Mercurial > hg > nginx-site
annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 491:5a3362234a4d
If text of the link given by URL is not provided, the URL is used.
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Thu, 19 Apr 2012 12:44:09 +0000 |
parents | b83d332fbdaa |
children | 58dd64aef626 |
rev | line source |
---|---|
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1 <?xml version="1.0"?> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
2 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
3 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
4 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
5 <module name="Module ngx_http_ssl_module" |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
6 link="/en/docs/http/ngx_http_ssl_module.html" |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
7 lang="en"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 <section id="summary"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
11 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
12 The <literal>ngx_http_ssl_module</literal> module provides the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
13 necessary support for HTTPS. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
17 This module is not built by default, it should be enabled with the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
18 <literal>--with-http_ssl_module</literal> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
19 configuration parameter. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
20 <note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
21 This module requires the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
22 <link url="http://www.openssl.org">OpenSSL</link> library. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
23 </note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
24 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
25 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
26 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
27 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
28 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
29 <section id="example" name="Example Configuration"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
30 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
31 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
32 To reduce the processor load it is recommended to |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
33 <list type="bullet"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
34 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
35 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
36 set the number of worker processes equal to the number of processors, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
37 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
38 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
39 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
40 enable keep-alive connections, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
41 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
42 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
43 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
44 enable shared session cache, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
45 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
46 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
47 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
48 disable built-in session cache, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
49 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
50 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
51 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
52 and possibly increase the session lifetime (by default, 5 minutes): |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
53 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
54 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
55 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
56 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
57 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
58 <emphasis>worker_processes 2;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
59 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
60 http { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
61 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
62 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
63 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
64 server { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
65 listen 443; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
66 <emphasis>keepalive_timeout 70;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
67 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
68 ssl on; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
69 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
70 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
71 ssl_certificate /usr/local/nginx/conf/cert.pem; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
72 ssl_certificate_key /usr/local/nginx/conf/cert.key; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
73 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
74 <emphasis>ssl_session_timeout 10m;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
75 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
76 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
77 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
78 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
79 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
80 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
81 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 <section id="directives" name="Directives"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 <directive name="ssl"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
89 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
90 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 Enables the HTTPS protocol for the given virtual server. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
95 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
97 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
98 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
99 <directive name="ssl_certificate"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
100 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
101 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
102 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
103 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
104 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
105 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
106 Specifies a file with a certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
107 for the given virtual server. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
108 If intermediate certificates should be specified in addition |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
109 to a primary certificate, they should be specified in the same file |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
110 in the following order: the primary certificate comes first, then |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
111 the intermediate certificates. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
112 A secret key in the PEM format may be placed in the same file. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
113 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
114 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
115 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
116 It should be kept in mind that due to the HTTPS protocol limitations |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
117 virtual servers should listen on different IP addresses: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
118 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
119 server { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
120 listen 192.168.1.1:443; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
121 server_name one.example.com; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
122 ssl_certificate /usr/local/nginx/conf/one.example.com.cert; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
123 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
124 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
125 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
126 server { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
127 listen 192.168.1.2:443; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
128 server_name two.example.com; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
129 ssl_certificate /usr/local/nginx/conf/two.example.com.cert; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
130 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
131 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
132 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
133 otherwise |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
134 <link doc="configuring_https_servers.xml" |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
135 id="name_based_https_servers">the first server’s certificate</link> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
136 will be issued for the second site. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
137 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
138 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
139 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
140 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 <directive name="ssl_certificate_key"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
143 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
145 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
146 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
147 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 Specifies a file with a secret key in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
150 for the given virtual server. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
151 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
152 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
153 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
154 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
155 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
156 <directive name="ssl_ciphers"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
157 <syntax><value>ciphers</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
158 <default>HIGH:!ADH:!MD5</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
159 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
160 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
161 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
162 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
163 Specifies the enabled ciphers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
164 The ciphers are specified in the format understood by the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
165 OpenSSL library, for example: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
166 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
167 ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
168 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
169 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
170 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
171 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
172 The full list can be viewed using the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
173 “<command>openssl ciphers</command>” command. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
174 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
175 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
176 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
177 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
178 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
179 <directive name="ssl_client_certificate"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
180 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
181 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
182 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
183 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
184 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
185 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
186 Specifies a file with CA certificates in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
187 used for client certificate verification. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
188 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
189 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
190 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
191 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
192 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
193 <directive name="ssl_crl"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
194 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
195 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
196 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
197 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
198 <appeared-in>0.8.7</appeared-in> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
199 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
200 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
201 Specifies a file with revoked certificates (CRL) |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
202 in the PEM format, used to client certificate verification. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
203 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
204 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
205 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
206 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
207 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
208 <directive name="ssl_dhparam"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
209 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
210 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
211 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
212 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
213 <appeared-in>0.7.2</appeared-in> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 Specifies a file with DH parameters for EDH ciphers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
217 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
218 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
219 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
220 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
221 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
222 <directive name="ssl_prefer_server_ciphers"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
223 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
224 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
225 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
226 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
227 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
228 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
229 Specifies that server ciphers should be preferred over client |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
230 ciphers when using the SSLv3 and TLS protocols. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
231 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
232 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
233 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
234 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
235 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
236 <directive name="ssl_protocols"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
237 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
238 [<literal>SSLv2</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
239 [<literal>SSLv3</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
240 [<literal>TLSv1</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
241 [<literal>TLSv1.1</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
242 [<literal>TLSv1.2</literal>]</syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
243 <default>SSLv3 TLSv1 TLSv1.1 TLSv1.2</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
244 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
245 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
246 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
247 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
248 Enables the specified protocols. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
249 The parameters <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> work |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
250 only when using the OpenSSL library version 1.0.1 and higher. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
251 <note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 The parameters <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> are |
393
b83d332fbdaa
Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents:
384
diff
changeset
|
253 supported starting from versions 1.1.13 and 1.0.12 |
b83d332fbdaa
Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents:
384
diff
changeset
|
254 so when using OpenSSL version 1.0.1 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 and higher on older nginx versions these protocols will work but could not |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 be disabled. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
257 </note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
258 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
259 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 <directive name="ssl_session_cache"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
264 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
265 <literal>off</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
266 <literal>none</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
267 [<literal>builtin</literal>[:<value>size</value>]] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
268 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
269 <default>none</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
270 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
271 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
272 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
273 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
274 Sets types and sizes of caches that store session parameters. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
275 A cache can be any of the following types: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
277 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
278 <tag-name><literal>off</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
279 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
280 the use of session cache is strictly prohibited: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
281 nginx explicitly tells a client that sessions may not be reused. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 <tag-name><literal>none</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
285 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
286 the use of session cache is gently disallowed: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
287 nginx tells a client that sessions may be reused, but does not |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
288 actually do that. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
289 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
290 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
291 <tag-name><literal>builtin</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
292 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
293 a cache built in OpenSSL; used by one worker process only. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
294 The cache size is specified in sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
295 If size is not given, it is equal to 20480 sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
296 Use of the built-in cache can cause memory fragmentation. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
299 <tag-name><literal>shared</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
300 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
301 shared between all worker processes. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
302 The cache size is specified in bytes; one megabyte can store |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
303 about 4000 sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
304 Each shared cache should have an arbitrary name. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
305 A cache with the same name can be used in several virtual servers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
306 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
307 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
308 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
309 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
310 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
311 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
312 Both cache types can be used simultaneously, for example: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
313 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
314 ssl_session_cache builtin:1000 shared:SSL:10m; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
315 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
316 but using only shared cache without the built-in cache should |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
317 be more efficient. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
318 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
319 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
320 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
321 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
322 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
323 <directive name="ssl_session_timeout"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
324 <syntax><value>time</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
325 <default>5m</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
326 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
327 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
328 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
329 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
330 Specifies a time during which a client may reuse the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
331 session parameters stored in a cache. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
332 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
333 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
334 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
335 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
336 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
337 <directive name="ssl_verify_client"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
338 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
339 <literal>on</literal> | <literal>off</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
340 <literal>optional</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
342 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
343 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
344 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
345 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
346 Enables the client certificate verification. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
347 The <literal>optional</literal> parameter (0.8.7+) requests the client |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
348 certificate and verifies it if it was present. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
349 The result of verification is stored in the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
350 <var>$ssl_client_verify</var> variable. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
351 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
352 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
353 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
354 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
355 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
356 <directive name="ssl_verify_depth"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
357 <syntax><value>number</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
358 <default>1</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
359 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
360 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
361 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
362 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
363 Sets a verification depth in the client certificates chain. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
364 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
365 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
366 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
367 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
368 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
369 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
370 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
371 <section id="errors" name="Error Processing"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
372 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
373 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
374 The <literal>ngx_http_ssl_module</literal> module supports several |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
375 non-standard error codes that can be used for redirects using the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
376 <link doc="ngx_http_core_module.xml" id="error_page"/> directive: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
377 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
378 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
379 <tag-name>495</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
380 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
381 an error has occurred during the client certificate verification; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
382 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
383 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
384 <tag-name>496</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
385 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
386 a client did not present the required certificate; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
387 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
388 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
389 <tag-name>497</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
390 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
391 a regular request was sent to the HTTPS port. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
392 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
393 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
394 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
395 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
396 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
397 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
398 A redirection happens after the request was fully parsed and |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
399 variables such as <var>$request_uri</var>, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
400 <var>$uri</var>, <var>$args</var> and others were made available. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
401 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
402 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
403 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
404 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
405 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
406 <section id="variables" name="Embedded Variables"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
407 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
408 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
409 The <literal>ngx_http_ssl_module</literal> module supports |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
410 several embedded variables: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
411 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
412 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
413 <tag-name><var>$ssl_cipher</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
414 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
415 returns the string of ciphers used |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
416 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
417 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
418 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
419 <tag-name><var>$ssl_client_cert</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
420 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
421 returns the client certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
422 for an established SSL connection, with each line except the first |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
423 prepended with the tab character; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
424 this is intended for the use in the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
425 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
426 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
427 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
428 <tag-name><var>$ssl_client_raw_cert</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
429 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
430 returns the client certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
431 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
432 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
433 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
434 <tag-name><var>$ssl_client_serial</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
435 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
436 returns the serial number of the client certificate |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
437 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
438 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
439 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
440 <tag-name><var>$ssl_client_s_dn</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
441 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
442 returns the “subject DN” string of the client certificate |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
443 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
444 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
445 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
446 <tag-name><var>$ssl_client_i_dn</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
447 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
448 returns the “issuer DN” string of the client certificate |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
449 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
450 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
451 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
452 <tag-name><var>$ssl_client_verify</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
453 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
454 returns the result of client certificate verification: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
455 “<literal>SUCCESS</literal>”, “<literal>FAILED</literal>”, and |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
456 “<literal>NONE</literal>” if a certificate was not present; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
457 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
458 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
459 <tag-name><var>$ssl_protocol</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
460 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
461 returns the protocol of an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
462 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
463 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
464 <tag-name><var>$ssl_session_id</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
465 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
466 returns the session identifier of an established SSL connection. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
467 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
468 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
469 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
470 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
471 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
472 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
473 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
474 </module> |