nginx-site: xml/ru/docs/http/configuring_https

annotate xml/ru/docs/http/configuring_https_servers.xml @ 1505:47f70f50d554

Removed recommendation about using RC4.

author	Yaroslav Zhuravlev <yar@nginx.com>
date	Wed, 10 Jun 2015 20:31:56 +0300
parents	3687cc9a3592
children	ecf2dd95ceb6

rev	line source
580 be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	1 <!--
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	4 -->
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	5
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	7
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	8 <article name="Настройка HTTPS-серверов"
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	9 link="/ru/docs/http/configuring_https_servers.html"
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	10 lang="ru"
1505 47f70f50d554 Removed recommendation about using RC4. Yaroslav Zhuravlev <yar@nginx.com> parents: 1499 diff changeset	11 rev="9"
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	12 author="Игорь Сысоев"
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	13 editor="Brian Mercer">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	14
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	15 <section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	16
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	17 <para>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	18 Чтобы настроить HTTPS-сервер, необходимо включить параметр
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	19 <literal>ssl</literal> на
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	20 <link doc="ngx_http_core_module.xml" id="listen">слушающих сокетах</link>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	21 в блоке <link doc="ngx_http_core_module.xml" id="server"/>,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	22 а также указать местоположение файлов с
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	23 сертификатом сервера и секретным ключом:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	24
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	25 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	26 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	27 listen 443 <b>ssl</b>;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	28 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	29 ssl_certificate <b>www.example.com.crt</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	30 ssl_certificate_key <b>www.example.com.key</b>;
1411 8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example. Sergey Budnevitch <sb@waeme.net> parents: 817 diff changeset	31 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	32 ssl_ciphers HIGH:!aNULL:!MD5;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	33 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	34 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	35 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	36
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	37 Сертификат сервера является публичным.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	38 Он посылается каждому клиенту, соединяющемуся с сервером.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	39 Секретный ключ следует хранить в файле с ограниченным доступом
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	40 (права доступа должны позволять основному процессу nginx читать этот файл).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	41 Секретный ключ можно также хранить в одном файле с сертификатом:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	42
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	43 <programlisting>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	44 ssl_certificate www.example.com.cert;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	45 ssl_certificate_key www.example.com.cert;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	46 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	47
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	48 при этом права доступа к файлу следует также ограничить.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	49 Несмотря на то, что и сертификат, и ключ хранятся в одном файле,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	50 клиенту посылается только сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	51 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	52
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	53 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	54 С помощью директив <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	55 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	56 можно ограничить соединения
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	57 использованием только “сильных” версий и шифров SSL/TLS.
1499 3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	58 По умолчанию nginx использует
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	59 “<literal>ssl_protocols TLSv1 TLSv1.1 TLSv1.2</literal>” и
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	60 “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”,
1499 3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	61 поэтому их явная настройка в общем случае не требуется.
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	62 Следует отметить, что значения по умолчанию этих директив несколько раз
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	63 <link id="compatibility">менялись</link>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	64 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	65
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	66 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	67
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	68
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	69 <section id="optimization" name="Оптимизация HTTPS-сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	70
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	71 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	72 SSL-операции потребляют дополнительные ресурсы процессора.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	73 На мультипроцессорных системах следует запускать несколько рабочих процессов,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	74 не меньше числа доступных процессорных ядер.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	75 Наиболее ресурсоёмкой для процессора является операция SSL handshake, в рамках
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	76 которой формируются криптографические параметры сессии.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	77 Существует два способа уменьшения числа этих операций, производимых для каждого
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	78 клиента: использование постоянных (keepalive) соединений, позволяющих в рамках
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	79 одного соединения обрабатывать сразу несколько запросов, и повторное
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	80 использование параметров SSL-сессии для предотвращения необходимости выполнения
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	81 SSL handshake для параллельных и последующих соединений.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	82 Сессии хранятся в кэше SSL-сессий, разделяемом между рабочими процессами и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	83 настраиваемом директивой
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	84 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	85 В 1 мегабайт кэша помещается около 4000 сессий.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	86 Таймаут кэша по умолчанию равен 5 минутам.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	87 Он может быть увеличен с помощью директивы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	88 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>.
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	89 Вот пример конфигурации, оптимизированной под многоядерную систему
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	90 с 10-мегабайтным разделяемым кэшем сессий:
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	91
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	92 <programlisting>
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	93 <b>worker_processes auto</b>;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	94
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	95 http {
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	96 <b>ssl_session_cache shared:SSL:10m</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	97 <b>ssl_session_timeout 10m</b>;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	98
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	99 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	100 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	101 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	102 <b>keepalive_timeout 70</b>;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	103
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	104 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	105 ssl_certificate_key www.example.com.key;
1411 8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example. Sergey Budnevitch <sb@waeme.net> parents: 817 diff changeset	106 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	107 ssl_ciphers HIGH:!aNULL:!MD5;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	108 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	109 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	110 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	111
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	112 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	113
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	114
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	115 <section id="chains" name="Цепочки SSL-сертификатов">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	116
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	117 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	118 Некоторые браузеры могут выдавать предупреждение о сертификате, подписанном
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	119 общеизвестным центром сертификации, в то время как другие браузеры без
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	120 проблем принимают этот же сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	121 Так происходит потому, что центр, выдавший сертификат, подписал его
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	122 промежуточным сертификатом, которого нет в базе данных сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	123 общеизвестных доверенных центров сертификации, распространяемой
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	124 вместе с браузером.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	125 В подобном случае центр сертификации предоставляет “связку” сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	126 которую следует присоединить к сертификату сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	127 Сертификат сервера следует разместить перед связкой сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	128 в скомбинированном файле:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	129
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	130 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	131 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	132 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	133
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	134 Полученный файл следует указать в директиве
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	135 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	136
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	137 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	138 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	139 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	140 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	141 ssl_certificate www.example.com.chained.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	142 ssl_certificate_key www.example.com.key;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	143 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	144 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	145 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	146
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	147 Если сертификат сервера и связка сертификатов были соединены в неправильном
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	148 порядке, nginx откажется запускаться и выдаст сообщение об ошибке:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	149
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	150 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	151 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	152 (SSL: error:0B080074:x509 certificate routines:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	153 X509_check_private_key:key values mismatch)
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	154 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	155
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	156 поскольку nginx попытается использовать секретный ключ с первым
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	157 сертификатом из связки вместо сертификата сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	158 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	159
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	160 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	161 Браузеры обычно сохраняют полученные промежуточные сертификаты, подписанные
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	162 доверенными центрами сертификации, поэтому активно используемые браузеры
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	163 уже могут иметь требуемые промежуточные сертификаты и не выдать предупреждение
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	164 о сертификате, присланном без связанной с ним цепочки сертификатов.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	165 Убедиться в том, что сервер присылает полную цепочку сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	166 можно при помощи утилиты командной строки <command>openssl</command>, например:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	167
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	168 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	169 $ openssl s_client -connect www.godaddy.com:443
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	170 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	171 Certificate chain
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	172 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	173 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	174 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	175 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	176 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	177 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	178 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	179 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	180 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	181 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	182 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	183 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	184 i:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	185 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	186 2 s:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	187 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	188 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	189 /OU=ValiCert Class 2 Policy Validation Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	190 /CN=http://www.valicert.com//emailAddress=info@valicert.com
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	191 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	192 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	193
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	194 В этом примере субъект (“<i>s</i>”) сертификата №0 сервера
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	195 <literal>www.GoDaddy.com</literal> подписан издателем (“<i>i</i>”),
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	196 который в свою очередь является субъектом сертификата №1, подписанного
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	197 издателем, который в свою очередь является субъектом сертификата №2,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	198 подписанного общеизвестным издателем <i>ValiCert, Inc.</i>,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	199 чей сертификат хранится во встроенной в браузеры базе данных
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	200 сертификатов (которая в тёмном чулане хранится в доме, который построил Джек).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	201 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	202
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	203 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	204 Если связку сертификатов не добавили, будет показан только сертификат
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	205 сервера №0.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	206 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	207
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	208 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	209
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	210
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	211 <section id="single_http_https_server" name="Единый HTTP/HTTPS сервер">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	212
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	213 <para>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	214 Можно настроить единый сервер, который обслуживает как HTTP-,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	215 так и HTTPS-запросы:
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	216
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	217 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	218 server {
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	219 listen 80;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	220 listen 443 ssl;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	221 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	222 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	223 ssl_certificate_key www.example.com.key;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	224 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	225 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	226 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	227
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	228 <note>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	229 До версии 0.7.14 SSL нельзя было включить выборочно для
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	230 отдельных слущающих сокетов, как показано выше.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	231 SSL можно было включить только для всего сервера целиком,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	232 с помощью директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	233 что не позволяло настроить единый HTTP/HTTPS сервер.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	234 Для решения этой задачи был добавлен
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	235 параметр <literal>ssl</literal>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	236 директивы <link doc="ngx_http_core_module.xml" id="listen"/>.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	237 Поэтому использование
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	238 директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	239 в современных версиях не рекомендуется.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	240 </note>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	241 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	242
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	243 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	244
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	245
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	246 <section id="name_based_https_servers" name="Выбор HTTPS-сервера по имени">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	247
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	248 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	249 Типичная проблема возникает при настройке двух и более серверов HTTPS,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	250 слушающих на одном и том же IP-адресе:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	251
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	252 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	253 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	254 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	255 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	256 ssl_certificate www.example.com.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	257 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	258 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	259
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	260 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	261 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	262 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	263 ssl_certificate www.example.org.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	264 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	265 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	266 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	267
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	268 В такой конфигурации браузер получит сертификат сервера по умолчанию, т.е.
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	269 <literal>www.example.com</literal>, независимо от запрашиваемого имени сервера.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	270 Это связано с поведением протокола SSL.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	271 SSL-соединение устанавливается до того, как браузер посылает HTTP-запрос,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	272 и nginx не знает имени запрашиваемого сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	273 Следовательно, он лишь может предложить сертификат сервера по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	274 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	275
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	276 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	277 Наиболее старым и надёжным способом решения этой проблемы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	278 является назначение каждому HTTPS-серверу своего IP-адреса:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	279
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	280 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	281 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	282 listen 192.168.1.1:443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	283 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	284 ssl_certificate www.example.com.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	285 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	286 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	287
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	288 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	289 listen 192.168.1.2:443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	290 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	291 ssl_certificate www.example.org.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	292 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	293 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	294 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	295 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	296
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	297
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	298 <section id="certificate_with_several_names"
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	299 name="SSL-сертификат с несколькими именами">
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	300
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	301 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	302 Существуют и другие способы, которые позволяют использовать один и тот же
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	303 IP-адрес сразу для нескольких HTTPS-серверов.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	304 Все они, однако, имеют свои недостатки.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	305 Одним из таких способов является использование сертификата с несколькими
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	306 именами в поле SubjectAltName сертификата, например
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	307 <literal>www.example.com</literal> и <literal>www.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	308 Однако, длина поля SubjectAltName ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	309 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	310
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	311 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	312 Другим способом является использование wildcard-сертификата, например
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	313 <literal>*.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	314 Такой сертификат защищает все поддомены указанного домена, но только
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	315 на заданном уровне.
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	316 Под такой сертификат подходит <literal>www.example.org</literal>, но не подходят
130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	317 <literal>example.org</literal> и <literal>www.sub.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	318 Два вышеуказанных способа можно комбинировать.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	319 Сертификат может одновременно содержать и точное, и wildcard имена в поле
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	320 SubjectAltName, например
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	321 <literal>example.org</literal> и <literal>*.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	322 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	323
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	324 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	325 Лучше поместить сведения о файле сертификата с несколькими именами и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	326 файле с его секретным ключом на уровне конфигурации <i>http</i>, чтобы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	327 все серверы унаследовали их единственную копию в памяти:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	328
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	329 <programlisting>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	330 ssl_certificate common.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	331 ssl_certificate_key common.key;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	332
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	333 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	334 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	335 server_name www.example.com;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	336 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	337 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	338
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	339 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	340 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	341 server_name www.example.org;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	342 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	343 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	344 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	345 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	346
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	347 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	348
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	349
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	350 <section id="sni" name="Указание имени сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	351
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	352 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	353 Более общее решение для работы нескольких HTTPS-серверов на одном
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	354 IP-адресе —
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	355 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">расширение
661 e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	356 Server Name Indication протокола TLS</link> (SNI, RFC 6066),
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	357 которое позволяет браузеру передать запрашиваемое имя сервера во время
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	358 SSL handshake, а значит сервер будет знать, какой сертификат ему
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	359 следует использовать для соединения.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	360 Однако, поддержка SNI браузерами ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	361 Сейчас это поддерживается браузерами начиная со следующих версий:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	362 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	363
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	364 <para>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	365 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	366
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	367 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	368 Opera 8.0;
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	369 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	370
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	371 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	372 MSIE 7.0 (но только на Windows Vista и выше);
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	373 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	374
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	375 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	376 Firefox 2.0 и другие браузеры, использующие Mozilla Platform rv:1.8.1;
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	377 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	378
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	379 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	380 Safari 3.2.1 (Windows-версия поддерживает SNI только на Vista и выше);
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	381 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	382
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	383 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	384 и Chrome (Windows-версия также поддерживает SNI только на Vista и выше).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	385 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	386
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	387 </list>
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	388 <note>
661 e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	389 В SNI можно передавать только доменные имена,
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	390 однако некоторые браузеры могут ошибочно передавать IP-адрес сервера
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	391 в качестве его имени, если в запросе указан IP-адрес.
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	392 Полагаться на это не следует.
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	393 </note>
bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	394 </para>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	395
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	396 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	397 Чтобы использовать SNI в nginx, соответствующая поддержка должна
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	398 присутствовать как в библиотеке OpenSSL, использованной при сборке
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	399 бинарного файла nginx, так и в библиотеке, подгружаемой в момент работы.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	400 OpenSSL поддерживает SNI начиная с версии 0.9.8f, если она была
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	401 собрана с опцией конфигурации <nobr>“--enable-tlsext”.</nobr>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	402 Начиная с OpenSSL 0.9.8j эта опция включена по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	403 Если nginx был собран с поддержкой SNI, то при запуске nginx с ключом
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	404 “-V” об этом сообщается:
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	405
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	406 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	407 $ nginx -V
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	408 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	409 TLS SNI support enabled
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	410 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	411 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	412
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	413 Однако, если nginx, собранный с поддержкой SNI, в процессе работы подгружает
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	414 библиотеку OpenSSL, в которой нет поддержки SNI, nginx выдаёт предупреждение:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	415
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	416 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	417 nginx was built with SNI support, however, now it is linked
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	418 dynamically to an OpenSSL library which has no tlsext support,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	419 therefore SNI is not available
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	420 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	421 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	422
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	423 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	424
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	425 </section>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	426
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	427
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	428 <section id="compatibility" name="Совместимость">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	429
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	430 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	431 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	432
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	433 <listitem>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	434 Статус поддержки SNI отображается по ключу “-V”
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	435 начиная с версий 0.8.21 и 0.7.62.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	436 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	437
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	438 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	439 Параметр <literal>ssl</literal> директивы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	440 <link doc="ngx_http_core_module.xml" id="listen"/>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	441 поддерживается начиная с версии 0.7.14.
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	442 До версии 0.8.21 его можно было указывать только совместно с
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	443 параметром <literal>default</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	444 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	445
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	446 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	447 SNI поддерживается начиная с версии 0.5.32.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	448 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	449
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	450 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	451 Разделяемый кэш SSL-сессий поддерживается начиная с версии 0.5.6.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	452 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	453
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	454 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	455 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	456
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	457 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	458 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	459
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	460 <listitem>
1499 3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	461 Версия 1.9.1 и более поздние: протоколами SSL по умолчанию являются
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	462 TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL).
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	463 </listitem>
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	464
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	465 <listitem>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	466 Версия 0.7.65, 0.8.19 и более поздние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	467 SSLv3, TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	468 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	469
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	470 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	471 Версия 0.7.64, 0.8.18 и более ранние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	472 SSLv2, SSLv3 и TLSv1.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	473 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	474
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	475 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	476 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	477
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	478 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	479 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	480
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	481 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	482 Версия 1.0.5 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	483 “<literal>HIGH:!aNULL:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	484 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	485
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	486 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	487 Версия 0.7.65, 0.8.20 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	488 “<literal>HIGH:!ADH:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	489 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	490
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	491 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	492 Версия 0.8.19: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	493 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	494 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	495
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	496 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	497 Версия 0.7.64, 0.8.18 и более ранние: шифрами SSL по умолчанию являются<br/>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	498 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	499 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	500
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	501 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	502 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	503
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	504
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	505 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	506
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	507
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	508 </article>

Mercurial > hg > nginx-site

annotate xml/ru/docs/http/configuring_https_servers.xml @ 1505:47f70f50d554