Mercurial > hg > nginx-site

annotate xml/en/docs/stream/ngx_stream_ssl_module.xml @ 1878:127ae107e5a9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Removed clause about shared memory and Windows versions with ASLR. Starting with nginx 1.9.0 shared memory can be used on Windows versions with address space layout randomization.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 26 Dec 2016 19:38:06 +0300
parents aa29a64a5e9d
children 66a30a380fba
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1 <?xml version="1.0"?>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
3 <!--
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
4 Copyright (C) Nginx, Inc.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
5 -->
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
6
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 <module name="Module ngx_stream_ssl_module"
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 link="/en/docs/stream/ngx_stream_ssl_module.html"
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 lang="en"
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1876
diff changeset
12 rev="15">
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14 <section id="summary">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16 <para>
1462
e69e4dbcc760 Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 1456
diff changeset
17 The <literal>ngx_stream_ssl_module</literal> module (1.9.0)
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 provides the necessary support for a stream proxy server to work with
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 the SSL/TLS protocol.
1462
e69e4dbcc760 Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 1456
diff changeset
20 This module is not built by default, it should be enabled with the
e69e4dbcc760 Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 1456
diff changeset
21 <literal>--with-stream_ssl_module</literal>
e69e4dbcc760 Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 1456
diff changeset
22 configuration parameter.
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 </section>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27
1521
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
28 <section id="example" name="Example Configuration">
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
29
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
30 <para>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
31 To reduce the processor load, it is recommended to
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
32 <list type="bullet">
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
33
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
34 <listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
35 set the number of worker processes equal to the number of processors,
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
36 </listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
37
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
38 <listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
39 enable the shared session cache,
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
40 </listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
41
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
42 <listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
43 disable the built-in session cache,
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
44 </listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
45
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
46 <listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
47 and possibly increase the session lifetime (by default, 5 minutes):
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
48 </listitem>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
49
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
50 </list>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
51
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
52 <example>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
53 <emphasis>worker_processes auto;</emphasis>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
54
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
55 stream {
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
56
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
57 ...
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
58
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
59 server {
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
60 listen 12345 ssl;
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
61
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
62 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
63 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
64 ssl_certificate /usr/local/nginx/conf/cert.pem;
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
65 ssl_certificate_key /usr/local/nginx/conf/cert.key;
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
66 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
67 <emphasis>ssl_session_timeout 10m;</emphasis>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
68
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
69 ...
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
70 }
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
71 </example>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
72 </para>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
73
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
74 </section>
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
75
e3d3e2ed4275 Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1499
diff changeset
76
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 <section id="directives" name="Directives">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 <directive name="ssl_certificate">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 <syntax><value>file</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 <default/>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 <para>
1456
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
86 Specifies a <value>file</value> with the certificate in the PEM format
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
87 for the given server.
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 If intermediate certificates should be specified in addition to a primary
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 certificate, they should be specified in the same file in the following
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 order: the primary certificate comes first, then the intermediate certificates.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 A secret key in the PEM format may be placed in the same file.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93
1726
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
94 <para>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
95 Since version 1.11.0,
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
96 this directive can be specified multiple times
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
97 to load certificates of different types, for example, RSA and ECDSA:
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
98 <example>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
99 server {
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
100 listen 12345 ssl;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
101
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
102 ssl_certificate example.com.rsa.crt;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
103 ssl_certificate_key example.com.rsa.key;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
104
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
105 ssl_certificate example.com.ecdsa.crt;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
106 ssl_certificate_key example.com.ecdsa.key;
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
107
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
108 ...
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
109 }
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
110 </example>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
111 <note>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
112 Only OpenSSL 1.0.2 or higher supports separate certificate chains
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
113 for different certificates.
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
114 With older versions, only one certificate chain can be used.
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
115 </note>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
116 </para>
a0bc284941f6 Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1711
diff changeset
117
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121 <directive name="ssl_certificate_key">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 <syntax><value>file</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123 <default/>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 <para>
1456
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
128 Specifies a <value>file</value> with the secret key in the PEM format
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
129 for the given server.
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
130 </para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
131
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
132 <para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
133 The value
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
134 <literal>engine</literal>:<value>name</value>:<value>id</value>
1462
e69e4dbcc760 Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents: 1456
diff changeset
135 can be specified instead of the <value>file</value>,
1456
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
136 which loads a secret key with a specified <value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1450
diff changeset
137 from the OpenSSL engine <value>name</value>.
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 <directive name="ssl_ciphers">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144 <syntax><value>ciphers</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 <default>HIGH:!aNULL:!MD5</default>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150 Specifies the enabled ciphers.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 The ciphers are specified in the format understood by the
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152 OpenSSL library, for example:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 <example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 </example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 The full list can be viewed using the
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160 “<command>openssl ciphers</command>” command.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165
1869
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
166 <directive name="ssl_client_certificate">
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
167 <syntax><value>file</value></syntax>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
168 <default/>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
169 <context>stream</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
170 <context>server</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
171 <appeared-in>1.11.8</appeared-in>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
172
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
173 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
174 Specifies a <value>file</value> with trusted CA certificates in the PEM format
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
175 used to <link id="ssl_verify_client">verify</link> client certificates.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
176 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
177
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
178 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
179 The list of certificates will be sent to clients.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
180 If this is not desired, the <link id="ssl_trusted_certificate"/>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
181 directive can be used.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
182 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
183
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
184 </directive>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
185
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
186
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
187 <directive name="ssl_crl">
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
188 <syntax><value>file</value></syntax>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
189 <default/>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
190 <context>stream</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
191 <context>server</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
192 <appeared-in>1.11.8</appeared-in>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
193
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
194 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
195 Specifies a <value>file</value> with revoked certificates (CRL)
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
196 in the PEM format used to <link id="ssl_verify_client">verify</link>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
197 client certificates.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
198 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
199
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
200 </directive>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
201
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
202
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203 <directive name="ssl_dhparam">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204 <syntax><value>file</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205 <default/>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 <para>
1706
6f5497797cde Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents: 1521
diff changeset
210 Specifies a <value>file</value> with DH parameters for DHE ciphers.
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 <directive name="ssl_ecdh_curve">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 <syntax><value>curve</value></syntax>
1711
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
218 <default>auto</default>
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223 Specifies a <value>curve</value> for ECDHE ciphers.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225
1711
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
226 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
227 When using OpenSSL 1.0.2 or higher,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
228 it is possible to specify multiple curves (1.11.0), for example:
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
229 <example>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
230 ssl_ecdh_curve prime256v1:secp384r1;
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
231 </example>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
232 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
233
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
234 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
235 The special value <literal>auto</literal> (1.11.0) instructs nginx to use
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
236 a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
237 or <literal>prime256v1</literal> with older versions.
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
238 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
239
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
240 <para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
241 <note>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
242 Prior to version 1.11.0,
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
243 the <literal>prime256v1</literal> curve was used by default.
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
244 </note>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
245 </para>
38fb3e6b71e8 Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1706
diff changeset
246
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250 <directive name="ssl_handshake_timeout">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 <syntax><value>time</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 <default>60s</default>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257 Specifies a timeout for the SSL handshake to complete.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
258 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 <directive name="ssl_password_file">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264 <syntax><value>file</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 <default/>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
267 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 Specifies a <value>file</value> with passphrases for
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271 <link id="ssl_certificate_key">secret keys</link>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 where each passphrase is specified on a separate line.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273 Passphrases are tried in turn when loading the key.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277 Example:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 <example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 stream {
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 ssl_password_file /etc/keys/global.pass;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281 ...
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283 server {
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 listen 127.0.0.1:12345;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285 ssl_certificate_key /etc/keys/first.key;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286 }
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 server {
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289 listen 127.0.0.1:12346;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291 # named pipe can also be used instead of a file
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 ssl_password_file /etc/keys/fifo;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293 ssl_certificate_key /etc/keys/second.key;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 }
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295 }
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 </example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302 <directive name="ssl_prefer_server_ciphers">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303 <syntax><literal>on</literal> | <literal>off</literal></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 <default>off</default>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
305 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
307
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
308 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309 Specifies that server ciphers should be preferred over client ciphers
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 when the SSLv3 and TLS protocols are used.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316 <directive name="ssl_protocols">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
317 <syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318 [<literal>SSLv2</literal>]
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319 [<literal>SSLv3</literal>]
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 [<literal>TLSv1</literal>]
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321 [<literal>TLSv1.1</literal>]
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 [<literal>TLSv1.2</literal>]</syntax>
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1462
diff changeset
323 <default>TLSv1 TLSv1.1 TLSv1.2</default>
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
324 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
327 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
328 Enables the specified protocols.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters work
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
330 only when the OpenSSL library of version 1.0.1 or higher is used.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
331 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
332
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336 <directive name="ssl_session_cache">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 <syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 <literal>off</literal> |
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339 <literal>none</literal> |
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 [<literal>builtin</literal>[:<value>size</value>]]
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
342 <default>none</default>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347 Sets the types and sizes of caches that store session parameters.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348 A cache can be of any of the following types:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349 <list type="tag">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 <tag-name><literal>off</literal></tag-name>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352 <tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 the use of a session cache is strictly prohibited:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 nginx explicitly tells a client that sessions may not be reused.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
355 </tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357 <tag-name><literal>none</literal></tag-name>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358 <tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359 the use of a session cache is gently disallowed:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360 nginx tells a client that sessions may be reused, but does not
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361 actually store session parameters in the cache.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362 </tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364 <tag-name><literal>builtin</literal></tag-name>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 <tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366 a cache built in OpenSSL; used by one worker process only.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 The cache size is specified in sessions.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 If size is not given, it is equal to 20480 sessions.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369 Use of the built-in cache can cause memory fragmentation.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 </tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 <tag-name><literal>shared</literal></tag-name>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 <tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374 a cache shared between all worker processes.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 The cache size is specified in bytes; one megabyte can store
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 about 4000 sessions.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 Each shared cache should have an arbitrary name.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 A cache with the same name can be used in several
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 servers.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 </tag-desc>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 </list>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386 Both cache types can be used simultaneously, for example:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
387 <example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 ssl_session_cache builtin:1000 shared:SSL:10m;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 </example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 but using only shared cache without the built-in cache should
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391 be more efficient.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397 <directive name="ssl_session_ticket_key">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398 <syntax><value>file</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 <default/>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 Sets a <value>file</value> with the secret key used to encrypt
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 and decrypt TLS session tickets.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 The directive is necessary if the same key has to be shared between
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 multiple servers.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 By default, a randomly generated key is used.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412 If several keys are specified, only the first key is
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
413 used to encrypt TLS session tickets.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 This allows configuring key rotation, for example:
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 <example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 ssl_session_ticket_key current.key;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 ssl_session_ticket_key previous.key;
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418 </example>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
421 <para>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1876
diff changeset
422 The <value>file</value> must contain 80 or 48 bytes
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1876
diff changeset
423 of random data and can be created using the following command:
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 <example>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1876
diff changeset
425 openssl rand 80 > ticket.key
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 </example>
1877
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1876
diff changeset
427 Depending on the file size either AES256 (for 80-byte keys, 1.11.8)
aa29a64a5e9d Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1876
diff changeset
428 or AES128 (for 48-byte keys) is used for encryption.
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434 <directive name="ssl_session_tickets">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435 <syntax><literal>on</literal> | <literal>off</literal></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
436 <default>on</default>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
440 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
441 Enables or disables session resumption through
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
442 <link url="http://tools.ietf.org/html/rfc5077">TLS session tickets</link>.
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
447
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448 <directive name="ssl_session_timeout">
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449 <syntax><value>time</value></syntax>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450 <default>5m</default>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 <context>stream</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 <context>server</context>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454 <para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 Specifies a time during which a client may reuse the
1785
3fa0944ddc6a Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1745
diff changeset
456 session parameters.
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 </para>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459 </directive>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460
1869
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
461
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
462 <directive name="ssl_trusted_certificate">
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
463 <syntax><value>file</value></syntax>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
464 <default/>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
465 <context>stream</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
466 <context>server</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
467 <appeared-in>1.11.8</appeared-in>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
468
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
469 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
470 Specifies a <value>file</value> with trusted CA certificates in the PEM format
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
471 used to <link id="ssl_verify_client">verify</link> client certificates.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
472 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
473
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
474 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
475 In contrast to the certificate set by <link id="ssl_client_certificate"/>,
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
476 the list of these certificates will not be sent to clients.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
477 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
478
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
479 </directive>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
480
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
481
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
482 <directive name="ssl_verify_client">
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
483 <syntax>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
484 <literal>on</literal> | <literal>off</literal> |
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
485 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
486 <default>off</default>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
487 <context>stream</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
488 <context>server</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
489 <appeared-in>1.11.8</appeared-in>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
490
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
491 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
492 Enables verification of client certificates.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
493 The verification result is stored in the
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
494 <link id="var_ssl_client_verify">$ssl_client_verify</link> variable.
1876
b451f03e0a4b Described behavior of stream ssl_verify_client in case of error.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1869
diff changeset
495 If an error has occurred during the client certificate verification
b451f03e0a4b Described behavior of stream ssl_verify_client in case of error.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1869
diff changeset
496 or a client has not presented the required certificate,
b451f03e0a4b Described behavior of stream ssl_verify_client in case of error.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1869
diff changeset
497 the connection is closed.
1869
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
498 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
499
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
500 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
501 The <literal>optional</literal> parameter requests the client
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
502 certificate and verifies it if the certificate is present.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
503 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
504
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
505 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
506 The <literal>optional_no_ca</literal> parameter
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
507 requests the client
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
508 certificate but does not require it to be signed by a trusted CA certificate.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
509 This is intended for the use in cases when a service that is external to nginx
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
510 performs the actual certificate verification.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
511 The contents of the certificate is accessible through the
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
512 <link id="var_ssl_client_cert">$ssl_client_cert</link> variable.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
513 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
514
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
515 </directive>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
516
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
517
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
518 <directive name="ssl_verify_depth">
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
519 <syntax><value>number</value></syntax>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
520 <default>1</default>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
521 <context>stream</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
522 <context>server</context>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
523 <appeared-in>1.11.8</appeared-in>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
524
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
525 <para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
526 Sets the verification depth in the client certificates chain.
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
527 </para>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
528
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
529 </directive>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
530
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
531 </section>
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
532
1745
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
533
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
534 <section id="variables" name="Embedded Variables">
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
535
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
536 <para>
1790
6da8d19f89c0 Corrected module name in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1785
diff changeset
537 The <literal>ngx_stream_ssl_module</literal> module supports variables
1745
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
538 since 1.11.2.
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
539 <list type="tag">
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
540
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
541 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
542 <tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
543 returns the string of ciphers used
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
544 for an established SSL connection;
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
545 </tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
546
1857
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
547 <tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
548 <tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
549 returns the list of ciphers supported by the client (1.11.7).
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
550 Known ciphers are listed by names, unknown are shown in hexadecimal,
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
551 for example:
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
552 <example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
553 AES128-SHA:AES256-SHA:0x00ff
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
554 </example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
555 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
556 The variable is fully supported only when using OpenSSL version 1.0.2 or higher.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
557 With older versions, the variable is available
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
558 only for new sessions and lists only known ciphers.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
559 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
560 </tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
561
1869
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
562 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
563 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
564 returns the client certificate in the PEM format
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
565 for an established SSL connection, with each line except the first
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
566 prepended with the tab character (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
567 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
568
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
569 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
570 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
571 returns the SHA1 fingerprint of the client certificate
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
572 for an established SSL connection (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
573 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
574
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
575 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
576 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
577 returns the “issuer DN” string of the client certificate
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
578 for an established SSL connection according to
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
579 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
580 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
581
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
582 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
583 </tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
584 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
585 returns the client certificate in the PEM format
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
586 for an established SSL connection (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
587 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
588
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
589 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
590 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
591 returns the “subject DN” string of the client certificate
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
592 for an established SSL connection according to
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
593 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
594 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
595
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
596 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
597 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
598 returns the serial number of the client certificate
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
599 for an established SSL connection (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
600 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
601
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
602 <tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
603 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
604 returns the end date of the client certificate (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
605 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
606
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
607 <tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
608 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
609 returns the number of days
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
610 until the client certificate expires (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
611 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
612
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
613 <tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
614 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
615 returns the start date of the client certificate (1.11.8);
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
616 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
617
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
618 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
619 <tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
620 returns the result of client certificate verification (1.11.8):
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
621 “<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”,
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
622 and “<literal>NONE</literal>” if a certificate was not present;
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
623 </tag-desc>
e1d0b56c0310 Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1857
diff changeset
624
1857
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
625 <tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
626 <tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
627 returns the list of curves supported by the client (1.11.7).
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
628 Known curves are listed by names, unknown are shown in hexadecimal,
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
629 for example:
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
630 <example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
631 0x001d:prime256v1:secp521r1:secp384r1
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
632 </example>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
633 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
634 The variable is supported only when using OpenSSL version 1.0.2 or higher.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
635 With older versions, the variable value will be an empty string.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
636 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
637 <note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
638 The variable is available only for new sessions.
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
639 </note>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
640 </tag-desc>
0882ccb0c00f Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1790
diff changeset
641
1745
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
642 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
643 <tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
644 returns the protocol of an established SSL connection;
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
645 </tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
646
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
647 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
648 <tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
649 returns the server name requested through
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
650 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>;
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
651 </tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
652
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
653 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
654 <tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
655 returns the session identifier of an established SSL connection;
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
656 </tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
657
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
658 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
659 <tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
660 returns “<literal>r</literal>” if an SSL session was reused,
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
661 or “<literal>.</literal>” otherwise.
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
662 </tag-desc>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
663
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
664 </list>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
665 </para>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
666
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
667 </section>
0dfb7628bfee Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1726
diff changeset
668
1450
f5b5eefc43cb Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
669 </module>