Mercurial > hg > nginx-site
annotate xml/ru/docs/http/ngx_http_ssl_module.xml @ 2983:67dd348c9757
Documented new global nginx properties in njs Reference.
The following properties were added: ngx.build, ngx.conf_file_path,
ngx.error_log_path, ngx.prefix, ngx.version, ngx.version_number.
author | Yaroslav Zhuravlev <yar@nginx.com> |
---|---|
date | Thu, 01 Jun 2023 17:12:18 +0100 |
parents | 2b02fee0d12e |
children | 0e805229dd19 |
rev | line source |
---|---|
222
bfe3eff81d04
Removed redundant encoding specification.
Ruslan Ermilov <ru@nginx.com>
parents:
110
diff
changeset
|
1 <?xml version="1.0"?> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
2 |
580
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
3 <!-- |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
4 Copyright (C) Igor Sysoev |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
5 Copyright (C) Nginx, Inc. |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
6 --> |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
7 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
9 |
379 | 10 <module name="Модуль ngx_http_ssl_module" |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
11 link="/ru/docs/http/ngx_http_ssl_module.html" |
589 | 12 lang="ru" |
2978
2b02fee0d12e
Documented removal of the ssl directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2948
diff
changeset
|
13 rev="61"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
14 |
110
40eec261c2a6
Added proper support for anonymous sections, notably for the summary.
Ruslan Ermilov <ru@nginx.com>
parents:
106
diff
changeset
|
15 <section id="summary"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
16 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
17 <para> |
379 | 18 Модуль <literal>ngx_http_ssl_module</literal> обеспечивает работу |
19 по протоколу HTTPS. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
20 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
21 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
22 <para> |
379 | 23 По умолчанию этот модуль не собирается, его сборку необходимо |
24 разрешить с помощью конфигурационного параметра | |
271 | 25 <literal>--with-http_ssl_module</literal>. |
379 | 26 <note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
27 Для сборки и работы этого модуля нужна библиотека |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
28 <link url="http://www.openssl.org">OpenSSL</link>. |
379 | 29 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
30 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
31 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
32 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
33 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
34 |
379 | 35 <section id="example" name="Пример конфигурации"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
36 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
37 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
38 Для уменьшения загрузки процессора рекомендуется |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
39 <list type="bullet"> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
40 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
41 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
42 установить число |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
43 <link doc="../ngx_core_module.xml" id="worker_processes">рабочих процессов</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
44 равным числу процессоров, |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
45 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
46 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
47 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
48 разрешить |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
49 <link doc="ngx_http_core_module.xml" id="keepalive_timeout">keep-alive</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
50 соединения, |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
51 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
52 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
53 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
54 включить <link id="ssl_session_cache_shared">разделяемый</link> кэш сессий, |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
55 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
56 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
57 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
58 выключить <link id="ssl_session_cache_builtin">встроенный</link> кэш сессий |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
59 </listitem> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
60 |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
61 <listitem> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
62 и, возможно, увеличить <link id="ssl_session_timeout">время жизни</link> сессии |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
63 (по умолчанию 5 минут): |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
64 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
65 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
66 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
67 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
68 <example> |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
69 <emphasis>worker_processes auto;</emphasis> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
70 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
71 http { |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
72 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
73 ... |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
74 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
75 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
76 listen 443 ssl; |
379 | 77 <emphasis>keepalive_timeout 70;</emphasis> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
78 |
2948
37e082fd009c
Added TLSv1.3 to the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2897
diff
changeset
|
79 ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; |
379 | 80 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
81 ssl_certificate /usr/local/nginx/conf/cert.pem; | |
82 ssl_certificate_key /usr/local/nginx/conf/cert.key; | |
83 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> | |
84 <emphasis>ssl_session_timeout 10m;</emphasis> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
85 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
86 ... |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
87 } |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
88 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
89 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
90 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
91 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
92 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
93 |
379 | 94 <section id="directives" name="Директивы"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
95 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
96 <directive name="ssl"> |
271 | 97 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
98 <default>off</default> |
379 | 99 <context>http</context> |
100 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
101 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
102 <para> |
2978
2b02fee0d12e
Documented removal of the ssl directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2948
diff
changeset
|
103 Эта директива устарела в версии 1.15.0 |
2b02fee0d12e
Documented removal of the ssl directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2948
diff
changeset
|
104 и была удалена в версии 1.25.1. |
2168
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
105 Вместо неё следует |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
106 использовать параметр <literal>ssl</literal> |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
107 директивы <link doc="ngx_http_core_module.xml" id="listen"/>. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
108 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
109 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
110 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
111 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
112 |
1039
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
113 <directive name="ssl_buffer_size"> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
114 <syntax><value>size</value></syntax> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
115 <default>16k</default> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
116 <context>http</context> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
117 <context>server</context> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
118 <appeared-in>1.5.9</appeared-in> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
119 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
120 <para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
121 Задаёт размер буфера, используемого при отправке данных. |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
122 </para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
123 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
124 <para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
125 По умолчанию размер буфера равен 16k, что соответствует минимальным |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
126 накладным расходам при передаче больших ответов. |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
127 С целью минимизации времени получения начала ответа (Time To First Byte) |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
128 может быть полезно использовать меньшие значения, |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
129 например: |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
130 <example> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
131 ssl_buffer_size 4k; |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
132 </example> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
133 </para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
134 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
135 </directive> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
136 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1020
diff
changeset
|
137 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
138 <directive name="ssl_certificate"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
139 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
140 <default/> |
379 | 141 <context>http</context> |
142 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
143 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
144 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
145 Указывает <value>файл</value> с сертификатом в формате PEM |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
146 для данного виртуального сервера. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
147 Если вместе с основным сертификатом нужно указать промежуточные, |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
148 то они должны находиться в этом же файле в следующем порядке: сначала |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
149 основной сертификат, а затем промежуточные. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
150 В этом же файле может находиться секретный ключ в формате PEM. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
151 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
152 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
153 <para> |
1726
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
154 Начиная с версии 1.11.0 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
155 эта директива может быть указана несколько раз |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
156 для загрузки сертификатов разных типов, например RSA и ECDSA: |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
157 <example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
158 server { |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
159 listen 443 ssl; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
160 server_name example.com; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
161 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
162 ssl_certificate example.com.rsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
163 ssl_certificate_key example.com.rsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
164 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
165 ssl_certificate example.com.ecdsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
166 ssl_certificate_key example.com.ecdsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
167 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
168 ... |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
169 } |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
170 </example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
171 <note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
172 Возможность задавать отдельные |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
173 <link doc="configuring_https_servers.xml" id="chains">цепочки |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
174 сертификатов</link> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
175 для разных сертификатов есть только в OpenSSL 1.0.2 и выше. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
176 Для более старых версий следует указывать только одну цепочку сертификатов. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
177 </note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
178 </para> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
179 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
180 <para> |
2334
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
181 Начиная с версии 1.15.9 в имени файла можно использовать переменные |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
182 при использовании OpenSSL 1.0.2 и выше: |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
183 <example> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
184 ssl_certificate $ssl_server_name.crt; |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
185 ssl_certificate_key $ssl_server_name.key; |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
186 </example> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
187 Однако нужно учитывать, что при использовании переменных |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
188 сертификат загружается при каждой операции SSL handshake, |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
189 что может отрицательно влиять на производительность. |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
190 </para> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
191 |
2350
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
192 <para id="ssl_certificate_data"> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
193 Вместо <value>файла</value> можно указать значение |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
194 <literal>data</literal>:<value>$переменная</value> (1.15.10), |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
195 при котором сертификат загружается из переменной |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
196 без использования промежуточных файлов. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
197 При этом следует учитывать, что ненадлежащее использование |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
198 подобного синтаксиса может быть небезопасно, |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
199 например данные секретного ключа могут попасть в |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
200 <link doc="../ngx_core_module.xml" id="error_log">лог ошибок</link>. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
201 </para> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
202 |
2334
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
203 <para> |
280 | 204 Нужно иметь в виду, что из-за ограничения протокола HTTPS |
2040
093855e77388
Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2027
diff
changeset
|
205 для максимальной совместимости виртуальные серверы должны слушать на |
093855e77388
Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2027
diff
changeset
|
206 <link doc="configuring_https_servers.xml" id="name_based_https_servers">разных |
093855e77388
Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2027
diff
changeset
|
207 IP-адресах</link>. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
208 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
209 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
210 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
211 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
212 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
213 <directive name="ssl_certificate_key"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
214 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
215 <default/> |
379 | 216 <context>http</context> |
217 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
218 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
219 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
220 Указывает <value>файл</value> с секретным ключом в формате PEM |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
221 для данного виртуального сервера. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
222 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
223 |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
224 <para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
225 Вместо <value>файла</value> можно указать значение |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
226 <literal>engine</literal>:<value>имя</value>:<value>id</value> (1.7.9), |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
227 которое загружает ключ с указанным <value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
228 из OpenSSL engine с заданным <value>именем</value>. |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
229 </para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
230 |
2350
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
231 <para id="ssl_certificate_key_data"> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
232 Вместо <value>файла</value> можно указать значение |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
233 <literal>data</literal>:<value>$переменная</value> (1.15.10), |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
234 при котором секретный ключ загружается из переменной |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
235 без использования промежуточных файлов. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
236 При этом следует учитывать, что ненадлежащее использование |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
237 подобного синтаксиса может быть небезопасно, |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
238 например данные секретного ключа могут попасть в |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
239 <link doc="../ngx_core_module.xml" id="error_log">лог ошибок</link>. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
240 </para> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
241 |
2334
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
242 <para> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
243 Начиная с версии 1.15.9 в имени файла можно использовать переменные |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
244 при использовании OpenSSL 1.0.2 и выше. |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
245 </para> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
246 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
247 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
248 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
249 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
250 <directive name="ssl_ciphers"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
251 <syntax><value>шифры</value></syntax> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
252 <default>HIGH:!aNULL:!MD5</default> |
379 | 253 <context>http</context> |
254 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
255 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
256 <para> |
379 | 257 Описывает разрешённые шифры. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
258 Шифры задаются в формате, поддерживаемом библиотекой |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
259 OpenSSL, например: |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
260 <example> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
261 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
262 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
263 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
264 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
265 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
266 Полный список можно посмотреть с помощью команды |
271 | 267 “<command>openssl ciphers</command>”. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
268 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
269 |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
270 <para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
271 <note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
272 В предыдущих версиях nginx по умолчанию использовались |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
273 <link doc="configuring_https_servers.xml" id="compatibility">другие</link> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
274 шифры. |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
275 </note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
276 </para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
277 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
278 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
279 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
280 |
379 | 281 <directive name="ssl_client_certificate"> |
282 <syntax><value>файл</value></syntax> | |
283 <default/> | |
284 <context>http</context> | |
285 <context>server</context> | |
286 | |
287 <para> | |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
288 Указывает <value>файл</value> с доверенными сертификатами CA в формате |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
289 PEM, которые используются для |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
290 <link id="ssl_verify_client">проверки</link> клиентских сертификатов и |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
291 ответов OCSP, если включён <link id="ssl_stapling"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
292 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
293 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
294 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
295 Список сертификатов будет отправляться клиентам. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
296 Если это нежелательно, можно воспользоваться директивой |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
297 <link id="ssl_trusted_certificate"/>. |
379 | 298 </para> |
299 | |
300 </directive> | |
301 | |
302 | |
2616
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
303 <directive name="ssl_conf_command"> |
2865
0d355d154181
Corrected syntax of ssl_conf_command and friends.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2837
diff
changeset
|
304 <syntax><value>имя</value> <value>значение</value></syntax> |
2616
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
305 <default/> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
306 <context>http</context> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
307 <context>server</context> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
308 <appeared-in>1.19.4</appeared-in> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
309 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
310 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
311 Задаёт произвольные конфигурационные |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
312 <link url="https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html">команды</link> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
313 OpenSSL. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
314 <note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
315 Директива поддерживается при использовании OpenSSL 1.0.2 и выше. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
316 </note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
317 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
318 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
319 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
320 На одном уровне может быть указано |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
321 несколько директив <literal>ssl_conf_command</literal>: |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
322 <example> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
323 ssl_conf_command Options PrioritizeChaCha; |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
324 ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
325 </example> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
326 Директивы наследуются с предыдущего уровня конфигурации при условии, что |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
327 на данном уровне не описаны свои директивы <literal>ssl_conf_command</literal>. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
328 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
329 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
330 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
331 <note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
332 Следует учитывать, что изменение настроек OpenSSL напрямую |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
333 может привести к неожиданному поведению. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
334 </note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
335 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
336 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
337 </directive> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
338 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
339 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
340 <directive name="ssl_crl"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
341 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
342 <default/> |
379 | 343 <context>http</context> |
344 <context>server</context> | |
345 <appeared-in>0.8.7</appeared-in> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
346 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
347 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
348 Указывает <value>файл</value> с отозванными сертификатами (CRL) |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
349 в формате PEM, используемыми для |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
350 <link id="ssl_verify_client">проверки</link> клиентских сертификатов. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
351 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
352 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
353 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
354 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
355 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
356 <directive name="ssl_dhparam"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
357 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
358 <default/> |
379 | 359 <context>http</context> |
360 <context>server</context> | |
361 <appeared-in>0.7.2</appeared-in> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
362 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
363 <para> |
1706
6f5497797cde
Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents:
1522
diff
changeset
|
364 Указывает <value>файл</value> с параметрами для DHE-шифров. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
365 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
366 |
2296
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
367 <para> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
368 По умолчанию параметры не заданы, |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
369 и соответственно DHE-шифры не будут использоваться. |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
370 <note> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
371 До версии 1.11.0 по умолчанию использовались встроенные параметры. |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
372 </note> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
373 </para> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
374 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
375 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
376 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
377 |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
378 <directive name="ssl_early_data"> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
379 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
380 <default>off</default> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
381 <context>http</context> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
382 <context>server</context> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
383 <appeared-in>1.15.3</appeared-in> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
384 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
385 <para> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
386 Разрешает или запрещает TLS 1.3 |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
387 <link url="https://datatracker.ietf.org/doc/html/rfc8446#section-2.3">early data</link>. |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
388 <note> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
389 Запросы, отправленные внутри early data, могут быть подвержены |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
390 <link url="https://datatracker.ietf.org/doc/html/rfc8470">атакам повторного воспроизведения</link> (replay). |
2234
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
391 Для защиты от подобных атак на уровне приложения |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
392 необходимо использовать |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
393 переменную <link id="var_ssl_early_data">$ssl_early_data</link>. |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
394 </note> |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
395 |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
396 <example> |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
397 proxy_set_header Early-Data $ssl_early_data; |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
398 </example> |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
399 |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
400 <note> |
2241
b7ac730b96f3
Documented TLS 1.3 early data support with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2238
diff
changeset
|
401 Директива поддерживается при использовании OpenSSL 1.1.1 и выше (1.15.4) или |
2234
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
402 <link url="https://boringssl.googlesource.com/boringssl/">BoringSSL</link>. |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
403 </note> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
404 </para> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
405 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
406 </directive> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
407 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
408 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
409 <directive name="ssl_ecdh_curve"> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
410 <syntax><value>кривая</value></syntax> |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
411 <default>auto</default> |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
412 <context>http</context> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
413 <context>server</context> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
414 <appeared-in>1.1.0</appeared-in> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
415 <appeared-in>1.0.6</appeared-in> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
416 |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
417 <para> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
418 Задаёт кривую для ECDHE-шифров. |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
419 </para> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
420 |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
421 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
422 При использовании OpenSSL 1.0.2 и выше |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
423 можно указывать несколько кривых (1.11.0), например: |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
424 <example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
425 ssl_ecdh_curve prime256v1:secp384r1; |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
426 </example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
427 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
428 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
429 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
430 Специальное значение <literal>auto</literal> (1.11.0) соответствует |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
431 встроенному в библиотеку OpenSSL списку кривых для OpenSSL 1.0.2 и выше, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
432 или <literal>prime256v1</literal> для более старых версий. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
433 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
434 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
435 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
436 <note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
437 До версии 1.11.0 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
438 по умолчанию использовалась кривая <literal>prime256v1</literal>. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
439 </note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
440 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
441 |
2648
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
442 <para> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
443 <note> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
444 При использовании OpenSSL 1.0.2 и выше |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
445 директива задаёт список кривых, поддерживаемых сервером. |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
446 Поэтому для работы ECDSA-сертификатов |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
447 важно, чтобы список включал кривые, используемые в сертификатах. |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
448 </note> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
449 </para> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
450 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
451 </directive> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
452 |
2648
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
453 |
2548
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
454 <directive name="ssl_ocsp"> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
455 <syntax><literal>on</literal> | |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
456 <literal>off</literal> | |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
457 <literal>leaf</literal></syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
458 <default>off</default> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
459 <context>http</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
460 <context>server</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
461 <appeared-in>1.19.0</appeared-in> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
462 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
463 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
464 Включает проверку OCSP для цепочки клиентских сертификатов. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
465 Параметр <literal>leaf</literal> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
466 включает проверку только клиентского сертификата. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
467 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
468 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
469 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
470 Для работы проверки OCSP |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
471 необходимо дополнительно установить значение директивы |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
472 <link id="ssl_verify_client"/> в |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
473 <literal>on</literal> или <literal>optional</literal>. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
474 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
475 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
476 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
477 Для преобразования имени хоста OCSP responder’а в адрес необходимо |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
478 дополнительно задать директиву |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
479 <link doc="ngx_http_core_module.xml" id="resolver"/>. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
480 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
481 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
482 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
483 Пример: |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
484 <example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
485 ssl_verify_client on; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
486 ssl_ocsp on; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
487 resolver 192.0.2.1; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
488 </example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
489 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
490 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
491 </directive> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
492 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
493 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
494 <directive name="ssl_ocsp_cache"> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
495 <syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
496 <literal>off</literal> | |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
497 [<literal>shared</literal>:<value>имя</value>:<value>размер</value>]</syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
498 <default>off</default> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
499 <context>http</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
500 <context>server</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
501 <appeared-in>1.19.0</appeared-in> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
502 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
503 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
504 Задаёт <literal>имя</literal> и <literal>размер</literal> кэша, |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
505 который хранит статус клиентских сертификатов для проверки OCSP-ответов. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
506 Кэш разделяется между всеми рабочими процессами. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
507 Кэш с одинаковым названием может использоваться в нескольких |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
508 виртуальных серверах. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
509 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
510 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
511 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
512 Параметр <literal>off</literal> запрещает использование кэша. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
513 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
514 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
515 </directive> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
516 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
517 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
518 <directive name="ssl_ocsp_responder"> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
519 <syntax><value>url</value></syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
520 <default/> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
521 <context>http</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
522 <context>server</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
523 <appeared-in>1.19.0</appeared-in> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
524 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
525 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
526 Переопределяет URL OCSP responder’а, указанный в расширении сертификата |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
527 “<link url="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1">Authority |
2548
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
528 Information Access</link>” |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
529 для <link id="ssl_ocsp">проверки</link> клиентских сертификатов. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
530 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
531 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
532 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
533 Поддерживаются только “<literal>http://</literal>” OCSP responder’ы: |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
534 <example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
535 ssl_ocsp_responder http://ocsp.example.com/; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
536 </example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
537 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
538 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
539 </directive> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
540 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
541 |
1239
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
542 <directive name="ssl_password_file"> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
543 <syntax><value>файл</value></syntax> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
544 <default/> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
545 <context>http</context> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
546 <context>server</context> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
547 <appeared-in>1.7.3</appeared-in> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
548 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
549 <para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
550 Задаёт <value>файл</value> с паролями от |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
551 <link id="ssl_certificate_key">секретных ключей</link>, |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
552 где каждый пароль указан на отдельной строке. |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
553 Пароли применяются по очереди в момент загрузки ключа. |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
554 </para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
555 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
556 <para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
557 Пример: |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
558 <example> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
559 http { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
560 ssl_password_file /etc/keys/global.pass; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
561 ... |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
562 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
563 server { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
564 server_name www1.example.com; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
565 ssl_certificate_key /etc/keys/first.key; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
566 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
567 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
568 server { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
569 server_name www2.example.com; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
570 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
571 # вместо файла можно указать именованный канал |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
572 ssl_password_file /etc/keys/fifo; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
573 ssl_certificate_key /etc/keys/second.key; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
574 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
575 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
576 </example> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
577 </para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
578 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
579 </directive> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
580 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
581 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
582 <directive name="ssl_prefer_server_ciphers"> |
271 | 583 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
584 <default>off</default> |
379 | 585 <context>http</context> |
586 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
587 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
588 <para> |
379 | 589 Указывает, чтобы при использовании протоколов SSLv3 и TLS |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
590 серверные шифры были более приоритетны, чем клиентские. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
591 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
592 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
593 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
594 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
595 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
596 <directive name="ssl_protocols"> |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
597 <syntax> |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
598 [<literal>SSLv2</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
599 [<literal>SSLv3</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
600 [<literal>TLSv1</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
601 [<literal>TLSv1.1</literal>] |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
602 [<literal>TLSv1.2</literal>] |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
603 [<literal>TLSv1.3</literal>]</syntax> |
2948
37e082fd009c
Added TLSv1.3 to the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2897
diff
changeset
|
604 <default>TLSv1 TLSv1.1 TLSv1.2 TLSv1.3</default> |
379 | 605 <context>http</context> |
606 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
607 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
608 <para> |
379 | 609 Разрешает указанные протоколы. |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
610 <note> |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
611 Параметры <literal>TLSv1.1</literal> и <literal>TLSv1.2</literal> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
612 (1.1.13, 1.0.12) работают только при использовании OpenSSL 1.0.1 и выше. |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
613 </note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
614 <note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
615 Параметр <literal>TLSv1.3</literal> (1.13.0) работает только |
2769
16f6fa718be2
Updated TLSv1.3 support notes.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2735
diff
changeset
|
616 при использовании OpenSSL 1.1.1 и выше. |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
617 </note> |
2948
37e082fd009c
Added TLSv1.3 to the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2897
diff
changeset
|
618 <note> |
37e082fd009c
Added TLSv1.3 to the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2897
diff
changeset
|
619 Параметр <literal>TLSv1.3</literal> используется по умолчанию |
37e082fd009c
Added TLSv1.3 to the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2897
diff
changeset
|
620 начиная с 1.23.4. |
37e082fd009c
Added TLSv1.3 to the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2897
diff
changeset
|
621 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
622 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
623 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
624 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
625 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
626 |
2618
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
627 <directive name="ssl_reject_handshake"> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
628 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
629 <default>off</default> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
630 <context>http</context> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
631 <context>server</context> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
632 <appeared-in>1.19.4</appeared-in> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
633 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
634 <para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
635 Если разрешено, то операции SSL handshake в |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
636 блоке <link doc="ngx_http_core_module.xml" id="server"/> будут отклонены. |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
637 </para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
638 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
639 <para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
640 Например в этой конфигурации отклоняются все операции SSL handshake с |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
641 именем сервера, отличным от <literal>example.com</literal>: |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
642 <example> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
643 server { |
2718
fb41de2d765a
Added default_server to ssl_reject_handshake example.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2648
diff
changeset
|
644 listen 443 ssl default_server; |
2618
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
645 ssl_reject_handshake on; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
646 } |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
647 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
648 server { |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
649 listen 443 ssl; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
650 server_name example.com; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
651 ssl_certificate example.com.crt; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
652 ssl_certificate_key example.com.key; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
653 } |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
654 </example> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
655 </para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
656 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
657 </directive> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
658 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
659 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
660 <directive name="ssl_session_cache"> |
271 | 661 <syntax> |
379 | 662 <literal>off</literal> | |
663 <literal>none</literal> | | |
664 [<literal>builtin</literal>[:<value>размер</value>]] | |
665 [<literal>shared</literal>:<value>название</value>:<value>размер</value>]</syntax> | |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
666 <default>none</default> |
379 | 667 <context>http</context> |
668 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
669 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
670 <para> |
379 | 671 Задаёт тип и размеры кэшей для хранения параметров сессий. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
672 Тип кэша может быть следующим: |
379 | 673 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
674 |
379 | 675 <tag-name><literal>off</literal></tag-name> |
676 <tag-desc> | |
677 жёсткое запрещение использования кэша сессий: | |
1522
ee91c95fca48
Corrected Russian translation of the ssl_session_cache directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
678 nginx явно сообщает клиенту, что сессии не могут использоваться повторно. |
379 | 679 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
680 |
379 | 681 <tag-name><literal>none</literal></tag-name> |
682 <tag-desc> | |
683 мягкое запрещение использования кэша сессий: | |
1522
ee91c95fca48
Corrected Russian translation of the ssl_session_cache directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
684 nginx сообщает клиенту, что сессии могут использоваться повторно, но |
966 | 685 на самом деле не хранит параметры сессии в кэше. |
379 | 686 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
687 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
688 <tag-name id="ssl_session_cache_builtin"><literal>builtin</literal></tag-name> |
379 | 689 <tag-desc> |
690 встроенный в OpenSSL кэш, используется в рамках только одного рабочего процесса. | |
691 Размер кэша задаётся в сессиях. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
692 Если размер не задан, то он равен 20480 сессиям. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
693 Использование встроенного кэша может вести к фрагментации памяти. |
379 | 694 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
695 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
696 <tag-name id="ssl_session_cache_shared"><literal>shared</literal></tag-name> |
379 | 697 <tag-desc> |
966 | 698 кэш, разделяемый между всеми рабочими процессами. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
699 Размер кэша задаётся в байтах, в 1 мегабайт может поместиться |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
700 около 4000 сессий. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
701 У каждого разделяемого кэша должно быть произвольное название. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
702 Кэш с одинаковым названием может использоваться в нескольких |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
703 виртуальных серверах. |
2897
3f5e91af4a52
Documented automatic rotation of TLS session ticket keys.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2865
diff
changeset
|
704 Также он используется для автоматического создания, хранения и |
3f5e91af4a52
Documented automatic rotation of TLS session ticket keys.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2865
diff
changeset
|
705 периодического обновления ключей TLS session tickets (1.23.2), |
3f5e91af4a52
Documented automatic rotation of TLS session ticket keys.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2865
diff
changeset
|
706 если они не указаны явно |
3f5e91af4a52
Documented automatic rotation of TLS session ticket keys.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2865
diff
changeset
|
707 с помощью директивы <link id="ssl_session_ticket_key"/>. |
379 | 708 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
709 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
710 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
711 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
712 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
713 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
714 Можно использовать одновременно оба типа кэша, например: |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
715 <example> |
379 | 716 ssl_session_cache builtin:1000 shared:SSL:10m; |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
717 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
718 однако использование только разделяемого кэша без встроенного должно |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
719 быть более эффективным. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
720 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
721 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
722 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
723 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
724 |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
725 <directive name="ssl_session_ticket_key"> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
726 <syntax><value>файл</value></syntax> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
727 <default/> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
728 <context>http</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
729 <context>server</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
730 <appeared-in>1.5.7</appeared-in> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
731 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
732 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
733 Задаёт <value>файл</value> с секретным ключом, применяемым при шифровании и |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
734 расшифровании TLS session tickets. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
735 Директива необходима, если один и тот же ключ нужно использовать |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
736 на нескольких серверах. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
737 По умолчанию используется случайно сгенерированный ключ. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
738 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
739 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
740 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
741 Если указано несколько ключей, то только первый ключ |
1020 | 742 используется для шифрования TLS session tickets. |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
743 Это позволяет настроить ротацию ключей, например: |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
744 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
745 ssl_session_ticket_key current.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
746 ssl_session_ticket_key previous.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
747 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
748 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
749 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
750 <para> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
751 <value>Файл</value> должен содержать 80 или 48 байт случайных данных |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
752 и может быть создан следующей командой: |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
753 <example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
754 openssl rand 80 > ticket.key |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
755 </example> |
2735
ff357b676c2e
Removed trailing spaces.
Maxim Dounin <mdounin@mdounin.ru>
parents:
2718
diff
changeset
|
756 В зависимости от размера файла для шифрования будет использоваться либо |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
757 AES256 (для 80-байтных ключей, 1.11.8), либо AES128 (для 48-байтных ключей). |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
758 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
759 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
760 </directive> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
761 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
762 |
1055
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
763 <directive name="ssl_session_tickets"> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
764 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
765 <default>on</default> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
766 <context>http</context> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
767 <context>server</context> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
768 <appeared-in>1.5.9</appeared-in> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
769 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
770 <para> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
771 Разрешает или запрещает возобновление сессий при помощи |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
772 <link url="https://datatracker.ietf.org/doc/html/rfc5077">TLS session tickets</link>. |
1055
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
773 </para> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
774 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
775 </directive> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
776 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
777 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
778 <directive name="ssl_session_timeout"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
779 <syntax><value>время</value></syntax> |
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
780 <default>5m</default> |
379 | 781 <context>http</context> |
782 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
783 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
784 <para> |
379 | 785 Задаёт время, в течение которого клиент может повторно |
1785
3fa0944ddc6a
Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
786 использовать параметры сессии. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
787 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
788 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
789 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
790 |
379 | 791 |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
792 <directive name="ssl_stapling"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
793 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
794 <default>off</default> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
795 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
796 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
797 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
798 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
799 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
800 Разрешает или запрещает |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
801 <link url="https://datatracker.ietf.org/doc/html/rfc6066#section-8">прикрепление |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
802 OCSP-ответов</link> сервером. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
803 Пример: |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
804 <example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
805 ssl_stapling on; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
806 resolver 192.0.2.1; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
807 </example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
808 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
809 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
810 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
811 Для работы OCSP stapling’а должен быть известен сертификат издателя |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
812 сертификата сервера. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
813 Если в заданном директивой <link id="ssl_certificate"/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
814 файле не содержится промежуточных сертификатов, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
815 то сертификат издателя сертификата сервера следует поместить в файл, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
816 заданный директивой <link id="ssl_trusted_certificate"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
817 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
818 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
819 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
820 Для преобразования имени хоста OCSP responder’а в адрес необходимо |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
821 дополнительно задать директиву |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
822 <link doc="ngx_http_core_module.xml" id="resolver"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
823 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
824 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
825 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
826 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
827 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
828 <directive name="ssl_stapling_file"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
829 <syntax><value>файл</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
830 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
831 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
832 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
833 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
834 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
835 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
836 Если задано, то вместо опроса OCSP responder’а, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
837 указанного в сертификате сервера, |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
838 ответ берётся из указанного <value>файла</value>. |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
839 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
840 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
841 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
842 Ответ должен быть в формате DER и может быть сгенерирован командой |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
843 “<literal>openssl ocsp</literal>”. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
844 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
845 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
846 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
847 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
848 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
849 <directive name="ssl_stapling_responder"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
850 <syntax><value>url</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
851 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
852 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
853 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
854 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
855 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
856 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
857 Переопределяет URL OCSP responder’а, указанный в расширении сертификата |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
858 “<link url="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1">Authority |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
859 Information Access</link>”. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
860 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
861 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
862 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
863 Поддерживаются только “<literal>http://</literal>” OCSP responder’ы: |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
864 <example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
865 ssl_stapling_responder http://ocsp.example.com/; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
866 </example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
867 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
868 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
869 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
870 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
871 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
872 <directive name="ssl_stapling_verify"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
873 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
874 <default>off</default> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
875 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
876 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
877 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
878 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
879 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
880 Разрешает или запрещает проверку сервером ответов OCSP. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
881 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
882 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
883 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
884 Для работоспособности проверки сертификат издателя сертификата сервера, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
885 корневой сертификат и все промежуточные сертификаты должны быть указаны |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
886 как доверенные с помощью директивы |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
887 <link id="ssl_trusted_certificate"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
888 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
889 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
890 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
891 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
892 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
893 <directive name="ssl_trusted_certificate"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
894 <syntax><value>файл</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
895 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
896 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
897 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
898 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
899 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
900 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
901 Задаёт <value>файл</value> с доверенными сертификатами CA в формате PEM, |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
902 которые используются для <link id="ssl_verify_client">проверки</link> |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
903 клиентских сертификатов и ответов OCSP, |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
904 если включён <link id="ssl_stapling"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
905 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
906 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
907 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
908 В отличие от <link id="ssl_client_certificate"/>, список этих сертификатов |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
909 не будет отправляться клиентам. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
910 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
911 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
912 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
913 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
914 |
379 | 915 <directive name="ssl_verify_client"> |
916 <syntax> | |
917 <literal>on</literal> | <literal>off</literal> | | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
918 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
379 | 919 <default>off</default> |
920 <context>http</context> | |
921 <context>server</context> | |
922 | |
923 <para> | |
924 Разрешает проверку клиентских сертификатов. | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
925 Результат проверки доступен через переменную |
1871
5f156621b8b5
Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1870
diff
changeset
|
926 <link id="var_ssl_client_verify">$ssl_client_verify</link>. |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
927 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
928 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
929 <para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
930 Параметр <literal>optional</literal> (0.8.7+) запрашивает клиентский |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
931 сертификат, и если сертификат был предоставлен, проверяет его. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
932 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
933 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
934 <para> |
763
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
935 Параметр <literal>optional_no_ca</literal> (1.3.8, 1.2.5) |
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
936 запрашивает сертификат |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
937 клиента, но не требует, чтобы он был подписан доверенным сертификатом CA. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
938 Это предназначено для случаев, когда фактическая проверка сертификата |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
939 осуществляется внешним по отношению к nginx’у сервисом. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
940 Содержимое сертификата доступно через переменную |
1871
5f156621b8b5
Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1870
diff
changeset
|
941 <link id="var_ssl_client_cert">$ssl_client_cert</link>. |
379 | 942 </para> |
943 | |
944 </directive> | |
945 | |
946 | |
947 <directive name="ssl_verify_depth"> | |
948 <syntax><value>число</value></syntax> | |
949 <default>1</default> | |
950 <context>http</context> | |
951 <context>server</context> | |
952 | |
953 <para> | |
954 Устанавливает глубину проверки в цепочке клиентских сертификатов. | |
955 </para> | |
956 | |
957 </directive> | |
958 | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
959 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
960 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
961 |
379 | 962 <section id="errors" name="Обработка ошибок"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
963 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
964 <para> |
379 | 965 Модуль <literal>ngx_http_ssl_module</literal> поддерживает несколько |
966 нестандартных кодов ошибок, которые можно использовать для | |
967 перенаправления с помощью директивы | |
106
56457a474903
If text of the link is not provided, the @id is used.
Ruslan Ermilov <ru@nginx.com>
parents:
102
diff
changeset
|
968 <link doc="ngx_http_core_module.xml" id="error_page"/>: |
379 | 969 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
970 |
379 | 971 <tag-name>495</tag-name> |
972 <tag-desc> | |
973 при проверке клиентского сертификата произошла ошибка; | |
974 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
975 |
379 | 976 <tag-name>496</tag-name> |
977 <tag-desc> | |
978 клиент не предоставил требуемый сертификат; | |
979 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
980 |
379 | 981 <tag-name>497</tag-name> |
982 <tag-desc> | |
983 обычный запрос был послан на порт HTTPS. | |
984 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
985 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
986 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
987 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
988 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
989 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
990 Перенаправление делается после того, как запрос полностью разобран |
379 | 991 и доступны такие переменные, как <var>$request_uri</var>, |
966 | 992 <var>$uri</var>, <var>$args</var> и другие переменные. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
993 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
994 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
995 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
996 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
997 |
379 | 998 <section id="variables" name="Встроенные переменные"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
999 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1000 <para> |
379 | 1001 Модуль <literal>ngx_http_ssl_module</literal> поддерживает |
2388
d323beea61ec
An outdated adjective removed.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2350
diff
changeset
|
1002 встроенные переменные: |
379 | 1003 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1004 |
2789
d16409187314
Documented the $ssl_alpn_protocol variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2769
diff
changeset
|
1005 <tag-name id="var_ssl_alpn_protocol"><var>$ssl_alpn_protocol</var></tag-name> |
d16409187314
Documented the $ssl_alpn_protocol variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2769
diff
changeset
|
1006 <tag-desc> |
d16409187314
Documented the $ssl_alpn_protocol variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2769
diff
changeset
|
1007 возвращает протокол, выбранный при помощи ALPN во время операции SSL handshake, |
d16409187314
Documented the $ssl_alpn_protocol variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2769
diff
changeset
|
1008 либо пустую строку (1.21.4); |
d16409187314
Documented the $ssl_alpn_protocol variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2769
diff
changeset
|
1009 </tag-desc> |
d16409187314
Documented the $ssl_alpn_protocol variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2769
diff
changeset
|
1010 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1011 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name> |
379 | 1012 <tag-desc> |
2460
c60a8a15010c
Clarified description of the $ssl_cipher variable.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2388
diff
changeset
|
1013 возвращает название используемого шифра для установленного SSL-соединения; |
379 | 1014 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1015 |
1857
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1016 <tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1017 <tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1018 возвращает список шифров, поддерживаемых клиентом (1.11.7). |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1019 Известные шифры указаны по имени, неизвестные указаны в шестнадцатеричном виде, |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1020 например: |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1021 <example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1022 AES128-SHA:AES256-SHA:0x00ff |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1023 </example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1024 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1025 Переменная полностью поддерживается при использовании OpenSSL версии 1.0.2 |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1026 и выше. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1027 При использовании более старых версий переменная доступна |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1028 только для новых сессий и может содержать только известные шифры. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1029 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1030 </tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1031 |
2027
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1032 <tag-name id="var_ssl_client_escaped_cert"><var>$ssl_client_escaped_cert</var></tag-name> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1033 <tag-desc> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1034 возвращает клиентский сертификат в формате PEM |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1035 (закодирован в формате urlencode) для установленного SSL-соединения (1.13.5); |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1036 </tag-desc> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1037 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1038 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name> |
379 | 1039 <tag-desc> |
1040 возвращает клиентский сертификат | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1041 для установленного SSL-соединения в формате PEM |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1042 перед каждой строкой которого, кроме первой, вставляется символ табуляции; |
383
a73fa21add8a
Removed a misleading sentence.
Ruslan Ermilov <ru@nginx.com>
parents:
379
diff
changeset
|
1043 предназначена для использования в директиве |
379 | 1044 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/>; |
2027
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1045 <note> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1046 Переменная устарела, вместо неё следует использовать |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1047 переменную <var>$ssl_client_escaped_cert</var>. |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1048 </note> |
379 | 1049 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1050 |
1201
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1051 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1052 <tag-desc> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1053 возвращает SHA1-отпечаток клиентского сертификата |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1054 для установленного SSL-соединения (1.7.1); |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1055 </tag-desc> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1056 |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1057 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1058 <tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1059 возвращает строку “issuer DN” клиентского сертификата |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1060 для установленного SSL-соединения согласно |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
1061 <link url="https://datatracker.ietf.org/doc/html/rfc2253">RFC 2253</link> (1.11.6); |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1062 </tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1063 |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1064 <tag-name id="var_ssl_client_i_dn_legacy"><var>$ssl_client_i_dn_legacy</var></tag-name> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1065 <tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1066 возвращает строку “issuer DN” клиентского сертификата |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1067 для установленного SSL-соединения; |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1068 <note> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1069 До версии 1.11.6 переменная называлась <var>$ssl_client_s_dn</var>. |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1070 </note> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1071 </tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1072 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1073 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var> |
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1074 </tag-name> |
379 | 1075 <tag-desc> |
1076 возвращает клиентский сертификат | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1077 для установленного SSL-соединения в формате PEM; |
379 | 1078 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1079 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1080 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name> |
379 | 1081 <tag-desc> |
1082 возвращает строку “subject DN” клиентского сертификата | |
1824
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1083 для установленного SSL-соединения согласно |
2831
4add6ae1296f
Updated links to datatracker.ietf.org.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2807
diff
changeset
|
1084 <link url="https://datatracker.ietf.org/doc/html/rfc2253">RFC 2253</link> (1.11.6); |
1824
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1085 </tag-desc> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1086 |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1087 <tag-name id="var_ssl_client_s_dn_legacy"><var>$ssl_client_s_dn_legacy</var></tag-name> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1088 <tag-desc> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1089 возвращает строку “subject DN” клиентского сертификата |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1090 для установленного SSL-соединения; |
1824
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1091 <note> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1092 До версии 1.11.6 переменная называлась <var>$ssl_client_s_dn</var>. |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1093 </note> |
379 | 1094 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1095 |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1096 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name> |
379 | 1097 <tag-desc> |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1098 возвращает серийный номер клиентского сертификата |
379 | 1099 для установленного SSL-соединения; |
1100 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1101 |
1855
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1102 <tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1103 <tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1104 возвращает дату окончания срока действия клиентского сертификата (1.11.7); |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1105 </tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1106 |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1107 <tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1108 <tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1109 возвращает число дней, |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1110 оставшихся до истечения срока действия клиентского сертификата (1.11.7); |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1111 </tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1112 |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1113 <tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1114 <tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1115 возвращает дату начала срока действия клиентского сертификата (1.11.7); |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1116 </tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1117 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1118 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name> |
379 | 1119 <tag-desc> |
1120 возвращает результат проверки клиентского сертификата: | |
1856
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1121 “<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>” |
1863
fef4ab2d990c
Removed unnecessary version for "FAILED:reason" in $ssl_client_verify.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
1122 и, если сертификат не был предоставлен, “<literal>NONE</literal>”; |
1856
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1123 <note> |
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1124 До версии 1.11.7 результат “<literal>FAILED</literal>” |
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1125 не содержал строку <value>reason</value>. |
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1126 </note> |
379 | 1127 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1128 |
2807
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1129 <tag-name id="var_ssl_curve"><var>$ssl_curve</var></tag-name> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1130 <tag-desc> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1131 возвращает согласованную кривую, использованную для |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1132 обмена ключами во время операции SSL handshake (1.21.5). |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1133 Известные кривые указаны по имени, неизвестные указаны в шестнадцатеричном виде, |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1134 например: |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1135 <example> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1136 prime256v1 |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1137 </example> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1138 <note> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1139 Переменная поддерживается при использовании OpenSSL версии 3.0 и выше. |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1140 При использовании более старых версий значением переменной будет пустая строка. |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1141 </note> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1142 </tag-desc> |
4b73197f8ca9
Documented the $ssl_curve variable for http and stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2789
diff
changeset
|
1143 |
1857
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1144 <tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1145 <tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1146 возвращает список кривых, поддерживаемых клиентом (1.11.7). |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1147 Известные кривые указаны по имени, неизвестные указаны в шестнадцатеричном виде, |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1148 например: |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1149 <example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1150 0x001d:prime256v1:secp521r1:secp384r1 |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1151 </example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1152 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1153 Переменная поддерживается при использовании OpenSSL версии 1.0.2 и выше. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1154 При использовании более старых версий значением переменной будет пустая строка. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1155 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1156 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1157 Переменная доступна только для новых сессий. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1158 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1159 </tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1160 |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1161 <tag-name id="var_ssl_early_data"><var>$ssl_early_data</var></tag-name> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1162 <tag-desc> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1163 возвращает “<literal>1</literal>”, если |
2234
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
1164 используется TLS 1.3 <link id="ssl_early_data">early data</link> |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1165 и операция handshake не завершена, иначе “” (1.15.3). |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1166 </tag-desc> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1167 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1168 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name> |
379 | 1169 <tag-desc> |
1170 возвращает протокол установленного SSL-соединения; | |
1171 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1172 |
1167
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1173 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1174 <tag-desc> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1175 возвращает имя сервера, запрошенное через |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1176 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1177 (1.7.0); |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1178 </tag-desc> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1179 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1180 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name> |
379 | 1181 <tag-desc> |
1072
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1182 возвращает идентификатор сессии установленного SSL-соединения; |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1183 </tag-desc> |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1184 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1072
diff
changeset
|
1185 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name> |
1072
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1186 <tag-desc> |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1187 возвращает “<literal>r</literal>”, если сессия была использована повторно, |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1188 иначе “<literal>.</literal>” (1.5.11). |
379 | 1189 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1190 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1191 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1192 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1193 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1194 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1195 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
1196 </module> |