Mercurial > hg > nginx-site

annotate xml/ru/docs/http/configuring_https_servers.xml @ 2632:52500ccb82c1

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Updated docs for the upcoming NGINX Plus release.
author Yaroslav Zhuravlev <yar@nginx.com>
date Fri, 04 Dec 2020 13:34:05 +0000
parents aac9e462320b
children 37e082fd009c
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
1 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
4 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
5
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <article name="Настройка HTTPS-серверов"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 link="/ru/docs/http/configuring_https_servers.html"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 lang="ru"
2061
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
11 rev="13"
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12 author="Игорь Сысоев"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13 editor="Brian Mercer">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 <section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 <para>
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
18 Чтобы настроить HTTPS-сервер, необходимо включить параметр
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
19 <literal>ssl</literal> на
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
20 <link doc="ngx_http_core_module.xml" id="listen">слушающих сокетах</link>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
21 в блоке <link doc="ngx_http_core_module.xml" id="server"/>,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
22 а также указать местоположение файлов с
1733
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
23 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate">сертификатом сервера</link>
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
24 и
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
25 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate_key">секретным ключом</link>:
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
29 listen 443 <b>ssl</b>;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
30 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
31 ssl_certificate <b>www.example.com.crt</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
32 ssl_certificate_key <b>www.example.com.key</b>;
1411
8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents: 817
diff changeset
33 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
34 ssl_ciphers HIGH:!aNULL:!MD5;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 Сертификат сервера является публичным.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40 Он посылается каждому клиенту, соединяющемуся с сервером.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 Секретный ключ следует хранить в файле с ограниченным доступом
1842
db848aaa123a Corrected Russian translation of "master process".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1757
diff changeset
42 (права доступа должны позволять главному процессу nginx читать этот файл).
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 Секретный ключ можно также хранить в одном файле с сертификатом:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 <programlisting>
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
46 ssl_certificate www.example.com.cert;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
47 ssl_certificate_key www.example.com.cert;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50 при этом права доступа к файлу следует также ограничить.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 Несмотря на то, что и сертификат, и ключ хранятся в одном файле,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52 клиенту посылается только сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56 С помощью директив <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 можно ограничить соединения
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 использованием только “сильных” версий и шифров SSL/TLS.
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
60 По умолчанию nginx использует
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
61 “<literal>ssl_protocols TLSv1 TLSv1.1 TLSv1.2</literal>” и
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62 “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”,
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
63 поэтому их явная настройка в общем случае не требуется.
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
64 Следует отметить, что значения по умолчанию этих директив несколько раз
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
65 <link id="compatibility">менялись</link>.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 <section id="optimization" name="Оптимизация HTTPS-сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74 SSL-операции потребляют дополнительные ресурсы процессора.
1733
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
75 На мультипроцессорных системах следует запускать несколько
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
76 <link doc="../ngx_core_module.xml" id="worker_processes">рабочих процессов</link>,
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 не меньше числа доступных процессорных ядер.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 Наиболее ресурсоёмкой для процессора является операция SSL handshake, в рамках
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 которой формируются криптографические параметры сессии.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 Существует два способа уменьшения числа этих операций, производимых для каждого
1733
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
81 клиента: использование постоянных
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
82 (<link doc="ngx_http_core_module.xml" id="keepalive_timeout">keepalive</link>)
ecf2dd95ceb6 Added links in "Configuring HTTPS servers".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1505
diff changeset
83 соединений, позволяющих в рамках
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 одного соединения обрабатывать сразу несколько запросов, и повторное
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 использование параметров SSL-сессии для предотвращения необходимости выполнения
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 SSL handshake для параллельных и последующих соединений.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 Сессии хранятся в кэше SSL-сессий, разделяемом между рабочими процессами и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 настраиваемом директивой
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 В 1 мегабайт кэша помещается около 4000 сессий.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 Таймаут кэша по умолчанию равен 5 минутам.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 Он может быть увеличен с помощью директивы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>.
817
4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents: 801
diff changeset
94 Вот пример конфигурации, оптимизированной под многоядерную систему
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
95 с 10-мегабайтным разделяемым кэшем сессий:
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 <programlisting>
817
4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents: 801
diff changeset
98 <b>worker_processes auto</b>;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 http {
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
101 <b>ssl_session_cache shared:SSL:10m</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
102 <b>ssl_session_timeout 10m</b>;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
105 listen 443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
106 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
107 <b>keepalive_timeout 70</b>;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
109 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
110 ssl_certificate_key www.example.com.key;
1411
8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents: 817
diff changeset
111 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
112 ssl_ciphers HIGH:!aNULL:!MD5;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120 <section id="chains" name="Цепочки SSL-сертификатов">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123 Некоторые браузеры могут выдавать предупреждение о сертификате, подписанном
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 общеизвестным центром сертификации, в то время как другие браузеры без
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 проблем принимают этот же сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 Так происходит потому, что центр, выдавший сертификат, подписал его
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 промежуточным сертификатом, которого нет в базе данных сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 общеизвестных доверенных центров сертификации, распространяемой
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 вместе с браузером.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 В подобном случае центр сертификации предоставляет “связку” сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 которую следует присоединить к сертификату сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 Сертификат сервера следует разместить перед связкой сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 в скомбинированном файле:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 Полученный файл следует указать в директиве
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
144 listen 443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
145 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
146 ssl_certificate www.example.com.chained.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
147 ssl_certificate_key www.example.com.key;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152 Если сертификат сервера и связка сертификатов были соединены в неправильном
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 порядке, nginx откажется запускаться и выдаст сообщение об ошибке:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157 (SSL: error:0B080074:x509 certificate routines:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 X509_check_private_key:key values mismatch)
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 поскольку nginx попытается использовать секретный ключ с первым
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 сертификатом из связки вместо сертификата сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 Браузеры обычно сохраняют полученные промежуточные сертификаты, подписанные
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 доверенными центрами сертификации, поэтому активно используемые браузеры
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 уже могут иметь требуемые промежуточные сертификаты и не выдать предупреждение
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 о сертификате, присланном без связанной с ним цепочки сертификатов.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170 Убедиться в том, что сервер присылает полную цепочку сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 можно при помощи утилиты командной строки <command>openssl</command>, например:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 $ openssl s_client -connect www.godaddy.com:443
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 Certificate chain
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
182 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
186 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
187 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
188 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
189 i:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
190 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191 2 s:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 /OU=ValiCert Class 2 Policy Validation Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195 /CN=http://www.valicert.com//emailAddress=info@valicert.com
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198
2061
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
199 <note>
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
200 При тестировании конфигураций с <link id="sni">SNI</link>
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
201 необходимо указывать опцию <literal>-servername</literal>,
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
202 так как <command>openssl</command> по умолчанию не использует SNI.
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
203 </note>
aac9e462320b Added note about s_client and SNI (trac #708).
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2044
diff changeset
204
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
205 В этом примере субъект (“<i>s</i>”) сертификата №0 сервера
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
206 <literal>www.GoDaddy.com</literal> подписан издателем (“<i>i</i>”),
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 который в свою очередь является субъектом сертификата №1, подписанного
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208 издателем, который в свою очередь является субъектом сертификата №2,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 подписанного общеизвестным издателем <i>ValiCert, Inc.</i>,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 чей сертификат хранится во встроенной в браузеры базе данных
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 сертификатов (которая в тёмном чулане хранится в доме, который построил Джек).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215 Если связку сертификатов не добавили, будет показан только сертификат
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 сервера №0.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
218
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222 <section id="single_http_https_server" name="Единый HTTP/HTTPS сервер">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 <para>
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
225 Можно настроить единый сервер, который обслуживает как HTTP-,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
226 так и HTTPS-запросы:
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229 server {
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
230 listen 80;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
231 listen 443 ssl;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
232 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
233 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
234 ssl_certificate_key www.example.com.key;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
237 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
239 <note>
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
240 До версии 0.7.14 SSL нельзя было включить выборочно для
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
241 отдельных слущающих сокетов, как показано выше.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
242 SSL можно было включить только для всего сервера целиком,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
243 с помощью директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
244 что не позволяло настроить единый HTTP/HTTPS сервер.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
245 Для решения этой задачи был добавлен
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
246 параметр <literal>ssl</literal>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
247 директивы <link doc="ngx_http_core_module.xml" id="listen"/>.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
248 Поэтому использование
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
249 директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
250 в современных версиях не рекомендуется.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 </note>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257 <section id="name_based_https_servers" name="Выбор HTTPS-сервера по имени">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
258
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 Типичная проблема возникает при настройке двух и более серверов HTTPS,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261 слушающих на одном и том же IP-адресе:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
265 listen 443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
266 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
267 ssl_certificate www.example.com.crt;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
272 listen 443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
273 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
274 ssl_certificate www.example.org.crt;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
279 В такой конфигурации браузер получит сертификат сервера по умолчанию, т.е.
593
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 589
diff changeset
280 <literal>www.example.com</literal>, независимо от запрашиваемого имени сервера.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281 Это связано с поведением протокола SSL.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 SSL-соединение устанавливается до того, как браузер посылает HTTP-запрос,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283 и nginx не знает имени запрашиваемого сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 Следовательно, он лишь может предложить сертификат сервера по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 Наиболее старым и надёжным способом решения этой проблемы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289 является назначение каждому HTTPS-серверу своего IP-адреса:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
293 listen 192.168.1.1:443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
294 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
295 ssl_certificate www.example.com.crt;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
300 listen 192.168.1.2:443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
301 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
302 ssl_certificate www.example.org.crt;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
305 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
307
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
308
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309 <section id="certificate_with_several_names"
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
310 name="SSL-сертификат с несколькими именами">
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313 Существуют и другие способы, которые позволяют использовать один и тот же
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314 IP-адрес сразу для нескольких HTTPS-серверов.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315 Все они, однако, имеют свои недостатки.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316 Одним из таких способов является использование сертификата с несколькими
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
317 именами в поле SubjectAltName сертификата, например
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
318 <literal>www.example.com</literal> и <literal>www.example.org</literal>.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319 Однако, длина поля SubjectAltName ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
323 Другим способом является использование wildcard-сертификата, например
593
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 589
diff changeset
324 <literal>*.example.org</literal>.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 Такой сертификат защищает все поддомены указанного домена, но только
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326 на заданном уровне.
593
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 589
diff changeset
327 Под такой сертификат подходит <literal>www.example.org</literal>, но не подходят
130fad6dc1b4 Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents: 589
diff changeset
328 <literal>example.org</literal> и <literal>www.sub.example.org</literal>.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329 Два вышеуказанных способа можно комбинировать.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
330 Сертификат может одновременно содержать и точное, и wildcard имена в поле
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
331 SubjectAltName, например
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
332 <literal>example.org</literal> и <literal>*.example.org</literal>.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336 Лучше поместить сведения о файле сертификата с несколькими именами и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 файле с его секретным ключом на уровне конфигурации <i>http</i>, чтобы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 все серверы унаследовали их единственную копию в памяти:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 <programlisting>
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
341 ssl_certificate common.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
342 ssl_certificate_key common.key;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
345 listen 443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
346 server_name www.example.com;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
351 listen 443 ssl;
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
352 server_name www.example.org;
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
355 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361 <section id="sni" name="Указание имени сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364 Более общее решение для работы нескольких HTTPS-серверов на одном
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 IP-адресе —
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">расширение
661
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents: 660
diff changeset
367 Server Name Indication протокола TLS</link> (SNI, RFC 6066),
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 которое позволяет браузеру передать запрашиваемое имя сервера во время
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369 SSL handshake, а значит сервер будет знать, какой сертификат ему
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 следует использовать для соединения.
2040
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1842
diff changeset
371 Сейчас SNI
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1842
diff changeset
372 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication#Support">поддерживается</link>
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1842
diff changeset
373 большинством современных браузеров, однако может не использоваться некоторыми
093855e77388 Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1842
diff changeset
374 старыми или специализированными клиентами.
658
bd81a71006fe Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
375 <note>
661
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents: 660
diff changeset
376 В SNI можно передавать только доменные имена,
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents: 660
diff changeset
377 однако некоторые браузеры могут ошибочно передавать IP-адрес сервера
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents: 660
diff changeset
378 в качестве его имени, если в запросе указан IP-адрес.
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents: 660
diff changeset
379 Полагаться на это не следует.
658
bd81a71006fe Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
380 </note>
bd81a71006fe Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents: 593
diff changeset
381 </para>
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384 Чтобы использовать SNI в nginx, соответствующая поддержка должна
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 присутствовать как в библиотеке OpenSSL, использованной при сборке
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
386 бинарного файла nginx, так и в библиотеке, подгружаемой в момент работы.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
387 OpenSSL поддерживает SNI начиная с версии 0.9.8f, если она была
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
388 собрана с опцией конфигурации <nobr>“--enable-tlsext”.</nobr>
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389 Начиная с OpenSSL 0.9.8j эта опция включена по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 Если nginx был собран с поддержкой SNI, то при запуске nginx с ключом
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
391 “-V” об этом сообщается:
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394 $ nginx -V
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 TLS SNI support enabled
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399
2044
4aead463a7e2 Removed unnecessary comma in Russian texts.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 2040
diff changeset
400 Однако если nginx, собранный с поддержкой SNI, в процессе работы подгружает
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 библиотеку OpenSSL, в которой нет поддержки SNI, nginx выдаёт предупреждение:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 nginx was built with SNI support, however, now it is linked
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 dynamically to an OpenSSL library which has no tlsext support,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 therefore SNI is not available
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
412 </section>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
413
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 <section id="compatibility" name="Совместимость">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420 <listitem>
660
ba45bd0fc71e configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents: 659
diff changeset
421 Статус поддержки SNI отображается по ключу “-V”
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
422 начиная с версий 0.8.21 и 0.7.62.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 Параметр <literal>ssl</literal> директивы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427 <link doc="ngx_http_core_module.xml" id="listen"/>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 поддерживается начиная с версии 0.7.14.
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
429 До версии 0.8.21 его можно было указывать только совместно с
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 782
diff changeset
430 параметром <literal>default</literal>.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433 <listitem>
1757
40e461a34187 Fixed a typo in nginx version number.
Valentin Bartenev <vbart@nginx.com>
parents: 1733
diff changeset
434 SNI поддерживается начиная с версии 0.5.23.
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
436
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438 Разделяемый кэш SSL-сессий поддерживается начиная с версии 0.5.6.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
440
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
441 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
442 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
447 <listitem>
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
448 Версия 1.9.1 и более поздние: протоколами SSL по умолчанию являются
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
449 TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL).
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
450 </listitem>
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
451
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1411
diff changeset
452 <listitem>
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453 Версия 0.7.65, 0.8.19 и более поздние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454 SSLv3, TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 Версия 0.7.64, 0.8.18 и более ранние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459 SSLv2, SSLv3 и TLSv1.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
463 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
464
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
465 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
466 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469 Версия 1.0.5 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
470 “<literal>HIGH:!aNULL:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
471 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
472
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 Версия 0.7.65, 0.8.20 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475 “<literal>HIGH:!ADH:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
477
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 Версия 0.8.19: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
482
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
483 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
484 Версия 0.7.64, 0.8.18 и более ранние: шифрами SSL по умолчанию являются<br/>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
489 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
491
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
492 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
494
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 </article>