client_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
258 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
261 Specifies a <value>file</value> with trusted CA certificates in the PEM format
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
262 used to <link id="ssl_verify_client">verify</link> client certificates and
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
263 OCSP responses if <link id="ssl_stapling"/> is enabled.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
264 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
265
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
266 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
267 The list of certificates will be sent to clients.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
268 If this is not desired, the <link id="ssl_trusted_certificate"/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
269 directive can be used.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275 <directive name="ssl_crl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 <appeared-in>0.8.7</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
283 Specifies a <value>file</value> with revoked certificates (CRL)
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
284 in the PEM format used to <link id="ssl_verify_client">verify</link>
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
285 client certificates.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291 <directive name="ssl_dhparam">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 <appeared-in>0.7.2</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298 <para>
1706
6f5497797cde Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents: 1499
diff changeset
299 Specifies a <value>file</value> with DH parameters for DHE ciphers.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
305 <directive name="ssl_ecdh_curve">
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
306 <syntax><value>curve</value></syntax>
1711
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
307 <default>auto</default>
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
308 <context>http</context>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
309 <context>server</context>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
310 <appeared-in>1.1.0</appeared-in>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
311 <appeared-in>1.0.6</appeared-in>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
312
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
313 <para>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
314 Specifies a <value>curve</value> for ECDHE ciphers.
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
315 </para>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
316
1711
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
317 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
318 When using OpenSSL 1.0.2 or higher,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
319 it is possible to specify multiple curves (1.11.0), for example:
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
320 <example>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
321 ssl_ecdh_curve prime256v1:secp384r1;
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
322 </example>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
323 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
324
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
325 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
326 The special value <literal>auto</literal> (1.11.0) instructs nginx to use
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
327 a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
328 or <literal>prime256v1</literal> with older versions.
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
329 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
330
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
331 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
332 <note>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
333 Prior to version 1.11.0,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
334 the <literal>prime256v1</literal> curve was used by default.
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
335 </note>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
336 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
337
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
338 </directive>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
339
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
340
1239
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
341 <directive name="ssl_password_file">
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
342 <syntax><value>file</value></syntax>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
343 <default/>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
344 <context>http</context>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
345 <context>server</context>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
346 <appeared-in>1.7.3</appeared-in>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
347
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
348 <para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
349 Specifies a <value>file</value> with passphrases for
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
350 <link id="ssl_certificate_key">secret keys</link>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
351 where each passphrase is specified on a separate line.
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
352 Passphrases are tried in turn when loading the key.
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
353 </para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
354
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
355 <para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
356 Example:
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
357 <example>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
358 http {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
359 ssl_password_file /etc/keys/global.pass;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
360 ...
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
361
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
362 server {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
363 server_name www1.example.com;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
364 ssl_certificate_key /etc/keys/first.key;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
365 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
366
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
367 server {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
368 server_name www2.example.com;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
369
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
370 # named pipe can also be used instead of a file
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
371 ssl_password_file /etc/keys/fifo;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
372 ssl_certificate_key /etc/keys/second.key;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
373 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
374 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
375 </example>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
376 </para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
377
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
378 </directive>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
379
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
380
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381 <directive name="ssl_prefer_server_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
387 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 Specifies that server ciphers should be preferred over client
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 ciphers when using the SSLv3 and TLS protocols.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395 <directive name="ssl_protocols">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397 [<literal>SSLv2</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398 [<literal>SSLv3</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 [<literal>TLSv1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400 [<literal>TLSv1.1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 [<literal>TLSv1.2</literal>]</syntax>
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1457
diff changeset
402 <default>TLSv1 TLSv1.1 TLSv1.2</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 Enables the specified protocols.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
408 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters work
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
409 only when the OpenSSL library of version 1.0.1 or higher is used.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410 <note>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
411 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters are
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
412 supported starting from versions 1.1.13 and 1.0.12,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
413 so when the OpenSSL version 1.0.1 or higher
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
414 is used on older nginx versions, these protocols work, but cannot
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 be disabled.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
421
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
422 <directive name="ssl_session_cache">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 <literal>off</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425 <literal>none</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 [<literal>builtin</literal>[:<value>size</value>]]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 <default>none</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
433 Sets the types and sizes of caches that store session parameters.
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
434 A cache can be of any of the following types:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
436
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437 <tag-name><literal>off</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
439 the use of a session cache is strictly prohibited:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
440 nginx explicitly tells a client that sessions may not be reused.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
441 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
442
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443 <tag-name><literal>none</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
445 the use of a session cache is gently disallowed:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446 nginx tells a client that sessions may be reused, but does not
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
447 actually store session parameters in the cache.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450 <tag-name><literal>builtin</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 a cache built in OpenSSL; used by one worker process only.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453 The cache size is specified in sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454 If size is not given, it is equal to 20480 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 Use of the built-in cache can cause memory fragmentation.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 <tag-name><literal>shared</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
460 a cache shared between all worker processes.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461 The cache size is specified in bytes; one megabyte can store
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462 about 4000 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
463 Each shared cache should have an arbitrary name.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
464 A cache with the same name can be used in several virtual servers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
465 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
466
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
470 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
471 Both cache types can be used simultaneously, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
472 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473 ssl_session_cache builtin:1000 shared:SSL:10m;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475 but using only shared cache without the built-in cache should
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476 be more efficient.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
477 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
482 <directive name="ssl_session_ticket_key">
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
483 <syntax><value>file</value></syntax>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
484 <default/>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
485 <context>http</context>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
486 <context>server</context>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
487 <appeared-in>1.5.7</appeared-in>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
488
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
489 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
490 Sets a <value>file</value> with the secret key used to encrypt
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
491 and decrypt TLS session tickets.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
492 The directive is necessary if the same key has to be shared between
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
493 multiple servers.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
494 By default, a randomly generated key is used.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
495 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
496
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
497 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
498 If several keys are specified, only the first key is
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
499 used to encrypt TLS session tickets.
1144
ac131944d349 Changed infinitive to gerund after "allow".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1072
diff changeset
500 This allows configuring key rotation, for example:
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
501 <example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
502 ssl_session_ticket_key current.key;
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
503 ssl_session_ticket_key previous.key;
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
504 </example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
505 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
506
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
507 <para>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
508 The <value>file</value> must contain 80 or 48 bytes
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
509 of random data and can be created using the following command:
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
510 <example>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
511 openssl rand 80 > ticket.key
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
512 </example>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
513 Depending on the file size either AES256 (for 80-byte keys, 1.11.8)
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1871
diff changeset
514 or AES128 (for 48-byte keys) is used for encryption.
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
515 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
516
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
517 </directive>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
518
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
519
1055
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
520 <directive name="ssl_session_tickets">
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
521 <syntax><literal>on</literal> | <literal>off</literal></syntax>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
522 <default>on</default>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
523 <context>http</context>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
524 <context>server</context>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
525 <appeared-in>1.5.9</appeared-in>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
526
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
527 <para>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
528 Enables or disables session resumption through
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
529 <link url="http://tools.ietf.org/html/rfc5077">TLS session tickets</link>.
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
530 </para>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
531
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
532 </directive>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
533
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
534
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
535 <directive name="ssl_session_timeout">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
536 <syntax><value>time</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
537 <default>5m</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
538 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
539 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
540
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
541 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
542 Specifies a time during which a client may reuse the
1785
3fa0944ddc6a Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
543 session parameters.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
544 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
545
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
546 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
547
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
548
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
549 <directive name="ssl_stapling">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
550 <syntax><literal>on</literal> | <literal>off</literal></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
551 <default>off</default>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
552 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
553 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
554 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
555
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
556 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
557 Enables or disables
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
558 <link url="http://tools.ietf.org/html/rfc4366#section-3.6">stapling
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
559 of OCSP responses</link> by the server.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
560 Example:
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
561 <example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
562 ssl_stapling on;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
563 resolver 192.0.2.1;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
564 </example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
565 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
566
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
567 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
568 For the OCSP stapling to work, the certificate of the server certificate
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
569 issuer should be known.
712
2c9e8facc761 Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents: 696
diff changeset
570 If the <link id="ssl_certificate"/> file does
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
571 not contain intermediate certificates,
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
572 the certificate of the server certificate issuer should be
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
573 present in the
712
2c9e8facc761 Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents: 696
diff changeset
574 <link id="ssl_trusted_certificate"/> file.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
575 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
576
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
577 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
578 For a resolution of the OCSP responder hostname,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
579 the <link doc="ngx_http_core_module.xml" id="resolver"/> directive
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
580 should also be specified.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
581 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
582
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
583 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
584
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
585
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
586 <directive name="ssl_stapling_file">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
587 <syntax><value>file</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
588 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
589 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
590 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
591 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
592
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
593 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
594 When set, the stapled OCSP response will be taken from the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
595 specified <value>file</value> instead of querying
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
596 the OCSP responder specified in the server certificate.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
597 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
598
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
599 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
600 The file should be in the DER format as produced by the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
601 “<literal>openssl ocsp</literal>” command.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
602 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
603
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
604 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
605
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
606
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
607 <directive name="ssl_stapling_responder">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
608 <syntax><value>url</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
609 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
610 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
611 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
612 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
613
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
614 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
615 Overrides the URL of the OCSP responder specified in the
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
616 “<link url="http://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
617 Information Access</link>” certificate extension.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
618 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
619
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
620 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
621 Only “<literal>http://</literal>” OCSP responders are supported:
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
622 <example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
623 ssl_stapling_responder http://ocsp.example.com/;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
624 </example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
625 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
626
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
627 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
628
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
629
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
630 <directive name="ssl_stapling_verify">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
631 <syntax><literal>on</literal> | <literal>off</literal></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
632 <default>off</default>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
633 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
634 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
635 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
636
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
637 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
638 Enables or disables verification of OCSP responses by the server.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
639 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
640
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
641 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
642 For verification to work, the certificate of the server certificate
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
643 issuer, the root certificate, and all intermediate certificates
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
644 should be configured as trusted using the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
645 <link id="ssl_trusted_certificate"/> directive.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
646 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
647
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
648 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
649
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
650
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
651 <directive name="ssl_trusted_certificate">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
652 <syntax><value>file</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
653 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
654 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
655 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
656 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
657
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
658 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
659 Specifies a <value>file</value> with trusted CA certificates in the PEM format
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
660 used to <link id="ssl_verify_client">verify</link> client certificates and
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
661 OCSP responses if <link id="ssl_stapling"/> is enabled.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
662 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
663
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
664 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
665 In contrast to the certificate set by <link id="ssl_client_certificate"/>,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
666 the list of these certificates will not be sent to clients.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
667 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
668
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
669 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
670
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
671
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
672 <directive name="ssl_verify_client">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
673 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
674 <literal>on</literal> | <literal>off</literal> |
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
675 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
676 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
677 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
678 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
679
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
680 <para>
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
681 Enables verification of client certificates.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
682 The verification result is stored in the
1871
5f156621b8b5 Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1870
diff changeset
683 <link id="var_ssl_client_verify">$ssl_client_verify</link> variable.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
684 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
685
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
686 <para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
687 The <literal>optional</literal> parameter (0.8.7+) requests the client
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
688 certificate and verifies it if the certificate is present.
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
689 </para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
690
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
691 <para>
763
cd581dbdaf76 The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents: 717
diff changeset
692 The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5)
cd581dbdaf76 The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents: 717
diff changeset
693 requests the client
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
694 certificate but does not require it to be signed by a trusted CA certificate.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
695 This is intended for the use in cases when a service that is external to nginx
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
696 performs the actual certificate verification.
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
697 The contents of the certificate is accessible through the
1871
5f156621b8b5 Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1870
diff changeset
698 <link id="var_ssl_client_cert">$ssl_client_cert</link> variable.
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
699 </para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
700
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
701 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
702
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
703
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
704 <directive name="ssl_verify_depth">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
705 <syntax><value>number</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
706 <default>1</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
707 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
708 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
709
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
710 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
711 Sets the verification depth in the client certificates chain.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
712 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
713
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
714 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
715
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
716 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
717
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
718
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
719 <section id="errors" name="Error Processing">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
720
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
721 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
722 The <literal>ngx_http_ssl_module</literal> module supports several
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
723 non-standard error codes that can be used for redirects using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
724 <link doc="ngx_http_core_module.xml" id="error_page"/> directive:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
725 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
726
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
727 <tag-name>495</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
728 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
729 an error has occurred during the client certificate verification;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
730 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
731
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
732 <tag-name>496</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
733 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
734 a client has not presented the required certificate;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
735 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
736
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
737 <tag-name>497</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
738 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
739 a regular request has been sent to the HTTPS port.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
740 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
741
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
742 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
743 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
744
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
745 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
746 The redirection happens after the request is fully parsed and
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
747 the variables, such as <var>$request_uri</var>,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
748 <var>$uri</var>, <var>$args</var> and others, are available.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
749 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
750
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
751 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
752
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
753
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
754 <section id="variables" name="Embedded Variables">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
755
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
756 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
757 The <literal>ngx_http_ssl_module</literal> module supports
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
758 several embedded variables:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
759 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
760
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
761 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
762 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
763 returns the string of ciphers used
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
764 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
765 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
766
1857
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
767 <tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
768 <tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
769 returns the list of ciphers supported by the client (1.11.7).
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
770 Known ciphers are listed by names, unknown are shown in hexadecimal,
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
771 for example:
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
772 <example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
773 AES128-SHA:AES256-SHA:0x00ff
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
774 </example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
775 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
776 The variable is fully supported only when using OpenSSL version 1.0.2 or higher.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
777 With older versions, the variable is available
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
778 only for new sessions and lists only known ciphers.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
779 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
780 </tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
781
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
782 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
783 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
784 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
785 for an established SSL connection, with each line except the first
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
786 prepended with the tab character;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
787 this is intended for the use in the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
788 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
789 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
790
1201
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
791 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
792 <tag-desc>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
793 returns the SHA1 fingerprint of the client certificate
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
794 for an established SSL connection (1.7.1);
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
795 </tag-desc>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
796
1870
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
797 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
798 <tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
799 returns the “issuer DN” string of the client certificate
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
800 for an established SSL connection according to
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
801 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
802 </tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
803
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
804 <tag-name id="var_ssl_client_i_dn_legacy"><var>$ssl_client_i_dn_legacy</var></tag-name>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
805 <tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
806 returns the “issuer DN” string of the client certificate
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
807 for an established SSL connection;
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
808 <note>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
809 Prior to version 1.11.6, the variable name was <var>$ssl_client_i_dn</var>.
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
810 </note>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
811 </tag-desc>
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
812
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
813 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var>
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
814 </tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
815 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
816 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
817 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
818 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
819
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
820 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
821 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
822 returns the “subject DN” string of the client certificate
1824
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
823 for an established SSL connection according to
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
824 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
825 </tag-desc>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
826
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
827 <tag-name id="var_ssl_client_s_dn_legacy"><var>$ssl_client_s_dn_legacy</var></tag-name>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
828 <tag-desc>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
829 returns the “subject DN” string of the client certificate
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
830 for an established SSL connection;
1824
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
831 <note>
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
832 Prior to version 1.11.6, the variable name was <var>$ssl_client_s_dn</var>.
e8811a423130 Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
833 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
834 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
835
1870
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
836 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
837 <tag-desc>
1870
fa7542e40381 Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1863
diff changeset
838 returns the serial number of the client certificate
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
839 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
840 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
841
1855
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
842 <tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
843 <tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
844 returns the end date of the client certificate (1.11.7);
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
845 </tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
846
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
847 <tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
848 <tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
849 returns the number of days
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
850 until the client certificate expires (1.11.7);
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
851 </tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
852
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
853 <tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
854 <tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
855 returns the start date of the client certificate (1.11.7);
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
856 </tag-desc>
2ef67c4d2226 Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1824
diff changeset
857
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
858 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
859 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
860 returns the result of client certificate verification:
1856
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
861 “<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”,
1863
fef4ab2d990c Removed unnecessary version for "FAILED:reason" in $ssl_client_verify.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
862 and “<literal>NONE</literal>” if a certificate was not present;
1856
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
863 <note>
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
864 Prior to version 1.11.7, the “<literal>FAILED</literal>” result
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
865 did not contain the <value>reason</value> string.
7133004fa5b3 $ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1855
diff changeset
866 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
867 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
868
1857
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
869 <tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
870 <tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
871 returns the list of curves supported by the client (1.11.7).
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
872 Known curves are listed by names, unknown are shown in hexadecimal,
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
873 for example:
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
874 <example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
875 0x001d:prime256v1:secp521r1:secp384r1
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
876 </example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
877 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
878 The variable is supported only when using OpenSSL version 1.0.2 or higher.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
879 With older versions, the variable value will be an empty string.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
880 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
881 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
882 The variable is available only for new sessions.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
883 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
884 </tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1856
diff changeset
885
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
886 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
887 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
888 returns the protocol of an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
889 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
890
1167
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
891 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
892 <tag-desc>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
893 returns the server name requested through
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
894 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
895 (1.7.0);
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
896 </tag-desc>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
897
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
898 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
899 <tag-desc>
1072
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
900 returns the session identifier of an established SSL connection;
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
901 </tag-desc>
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
902
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
903 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name>
1072
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
904 <tag-desc>
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
905 returns “<literal>r</literal>” if an SSL session was reused,
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
906 or “<literal>.</literal>” otherwise (1.5.11).
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
907 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
908
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
909 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
910 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
911
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
912 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
913
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
914 </module>