nginx-site: xml/ru/docs/http/configuring_https

annotate xml/ru/docs/http/configuring_https_servers.xml @ 817:4fecf0715bbf

Introducing "worker_processes auto" in SSL configuration examples.

author	Andrei Belov <defan@nginx.com>
date	Tue, 22 Jan 2013 17:45:12 +0400
parents	b95a6d779c89
children	8fe28c6edaa1

rev	line source
580 be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	1 <!--
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	4 -->
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 547 diff changeset	5
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	7
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	8 <article name="Настройка HTTPS-серверов"
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	9 link="/ru/docs/http/configuring_https_servers.html"
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	10 lang="ru"
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	11 rev="6"
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	12 author="Игорь Сысоев"
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	13 editor="Brian Mercer">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	14
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	15 <section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	16
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	17 <para>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	18 Чтобы настроить HTTPS-сервер, необходимо включить параметр
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	19 <literal>ssl</literal> на
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	20 <link doc="ngx_http_core_module.xml" id="listen">слушающих сокетах</link>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	21 в блоке <link doc="ngx_http_core_module.xml" id="server"/>,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	22 а также указать местоположение файлов с
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	23 сертификатом сервера и секретным ключом:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	24
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	25 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	26 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	27 listen 443 <b>ssl</b>;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	28 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	29 ssl_certificate <b>www.example.com.crt</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	30 ssl_certificate_key <b>www.example.com.key</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	31 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	32 ssl_ciphers HIGH:!aNULL:!MD5;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	33 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	34 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	35 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	36
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	37 Сертификат сервера является публичным.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	38 Он посылается каждому клиенту, соединяющемуся с сервером.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	39 Секретный ключ следует хранить в файле с ограниченным доступом
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	40 (права доступа должны позволять основному процессу nginx читать этот файл).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	41 Секретный ключ можно также хранить в одном файле с сертификатом:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	42
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	43 <programlisting>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	44 ssl_certificate www.example.com.cert;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	45 ssl_certificate_key www.example.com.cert;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	46 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	47
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	48 при этом права доступа к файлу следует также ограничить.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	49 Несмотря на то, что и сертификат, и ключ хранятся в одном файле,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	50 клиенту посылается только сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	51 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	52
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	53 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	54 С помощью директив <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	55 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	56 можно ограничить соединения
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	57 использованием только “сильных” версий и шифров SSL/TLS.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	58 Начиная с версии 1.0.5 nginx по умолчанию использует
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	59 “<literal>ssl_protocols SSLv3 TLSv1</literal>” и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	60 “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	61 поэтому явная их настройка имеет смысл только для более ранних версий nginx.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	62 Начиная с версий 1.1.13 и 1.0.12 nginx по умолчанию использует
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	63 “<literal>ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	64 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	65
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	66 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	67 Известно, что шифры с CBC-режимом уязвимы к ряду атак, в частности
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	68 к BEAST-атаке (см.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	69 <link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	70 Настройка шифров может быть изменена так, чтобы предпочитался RC4-SHA:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	71
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	72 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	73 ssl_ciphers RC4:HIGH:!aNULL:!MD5;
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	74 ssl_prefer_server_ciphers on;
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	75 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	76 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	77
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	78 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	79
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	80
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	81 <section id="optimization" name="Оптимизация HTTPS-сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	82
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	83 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	84 SSL-операции потребляют дополнительные ресурсы процессора.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	85 На мультипроцессорных системах следует запускать несколько рабочих процессов,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	86 не меньше числа доступных процессорных ядер.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	87 Наиболее ресурсоёмкой для процессора является операция SSL handshake, в рамках
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	88 которой формируются криптографические параметры сессии.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	89 Существует два способа уменьшения числа этих операций, производимых для каждого
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	90 клиента: использование постоянных (keepalive) соединений, позволяющих в рамках
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	91 одного соединения обрабатывать сразу несколько запросов, и повторное
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	92 использование параметров SSL-сессии для предотвращения необходимости выполнения
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	93 SSL handshake для параллельных и последующих соединений.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	94 Сессии хранятся в кэше SSL-сессий, разделяемом между рабочими процессами и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	95 настраиваемом директивой
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	96 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	97 В 1 мегабайт кэша помещается около 4000 сессий.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	98 Таймаут кэша по умолчанию равен 5 минутам.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	99 Он может быть увеличен с помощью директивы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	100 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>.
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	101 Вот пример конфигурации, оптимизированной под многоядерную систему
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	102 с 10-мегабайтным разделяемым кэшем сессий:
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	103
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	104 <programlisting>
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	105 <b>worker_processes auto</b>;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	106
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	107 http {
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	108 <b>ssl_session_cache shared:SSL:10m</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	109 <b>ssl_session_timeout 10m</b>;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	110
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	111 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	112 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	113 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	114 <b>keepalive_timeout 70</b>;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	115
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	116 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	117 ssl_certificate_key www.example.com.key;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	118 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	119 ssl_ciphers HIGH:!aNULL:!MD5;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	120 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	121 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	122 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	123
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	124 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	125
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	126
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	127 <section id="chains" name="Цепочки SSL-сертификатов">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	128
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	129 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	130 Некоторые браузеры могут выдавать предупреждение о сертификате, подписанном
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	131 общеизвестным центром сертификации, в то время как другие браузеры без
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	132 проблем принимают этот же сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	133 Так происходит потому, что центр, выдавший сертификат, подписал его
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	134 промежуточным сертификатом, которого нет в базе данных сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	135 общеизвестных доверенных центров сертификации, распространяемой
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	136 вместе с браузером.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	137 В подобном случае центр сертификации предоставляет “связку” сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	138 которую следует присоединить к сертификату сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	139 Сертификат сервера следует разместить перед связкой сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	140 в скомбинированном файле:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	141
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	142 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	143 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	144 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	145
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	146 Полученный файл следует указать в директиве
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	147 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	148
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	149 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	150 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	151 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	152 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	153 ssl_certificate www.example.com.chained.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	154 ssl_certificate_key www.example.com.key;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	155 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	156 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	157 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	158
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	159 Если сертификат сервера и связка сертификатов были соединены в неправильном
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	160 порядке, nginx откажется запускаться и выдаст сообщение об ошибке:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	161
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	162 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	163 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	164 (SSL: error:0B080074:x509 certificate routines:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	165 X509_check_private_key:key values mismatch)
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	166 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	167
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	168 поскольку nginx попытается использовать секретный ключ с первым
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	169 сертификатом из связки вместо сертификата сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	170 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	171
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	172 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	173 Браузеры обычно сохраняют полученные промежуточные сертификаты, подписанные
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	174 доверенными центрами сертификации, поэтому активно используемые браузеры
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	175 уже могут иметь требуемые промежуточные сертификаты и не выдать предупреждение
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	176 о сертификате, присланном без связанной с ним цепочки сертификатов.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	177 Убедиться в том, что сервер присылает полную цепочку сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	178 можно при помощи утилиты командной строки <command>openssl</command>, например:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	179
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	180 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	181 $ openssl s_client -connect www.godaddy.com:443
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	182 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	183 Certificate chain
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	184 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	185 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	186 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	187 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	188 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	189 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	190 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	191 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	192 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	193 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	194 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	195 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	196 i:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	197 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	198 2 s:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	199 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	200 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	201 /OU=ValiCert Class 2 Policy Validation Authority
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	202 /CN=http://www.valicert.com//emailAddress=info@valicert.com
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	203 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	204 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	205
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	206 В этом примере субъект (“<i>s</i>”) сертификата №0 сервера
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	207 <literal>www.GoDaddy.com</literal> подписан издателем (“<i>i</i>”),
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	208 который в свою очередь является субъектом сертификата №1, подписанного
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	209 издателем, который в свою очередь является субъектом сертификата №2,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	210 подписанного общеизвестным издателем <i>ValiCert, Inc.</i>,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	211 чей сертификат хранится во встроенной в браузеры базе данных
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	212 сертификатов (которая в тёмном чулане хранится в доме, который построил Джек).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	213 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	214
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	215 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	216 Если связку сертификатов не добавили, будет показан только сертификат
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	217 сервера №0.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	218 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	219
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	220 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	221
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	222
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	223 <section id="single_http_https_server" name="Единый HTTP/HTTPS сервер">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	224
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	225 <para>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	226 Можно настроить единый сервер, который обслуживает как HTTP-,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	227 так и HTTPS-запросы:
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	228
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	229 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	230 server {
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	231 listen 80;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	232 listen 443 ssl;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	233 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	234 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	235 ssl_certificate_key www.example.com.key;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	236 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	237 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	238 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	239
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	240 <note>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	241 До версии 0.7.14 SSL нельзя было включить выборочно для
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	242 отдельных слущающих сокетов, как показано выше.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	243 SSL можно было включить только для всего сервера целиком,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	244 с помощью директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	245 что не позволяло настроить единый HTTP/HTTPS сервер.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	246 Для решения этой задачи был добавлен
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	247 параметр <literal>ssl</literal>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	248 директивы <link doc="ngx_http_core_module.xml" id="listen"/>.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	249 Поэтому использование
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	250 директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	251 в современных версиях не рекомендуется.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	252 </note>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	253 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	254
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	255 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	256
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	257
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	258 <section id="name_based_https_servers" name="Выбор HTTPS-сервера по имени">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	259
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	260 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	261 Типичная проблема возникает при настройке двух и более серверов HTTPS,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	262 слушающих на одном и том же IP-адресе:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	263
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	264 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	265 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	266 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	267 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	268 ssl_certificate www.example.com.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	269 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	270 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	271
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	272 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	273 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	274 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	275 ssl_certificate www.example.org.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	276 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	277 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	278 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	279
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	280 В такой конфигурации браузер получит сертификат сервера по умолчанию, т.е.
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	281 <literal>www.example.com</literal>, независимо от запрашиваемого имени сервера.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	282 Это связано с поведением протокола SSL.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	283 SSL-соединение устанавливается до того, как браузер посылает HTTP-запрос,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	284 и nginx не знает имени запрашиваемого сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	285 Следовательно, он лишь может предложить сертификат сервера по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	286 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	287
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	288 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	289 Наиболее старым и надёжным способом решения этой проблемы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	290 является назначение каждому HTTPS-серверу своего IP-адреса:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	291
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	292 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	293 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	294 listen 192.168.1.1:443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	295 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	296 ssl_certificate www.example.com.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	297 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	298 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	299
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	300 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	301 listen 192.168.1.2:443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	302 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	303 ssl_certificate www.example.org.crt;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	304 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	305 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	306 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	307 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	308
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	309
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	310 <section id="certificate_with_several_names"
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	311 name="SSL-сертификат с несколькими именами">
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	312
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	313 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	314 Существуют и другие способы, которые позволяют использовать один и тот же
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	315 IP-адрес сразу для нескольких HTTPS-серверов.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	316 Все они, однако, имеют свои недостатки.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	317 Одним из таких способов является использование сертификата с несколькими
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	318 именами в поле SubjectAltName сертификата, например
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	319 <literal>www.example.com</literal> и <literal>www.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	320 Однако, длина поля SubjectAltName ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	321 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	322
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	323 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	324 Другим способом является использование wildcard-сертификата, например
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	325 <literal>*.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	326 Такой сертификат защищает все поддомены указанного домена, но только
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	327 на заданном уровне.
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	328 Под такой сертификат подходит <literal>www.example.org</literal>, но не подходят
130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	329 <literal>example.org</literal> и <literal>www.sub.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	330 Два вышеуказанных способа можно комбинировать.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	331 Сертификат может одновременно содержать и точное, и wildcard имена в поле
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	332 SubjectAltName, например
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	333 <literal>example.org</literal> и <literal>*.example.org</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	334 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	335
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	336 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	337 Лучше поместить сведения о файле сертификата с несколькими именами и
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	338 файле с его секретным ключом на уровне конфигурации <i>http</i>, чтобы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	339 все серверы унаследовали их единственную копию в памяти:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	340
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	341 <programlisting>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	342 ssl_certificate common.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	343 ssl_certificate_key common.key;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	344
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	345 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	346 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	347 server_name www.example.com;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	348 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	349 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	350
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	351 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	352 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	353 server_name www.example.org;
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	354 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	355 }
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	356 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	357 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	358
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	359 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	360
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	361
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	362 <section id="sni" name="Указание имени сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	363
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	364 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	365 Более общее решение для работы нескольких HTTPS-серверов на одном
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	366 IP-адресе —
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	367 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">расширение
661 e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	368 Server Name Indication протокола TLS</link> (SNI, RFC 6066),
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	369 которое позволяет браузеру передать запрашиваемое имя сервера во время
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	370 SSL handshake, а значит сервер будет знать, какой сертификат ему
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	371 следует использовать для соединения.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	372 Однако, поддержка SNI браузерами ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	373 Сейчас это поддерживается браузерами начиная со следующих версий:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	374 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	375
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	376 <para>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	377 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	378
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	379 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	380 Opera 8.0;
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	381 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	382
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	383 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	384 MSIE 7.0 (но только на Windows Vista и выше);
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	385 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	386
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	387 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	388 Firefox 2.0 и другие браузеры, использующие Mozilla Platform rv:1.8.1;
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	389 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	390
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	391 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	392 Safari 3.2.1 (Windows-версия поддерживает SNI только на Vista и выше);
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	393 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	394
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	395 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	396 и Chrome (Windows-версия также поддерживает SNI только на Vista и выше).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	397 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	398
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	399 </list>
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	400 <note>
661 e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	401 В SNI можно передавать только доменные имена,
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	402 однако некоторые браузеры могут ошибочно передавать IP-адрес сервера
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	403 в качестве его имени, если в запросе указан IP-адрес.
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	404 Полагаться на это не следует.
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	405 </note>
bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	406 </para>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	407
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	408 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	409 Чтобы использовать SNI в nginx, соответствующая поддержка должна
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	410 присутствовать как в библиотеке OpenSSL, использованной при сборке
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	411 бинарного файла nginx, так и в библиотеке, подгружаемой в момент работы.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	412 OpenSSL поддерживает SNI начиная с версии 0.9.8f, если она была
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	413 собрана с опцией конфигурации <nobr>“--enable-tlsext”.</nobr>
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	414 Начиная с OpenSSL 0.9.8j эта опция включена по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	415 Если nginx был собран с поддержкой SNI, то при запуске nginx с ключом
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	416 “-V” об этом сообщается:
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	417
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	418 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	419 $ nginx -V
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	420 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	421 TLS SNI support enabled
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	422 ...
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	423 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	424
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	425 Однако, если nginx, собранный с поддержкой SNI, в процессе работы подгружает
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	426 библиотеку OpenSSL, в которой нет поддержки SNI, nginx выдаёт предупреждение:
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	427
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	428 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	429 nginx was built with SNI support, however, now it is linked
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	430 dynamically to an OpenSSL library which has no tlsext support,
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	431 therefore SNI is not available
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	432 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	433 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	434
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	435 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	436
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	437 </section>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	438
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	439
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	440 <section id="compatibility" name="Совместимость">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	441
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	442 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	443 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	444
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	445 <listitem>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	446 Статус поддержки SNI отображается по ключу “-V”
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	447 начиная с версий 0.8.21 и 0.7.62.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	448 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	449
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	450 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	451 Параметр <literal>ssl</literal> директивы
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	452 <link doc="ngx_http_core_module.xml" id="listen"/>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	453 поддерживается начиная с версии 0.7.14.
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	454 До версии 0.8.21 его можно было указывать только совместно с
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	455 параметром <literal>default</literal>.
547 32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	456 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	457
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	458 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	459 SNI поддерживается начиная с версии 0.5.32.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	460 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	461
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	462 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	463 Разделяемый кэш SSL-сессий поддерживается начиная с версии 0.5.6.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	464 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	465
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	466 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	467 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	468
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	469 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	470 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	471
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	472 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	473 Версия 0.7.65, 0.8.19 и более поздние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	474 SSLv3, TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL).
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	475 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	476
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	477 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	478 Версия 0.7.64, 0.8.18 и более ранние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	479 SSLv2, SSLv3 и TLSv1.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	480 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	481
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	482 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	483 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	484
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	485 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	486 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	487
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	488 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	489 Версия 1.0.5 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	490 “<literal>HIGH:!aNULL:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	491 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	492
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	493 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	494 Версия 0.7.65, 0.8.20 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	495 “<literal>HIGH:!ADH:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	496 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	497
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	498 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	499 Версия 0.8.19: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	500 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	501 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	502
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	503 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	504 Версия 0.7.64, 0.8.18 и более ранние: шифрами SSL по умолчанию являются<br/>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	505 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	506 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	507
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	508 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	509 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	510
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	511
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	512 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	513
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	514
32dd85720515 Translated "configuring_https_servers" intro Russian. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	515 </article>

Mercurial > hg > nginx-site

annotate xml/ru/docs/http/configuring_https_servers.xml @ 817:4fecf0715bbf