Mercurial > hg > nginx-site
annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 2718:fb41de2d765a
Added default_server to ssl_reject_handshake example.
author | Yaroslav Zhuravlev <yar@nginx.com> |
---|---|
date | Tue, 04 May 2021 20:50:55 +0100 |
parents | 78161967514f |
children | 16f6fa718be2 |
rev | line source |
---|---|
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1 <?xml version="1.0"?> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
2 |
580
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
3 <!-- |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
4 Copyright (C) Igor Sysoev |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
5 Copyright (C) Nginx, Inc. |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
6 --> |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
7 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 <module name="Module ngx_http_ssl_module" |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
11 link="/en/docs/http/ngx_http_ssl_module.html" |
589 | 12 lang="en" |
2718
fb41de2d765a
Added default_server to ssl_reject_handshake example.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2648
diff
changeset
|
13 rev="53"> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 <section id="summary"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
17 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
18 The <literal>ngx_http_ssl_module</literal> module provides the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
19 necessary support for HTTPS. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
20 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
21 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
22 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
23 This module is not built by default, it should be enabled with the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
24 <literal>--with-http_ssl_module</literal> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
25 configuration parameter. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
26 <note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
27 This module requires the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
28 <link url="http://www.openssl.org">OpenSSL</link> library. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
29 </note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
30 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
31 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
32 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
33 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
34 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
35 <section id="example" name="Example Configuration"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
36 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
37 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
38 To reduce the processor load it is recommended to |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
39 <list type="bullet"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
40 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
41 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
42 set the number of |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
43 <link doc="../ngx_core_module.xml" id="worker_processes">worker processes</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
44 equal to the number of processors, |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
45 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
46 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
47 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
48 enable |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
49 <link doc="ngx_http_core_module.xml" id="keepalive_timeout">keep-alive</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
50 connections, |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
51 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
52 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
53 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
54 enable the <link id="ssl_session_cache_shared">shared</link> session cache, |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
55 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
56 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
57 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
58 disable the <link id="ssl_session_cache_builtin">built-in</link> session cache, |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
59 </listitem> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
60 |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
61 <listitem> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
62 and possibly increase the session <link id="ssl_session_timeout">lifetime</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
63 (by default, 5 minutes): |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
64 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
65 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
66 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
67 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
68 <example> |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
69 <emphasis>worker_processes auto;</emphasis> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
70 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
71 http { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
72 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
73 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
74 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
75 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
76 listen 443 ssl; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
77 <emphasis>keepalive_timeout 70;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
78 |
1411
8fe28c6edaa1
Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents:
1239
diff
changeset
|
79 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
80 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
81 ssl_certificate /usr/local/nginx/conf/cert.pem; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 ssl_certificate_key /usr/local/nginx/conf/cert.key; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 <emphasis>ssl_session_timeout 10m;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
89 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
90 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 <section id="directives" name="Directives"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
95 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 <directive name="ssl"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
97 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
98 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
99 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
100 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
101 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
102 <para> |
2168
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
103 This directive was made obsolete in version 1.15.0. |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
104 The <literal>ssl</literal> parameter |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
105 of the <link doc="ngx_http_core_module.xml" id="listen"/> directive |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2162
diff
changeset
|
106 should be used instead. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
107 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
108 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
109 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
110 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
111 |
1039
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
112 <directive name="ssl_buffer_size"> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
113 <syntax><value>size</value></syntax> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
114 <default>16k</default> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
115 <context>http</context> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
116 <context>server</context> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
117 <appeared-in>1.5.9</appeared-in> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
118 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
119 <para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
120 Sets the size of the buffer used for sending data. |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
121 </para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
122 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
123 <para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
124 By default, the buffer size is 16k, which corresponds to minimal |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
125 overhead when sending big responses. |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
126 To minimize Time To First Byte it may be beneficial to use smaller values, |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
127 for example: |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
128 <example> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
129 ssl_buffer_size 4k; |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
130 </example> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
131 </para> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
132 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
133 </directive> |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
134 |
f7ca80263893
Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1019
diff
changeset
|
135 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
136 <directive name="ssl_certificate"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
137 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
138 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
139 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
140 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 <para> |
966 | 143 Specifies a <value>file</value> with the certificate in the PEM format |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 for the given virtual server. |
1457
78ccd1af1400
Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents:
1456
diff
changeset
|
145 If intermediate certificates should be specified in addition to a primary |
78ccd1af1400
Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents:
1456
diff
changeset
|
146 certificate, they should be specified in the same file in the following |
78ccd1af1400
Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents:
1456
diff
changeset
|
147 order: the primary certificate comes first, then the intermediate certificates. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 A secret key in the PEM format may be placed in the same file. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
150 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
151 <para> |
1726
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
152 Since version 1.11.0, |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
153 this directive can be specified multiple times |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
154 to load certificates of different types, for example, RSA and ECDSA: |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
155 <example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
156 server { |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
157 listen 443 ssl; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
158 server_name example.com; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
159 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
160 ssl_certificate example.com.rsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
161 ssl_certificate_key example.com.rsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
162 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
163 ssl_certificate example.com.ecdsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
164 ssl_certificate_key example.com.ecdsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
165 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
166 ... |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
167 } |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
168 </example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
169 <note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
170 Only OpenSSL 1.0.2 or higher supports separate |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
171 <link doc="configuring_https_servers.xml" id="chains">certificate chains</link> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
172 for different certificates. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
173 With older versions, only one certificate chain can be used. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
174 </note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
175 </para> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
176 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1725
diff
changeset
|
177 <para> |
2334
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
178 Since version 1.15.9, variables can be used in the <value>file</value> name |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
179 when using OpenSSL 1.0.2 or higher: |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
180 <example> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
181 ssl_certificate $ssl_server_name.crt; |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
182 ssl_certificate_key $ssl_server_name.key; |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
183 </example> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
184 Note that using variables implies that |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
185 a certificate will be loaded for each SSL handshake, |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
186 and this may have a negative impact on performance. |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
187 </para> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
188 |
2350
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
189 <para id="ssl_certificate_data"> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
190 The value |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
191 <literal>data</literal>:<value>$variable</value> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
192 can be specified instead of the <value>file</value> (1.15.10), |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
193 which loads a certificate from a variable |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
194 without using intermediate files. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
195 Note that inappropriate use of this syntax may have its security implications, |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
196 such as writing secret key data to |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
197 <link doc="../ngx_core_module.xml" id="error_log">error log</link>. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
198 </para> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
199 |
2334
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
200 <para> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
201 It should be kept in mind that due to the HTTPS protocol limitations |
2040
093855e77388
Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2027
diff
changeset
|
202 for maximum interoperability virtual servers should listen on |
093855e77388
Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2027
diff
changeset
|
203 <link doc="configuring_https_servers.xml" id="name_based_https_servers">different |
093855e77388
Updated info about SNI.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2027
diff
changeset
|
204 IP addresses</link>. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
205 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
206 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
207 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
208 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
209 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
210 <directive name="ssl_certificate_key"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
211 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
212 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
213 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 <para> |
966 | 217 Specifies a <value>file</value> with the secret key in the PEM format |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
218 for the given virtual server. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
219 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
220 |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
221 <para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
222 The value |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
223 <literal>engine</literal>:<value>name</value>:<value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
224 can be specified instead of the <value>file</value> (1.7.9), |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
225 which loads a secret key with a specified <value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
226 from the OpenSSL engine <value>name</value>. |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
227 </para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1428
diff
changeset
|
228 |
2350
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
229 <para id="ssl_certificate_key_data"> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
230 The value |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
231 <literal>data</literal>:<value>$variable</value> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
232 can be specified instead of the <value>file</value> (1.15.10), |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
233 which loads a secret key from a variable without using intermediate files. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
234 Note that inappropriate use of this syntax may have its security implications, |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
235 such as writing secret key data to |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
236 <link doc="../ngx_core_module.xml" id="error_log">error log</link>. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
237 </para> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2334
diff
changeset
|
238 |
2334
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
239 <para> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
240 Since version 1.15.9, variables can be used in the <value>file</value> name |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
241 when using OpenSSL 1.0.2 or higher. |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
242 </para> |
dbe55598d3f6
Added variables support in ssl_certificate and ssl_certificate_key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
243 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
244 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
245 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
246 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
247 <directive name="ssl_ciphers"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
248 <syntax><value>ciphers</value></syntax> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
249 <default>HIGH:!aNULL:!MD5</default> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
250 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
251 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
253 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
254 Specifies the enabled ciphers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 The ciphers are specified in the format understood by the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 OpenSSL library, for example: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
257 <example> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
258 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
259 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 The full list can be viewed using the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
264 “<command>openssl ciphers</command>” command. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
265 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
266 |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
267 <para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
268 <note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
269 The previous versions of nginx used |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
270 <link doc="configuring_https_servers.xml" id="compatibility">different</link> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
271 ciphers by default. |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
272 </note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
273 </para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
274 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
275 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
277 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
278 <directive name="ssl_client_certificate"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
279 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
280 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
281 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
285 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
286 used to <link id="ssl_verify_client">verify</link> client certificates and |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
287 OCSP responses if <link id="ssl_stapling"/> is enabled. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
288 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
289 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
290 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
291 The list of certificates will be sent to clients. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
292 If this is not desired, the <link id="ssl_trusted_certificate"/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
293 directive can be used. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
294 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
295 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
296 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 |
2616
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
299 <directive name="ssl_conf_command"> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
300 <syntax><value>command</value></syntax> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
301 <default/> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
302 <context>http</context> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
303 <context>server</context> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
304 <appeared-in>1.19.4</appeared-in> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
305 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
306 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
307 Sets arbitrary OpenSSL configuration |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
308 <link url="https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html">commands</link>. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
309 <note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
310 The directive is supported when using OpenSSL 1.0.2 or higher. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
311 </note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
312 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
313 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
314 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
315 Several <literal>ssl_conf_command</literal> directives |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
316 can be specified on the same level: |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
317 <example> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
318 ssl_conf_command Options PrioritizeChaCha; |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
319 ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
320 </example> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
321 These directives are inherited from the previous configuration level |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
322 if and only if there are no <literal>ssl_conf_command</literal> directives |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
323 defined on the current level. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
324 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
325 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
326 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
327 <note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
328 Note that configuring OpenSSL directly |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
329 might result in unexpected behavior. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
330 </note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
331 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
332 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
333 </directive> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
334 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2548
diff
changeset
|
335 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
336 <directive name="ssl_crl"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
337 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
338 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
339 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
340 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 <appeared-in>0.8.7</appeared-in> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
342 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
343 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
344 Specifies a <value>file</value> with revoked certificates (CRL) |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
345 in the PEM format used to <link id="ssl_verify_client">verify</link> |
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
346 client certificates. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
347 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
348 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
349 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
350 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
351 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
352 <directive name="ssl_dhparam"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
353 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
354 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
355 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
356 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
357 <appeared-in>0.7.2</appeared-in> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
358 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
359 <para> |
1706
6f5497797cde
Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents:
1499
diff
changeset
|
360 Specifies a <value>file</value> with DH parameters for DHE ciphers. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
361 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
362 |
2296
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
363 <para> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
364 By default no parameters are set, |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
365 and therefore DHE ciphers will not be used. |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
366 <note> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
367 Prior to version 1.11.0, builtin parameters were used by default. |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
368 </note> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
369 </para> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2241
diff
changeset
|
370 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
371 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
372 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
373 |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
374 <directive name="ssl_early_data"> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
375 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
376 <default>off</default> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
377 <context>http</context> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
378 <context>server</context> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
379 <appeared-in>1.15.3</appeared-in> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
380 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
381 <para> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
382 Enables or disables TLS 1.3 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
383 <link url="https://tools.ietf.org/html/rfc8446#section-2.3">early data</link>. |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
384 <note> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
385 Requests sent within early data are subject to |
2238 | 386 <link url="https://tools.ietf.org/html/rfc8470">replay attacks</link>. |
2234
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
387 To protect against such attacks at the application layer, |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
388 the <link id="var_ssl_early_data">$ssl_early_data</link> variable |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
389 should be used. |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
390 </note> |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
391 |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
392 <example> |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
393 proxy_set_header Early-Data $ssl_early_data; |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
394 </example> |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
395 |
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
396 <note> |
2241
b7ac730b96f3
Documented TLS 1.3 early data support with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2238
diff
changeset
|
397 The directive is supported when using OpenSSL 1.1.1 or higher (1.15.4) and |
b7ac730b96f3
Documented TLS 1.3 early data support with OpenSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2238
diff
changeset
|
398 <link url="https://boringssl.googlesource.com/boringssl/">BoringSSL</link>. |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
399 </note> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
400 </para> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
401 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
402 </directive> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
403 |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
404 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
405 <directive name="ssl_ecdh_curve"> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
406 <syntax><value>curve</value></syntax> |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
407 <default>auto</default> |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
408 <context>http</context> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
409 <context>server</context> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
410 <appeared-in>1.1.0</appeared-in> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
411 <appeared-in>1.0.6</appeared-in> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
412 |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
413 <para> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
414 Specifies a <value>curve</value> for ECDHE ciphers. |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
415 </para> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
416 |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
417 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
418 When using OpenSSL 1.0.2 or higher, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
419 it is possible to specify multiple curves (1.11.0), for example: |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
420 <example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
421 ssl_ecdh_curve prime256v1:secp384r1; |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
422 </example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
423 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
424 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
425 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
426 The special value <literal>auto</literal> (1.11.0) instructs nginx to use |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
427 a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
428 or <literal>prime256v1</literal> with older versions. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
429 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
430 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
431 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
432 <note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
433 Prior to version 1.11.0, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
434 the <literal>prime256v1</literal> curve was used by default. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
435 </note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
436 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
437 |
2648
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
438 <para> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
439 <note> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
440 When using OpenSSL 1.0.2 or higher, |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
441 this directive sets the list of curves supported by the server. |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
442 Thus, in order for ECDSA certificates to work, |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
443 it is important to include the curves used in the certificates. |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
444 </note> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
445 </para> |
78161967514f
Mentioned ECDSA in ssl_ecdh_curve.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2618
diff
changeset
|
446 |
1054
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
447 </directive> |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
448 |
c5793e5c30d4
Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1039
diff
changeset
|
449 |
2548
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
450 <directive name="ssl_ocsp"> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
451 <syntax><literal>on</literal> | |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
452 <literal>off</literal> | |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
453 <literal>leaf</literal></syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
454 <default>off</default> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
455 <context>http</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
456 <context>server</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
457 <appeared-in>1.19.0</appeared-in> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
458 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
459 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
460 Enables OCSP validation of the client certificate chain. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
461 The <literal>leaf</literal> parameter |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
462 enables validation of the client certificate only. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
463 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
464 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
465 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
466 For the OCSP validation to work, |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
467 the <link id="ssl_verify_client"/> directive should be set to |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
468 <literal>on</literal> or <literal>optional</literal>. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
469 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
470 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
471 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
472 To resolve the OCSP responder hostname, |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
473 the <link doc="ngx_http_core_module.xml" id="resolver"/> directive |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
474 should also be specified. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
475 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
476 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
477 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
478 Example: |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
479 <example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
480 ssl_verify_client on; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
481 ssl_ocsp on; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
482 resolver 192.0.2.1; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
483 </example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
484 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
485 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
486 </directive> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
487 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
488 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
489 <directive name="ssl_ocsp_cache"> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
490 <syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
491 <literal>off</literal> | |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
492 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
493 <default>off</default> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
494 <context>http</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
495 <context>server</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
496 <appeared-in>1.19.0</appeared-in> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
497 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
498 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
499 Sets <literal>name</literal> and <literal>size</literal> of the cache |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
500 that stores client certificates status for OCSP validation. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
501 The cache is shared between all worker processes. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
502 A cache with the same name can be used in several virtual servers. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
503 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
504 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
505 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
506 The <literal>off</literal> parameter prohibits the use of the cache. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
507 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
508 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
509 </directive> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
510 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
511 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
512 <directive name="ssl_ocsp_responder"> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
513 <syntax><value>url</value></syntax> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
514 <default/> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
515 <context>http</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
516 <context>server</context> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
517 <appeared-in>1.19.0</appeared-in> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
518 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
519 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
520 Overrides the URL of the OCSP responder specified in the |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
521 “<link url="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
522 Information Access</link>” certificate extension |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
523 for <link id="ssl_ocsp">validation</link> of client certificates. |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
524 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
525 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
526 <para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
527 Only “<literal>http://</literal>” OCSP responders are supported: |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
528 <example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
529 ssl_ocsp_responder http://ocsp.example.com/; |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
530 </example> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
531 </para> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
532 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
533 </directive> |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
534 |
ffc4083f5c7e
Documented ssl_ocsp, ssl_ocsp_cache, ssl_ocsp_responder directives.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2460
diff
changeset
|
535 |
1239
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
536 <directive name="ssl_password_file"> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
537 <syntax><value>file</value></syntax> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
538 <default/> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
539 <context>http</context> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
540 <context>server</context> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
541 <appeared-in>1.7.3</appeared-in> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
542 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
543 <para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
544 Specifies a <value>file</value> with passphrases for |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
545 <link id="ssl_certificate_key">secret keys</link> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
546 where each passphrase is specified on a separate line. |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
547 Passphrases are tried in turn when loading the key. |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
548 </para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
549 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
550 <para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
551 Example: |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
552 <example> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
553 http { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
554 ssl_password_file /etc/keys/global.pass; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
555 ... |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
556 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
557 server { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
558 server_name www1.example.com; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
559 ssl_certificate_key /etc/keys/first.key; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
560 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
561 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
562 server { |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
563 server_name www2.example.com; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
564 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
565 # named pipe can also be used instead of a file |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
566 ssl_password_file /etc/keys/fifo; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
567 ssl_certificate_key /etc/keys/second.key; |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
568 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
569 } |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
570 </example> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
571 </para> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
572 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
573 </directive> |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
574 |
35cf5dca5fa4
SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1201
diff
changeset
|
575 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
576 <directive name="ssl_prefer_server_ciphers"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
577 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
578 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
579 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
580 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
581 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
582 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
583 Specifies that server ciphers should be preferred over client |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
584 ciphers when using the SSLv3 and TLS protocols. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
585 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
586 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
587 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
588 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
589 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
590 <directive name="ssl_protocols"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
591 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
592 [<literal>SSLv2</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
593 [<literal>SSLv3</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
594 [<literal>TLSv1</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
595 [<literal>TLSv1.1</literal>] |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
596 [<literal>TLSv1.2</literal>] |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
597 [<literal>TLSv1.3</literal>]</syntax> |
1499
3687cc9a3592
Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1457
diff
changeset
|
598 <default>TLSv1 TLSv1.1 TLSv1.2</default> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
599 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
600 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
601 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
602 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
603 Enables the specified protocols. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
604 <note> |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
605 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
606 (1.1.13, 1.0.12) work only when OpenSSL 1.0.1 or higher is used. |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
607 </note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
608 <note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
609 The <literal>TLSv1.3</literal> parameter (1.13.0) works only when |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
610 OpenSSL 1.1.1 built with TLSv1.3 support is used. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
611 </note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
612 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
613 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
614 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
615 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
616 |
2618
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
617 <directive name="ssl_reject_handshake"> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
618 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
619 <default>off</default> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
620 <context>http</context> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
621 <context>server</context> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
622 <appeared-in>1.19.4</appeared-in> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
623 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
624 <para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
625 If enabled, SSL handshakes in |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
626 the <link doc="ngx_http_core_module.xml" id="server"/> block will be rejected. |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
627 </para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
628 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
629 <para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
630 For example, in the following configuration, SSL handshakes with |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
631 server names other than <literal>example.com</literal> are rejected: |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
632 <example> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
633 server { |
2718
fb41de2d765a
Added default_server to ssl_reject_handshake example.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2648
diff
changeset
|
634 listen 443 ssl default_server; |
2618
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
635 ssl_reject_handshake on; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
636 } |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
637 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
638 server { |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
639 listen 443 ssl; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
640 server_name example.com; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
641 ssl_certificate example.com.crt; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
642 ssl_certificate_key example.com.key; |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
643 } |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
644 </example> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
645 </para> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
646 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
647 </directive> |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
648 |
0b98a81f196b
Documented the ssl_reject_handshake directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2616
diff
changeset
|
649 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
650 <directive name="ssl_session_cache"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
651 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
652 <literal>off</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
653 <literal>none</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
654 [<literal>builtin</literal>[:<value>size</value>]] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
655 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
656 <default>none</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
657 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
658 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
659 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
660 <para> |
966 | 661 Sets the types and sizes of caches that store session parameters. |
662 A cache can be of any of the following types: | |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
663 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
664 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
665 <tag-name><literal>off</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
666 <tag-desc> |
966 | 667 the use of a session cache is strictly prohibited: |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
668 nginx explicitly tells a client that sessions may not be reused. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
669 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
670 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
671 <tag-name><literal>none</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
672 <tag-desc> |
966 | 673 the use of a session cache is gently disallowed: |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
674 nginx tells a client that sessions may be reused, but does not |
966 | 675 actually store session parameters in the cache. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
676 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
677 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
678 <tag-name id="ssl_session_cache_builtin"><literal>builtin</literal></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
679 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
680 a cache built in OpenSSL; used by one worker process only. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
681 The cache size is specified in sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
682 If size is not given, it is equal to 20480 sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
683 Use of the built-in cache can cause memory fragmentation. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
684 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
685 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2040
diff
changeset
|
686 <tag-name id="ssl_session_cache_shared"><literal>shared</literal></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
687 <tag-desc> |
966 | 688 a cache shared between all worker processes. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
689 The cache size is specified in bytes; one megabyte can store |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
690 about 4000 sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
691 Each shared cache should have an arbitrary name. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
692 A cache with the same name can be used in several virtual servers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
693 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
694 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
695 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
696 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
697 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
698 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
699 Both cache types can be used simultaneously, for example: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
700 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
701 ssl_session_cache builtin:1000 shared:SSL:10m; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
702 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
703 but using only shared cache without the built-in cache should |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
704 be more efficient. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
705 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
706 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
707 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
708 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
709 |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
710 <directive name="ssl_session_ticket_key"> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
711 <syntax><value>file</value></syntax> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
712 <default/> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
713 <context>http</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
714 <context>server</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
715 <appeared-in>1.5.7</appeared-in> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
716 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
717 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
718 Sets a <value>file</value> with the secret key used to encrypt |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
719 and decrypt TLS session tickets. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
720 The directive is necessary if the same key has to be shared between |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
721 multiple servers. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
722 By default, a randomly generated key is used. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
723 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
724 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
725 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
726 If several keys are specified, only the first key is |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
727 used to encrypt TLS session tickets. |
1144
ac131944d349
Changed infinitive to gerund after "allow".
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1072
diff
changeset
|
728 This allows configuring key rotation, for example: |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
729 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
730 ssl_session_ticket_key current.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
731 ssl_session_ticket_key previous.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
732 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
733 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
734 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
735 <para> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
736 The <value>file</value> must contain 80 or 48 bytes |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
737 of random data and can be created using the following command: |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
738 <example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
739 openssl rand 80 > ticket.key |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
740 </example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
741 Depending on the file size either AES256 (for 80-byte keys, 1.11.8) |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1871
diff
changeset
|
742 or AES128 (for 48-byte keys) is used for encryption. |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
743 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
744 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
745 </directive> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
746 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
747 |
1055
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
748 <directive name="ssl_session_tickets"> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
749 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
750 <default>on</default> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
751 <context>http</context> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
752 <context>server</context> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
753 <appeared-in>1.5.9</appeared-in> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
754 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
755 <para> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
756 Enables or disables session resumption through |
1923
66a30a380fba
Fixed links to tools.ietf.org.
Ruslan Ermilov <ru@nginx.com>
parents:
1877
diff
changeset
|
757 <link url="https://tools.ietf.org/html/rfc5077">TLS session tickets</link>. |
1055
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
758 </para> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
759 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
760 </directive> |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
761 |
e26a9f598e40
Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1054
diff
changeset
|
762 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
763 <directive name="ssl_session_timeout"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
764 <syntax><value>time</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
765 <default>5m</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
766 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
767 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
768 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
769 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
770 Specifies a time during which a client may reuse the |
1785
3fa0944ddc6a
Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
771 session parameters. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
772 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
773 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
774 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
775 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
776 |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
777 <directive name="ssl_stapling"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
778 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
779 <default>off</default> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
780 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
781 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
782 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
783 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
784 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
785 Enables or disables |
2162
aa5d65fe4916
Updated link to TLS Certificate Status Request extension reference.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2068
diff
changeset
|
786 <link url="https://tools.ietf.org/html/rfc6066#section-8">stapling |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
787 of OCSP responses</link> by the server. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
788 Example: |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
789 <example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
790 ssl_stapling on; |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
791 resolver 192.0.2.1; |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
792 </example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
793 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
794 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
795 <para> |
966 | 796 For the OCSP stapling to work, the certificate of the server certificate |
797 issuer should be known. | |
712
2c9e8facc761
Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents:
696
diff
changeset
|
798 If the <link id="ssl_certificate"/> file does |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
799 not contain intermediate certificates, |
966 | 800 the certificate of the server certificate issuer should be |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
801 present in the |
712
2c9e8facc761
Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents:
696
diff
changeset
|
802 <link id="ssl_trusted_certificate"/> file. |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
803 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
804 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
805 <para> |
966 | 806 For a resolution of the OCSP responder hostname, |
807 the <link doc="ngx_http_core_module.xml" id="resolver"/> directive | |
808 should also be specified. | |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
809 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
810 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
811 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
812 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
813 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
814 <directive name="ssl_stapling_file"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
815 <syntax><value>file</value></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
816 <default/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
817 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
818 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
819 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
820 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
821 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
822 When set, the stapled OCSP response will be taken from the |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
823 specified <value>file</value> instead of querying |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
824 the OCSP responder specified in the server certificate. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
825 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
826 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
827 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
828 The file should be in the DER format as produced by the |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
829 “<literal>openssl ocsp</literal>” command. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
830 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
831 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
832 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
833 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
834 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
835 <directive name="ssl_stapling_responder"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
836 <syntax><value>url</value></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
837 <default/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
838 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
839 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
840 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
841 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
842 <para> |
966 | 843 Overrides the URL of the OCSP responder specified in the |
1923
66a30a380fba
Fixed links to tools.ietf.org.
Ruslan Ermilov <ru@nginx.com>
parents:
1877
diff
changeset
|
844 “<link url="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
845 Information Access</link>” certificate extension. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
846 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
847 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
848 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
849 Only “<literal>http://</literal>” OCSP responders are supported: |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
850 <example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
851 ssl_stapling_responder http://ocsp.example.com/; |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
852 </example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
853 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
854 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
855 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
856 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
857 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
858 <directive name="ssl_stapling_verify"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
859 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
860 <default>off</default> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
861 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
862 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
863 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
864 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
865 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
866 Enables or disables verification of OCSP responses by the server. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
867 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
868 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
869 <para> |
966 | 870 For verification to work, the certificate of the server certificate |
871 issuer, the root certificate, and all intermediate certificates | |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
872 should be configured as trusted using the |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
873 <link id="ssl_trusted_certificate"/> directive. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
874 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
875 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
876 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
877 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
878 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
879 <directive name="ssl_trusted_certificate"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
880 <syntax><value>file</value></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
881 <default/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
882 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
883 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
884 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
885 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
886 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
887 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
1428
933831d7bf0b
Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1411
diff
changeset
|
888 used to <link id="ssl_verify_client">verify</link> client certificates and |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
889 OCSP responses if <link id="ssl_stapling"/> is enabled. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
890 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
891 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
892 <para> |
966 | 893 In contrast to the certificate set by <link id="ssl_client_certificate"/>, |
894 the list of these certificates will not be sent to clients. | |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
895 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
896 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
897 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
898 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
899 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
900 <directive name="ssl_verify_client"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
901 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
902 <literal>on</literal> | <literal>off</literal> | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
903 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
904 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
905 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
906 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
907 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
908 <para> |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
909 Enables verification of client certificates. |
966 | 910 The verification result is stored in the |
1871
5f156621b8b5
Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1870
diff
changeset
|
911 <link id="var_ssl_client_verify">$ssl_client_verify</link> variable. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
912 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
913 |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
914 <para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
915 The <literal>optional</literal> parameter (0.8.7+) requests the client |
966 | 916 certificate and verifies it if the certificate is present. |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
917 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
918 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
919 <para> |
763
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
920 The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5) |
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
921 requests the client |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
922 certificate but does not require it to be signed by a trusted CA certificate. |
966 | 923 This is intended for the use in cases when a service that is external to nginx |
924 performs the actual certificate verification. | |
925 The contents of the certificate is accessible through the | |
1871
5f156621b8b5
Added links to $ssl_client_verify and $ssl_client_cert.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1870
diff
changeset
|
926 <link id="var_ssl_client_cert">$ssl_client_cert</link> variable. |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
927 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
928 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
929 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
930 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
931 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
932 <directive name="ssl_verify_depth"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
933 <syntax><value>number</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
934 <default>1</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
935 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
936 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
937 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
938 <para> |
966 | 939 Sets the verification depth in the client certificates chain. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
940 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
941 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
942 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
943 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
944 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
945 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
946 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
947 <section id="errors" name="Error Processing"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
948 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
949 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
950 The <literal>ngx_http_ssl_module</literal> module supports several |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
951 non-standard error codes that can be used for redirects using the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
952 <link doc="ngx_http_core_module.xml" id="error_page"/> directive: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
953 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
954 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
955 <tag-name>495</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
956 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
957 an error has occurred during the client certificate verification; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
958 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
959 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
960 <tag-name>496</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
961 <tag-desc> |
966 | 962 a client has not presented the required certificate; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
963 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
964 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
965 <tag-name>497</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
966 <tag-desc> |
966 | 967 a regular request has been sent to the HTTPS port. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
968 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
969 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
970 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
971 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
972 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
973 <para> |
966 | 974 The redirection happens after the request is fully parsed and |
975 the variables, such as <var>$request_uri</var>, | |
976 <var>$uri</var>, <var>$args</var> and others, are available. | |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
977 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
978 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
979 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
980 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
981 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
982 <section id="variables" name="Embedded Variables"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
983 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
984 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
985 The <literal>ngx_http_ssl_module</literal> module supports |
2388
d323beea61ec
An outdated adjective removed.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2350
diff
changeset
|
986 embedded variables: |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
987 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
988 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
989 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
990 <tag-desc> |
2460
c60a8a15010c
Clarified description of the $ssl_cipher variable.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2388
diff
changeset
|
991 returns the name of the cipher used |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
992 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
993 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
994 |
1857
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
995 <tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
996 <tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
997 returns the list of ciphers supported by the client (1.11.7). |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
998 Known ciphers are listed by names, unknown are shown in hexadecimal, |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
999 for example: |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1000 <example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1001 AES128-SHA:AES256-SHA:0x00ff |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1002 </example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1003 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1004 The variable is fully supported only when using OpenSSL version 1.0.2 or higher. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1005 With older versions, the variable is available |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1006 only for new sessions and lists only known ciphers. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1007 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1008 </tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1009 |
2027
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1010 <tag-name id="var_ssl_client_escaped_cert"><var>$ssl_client_escaped_cert</var></tag-name> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1011 <tag-desc> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1012 returns the client certificate in the PEM format (urlencoded) |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1013 for an established SSL connection (1.13.5); |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1014 </tag-desc> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1015 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1016 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1017 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1018 returns the client certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1019 for an established SSL connection, with each line except the first |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1020 prepended with the tab character; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1021 this is intended for the use in the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1022 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive; |
2027
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1023 <note> |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1024 The variable is deprecated, |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1025 the <var>$ssl_client_escaped_cert</var> variable should be used instead. |
dabca59da4ce
Documented the $ssl_client_escaped_cert variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
1026 </note> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1027 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1028 |
1201
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1029 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1030 <tag-desc> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1031 returns the SHA1 fingerprint of the client certificate |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1032 for an established SSL connection (1.7.1); |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1033 </tag-desc> |
db4b017b5796
SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1167
diff
changeset
|
1034 |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1035 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1036 <tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1037 returns the “issuer DN” string of the client certificate |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1038 for an established SSL connection according to |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1039 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6); |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1040 </tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1041 |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1042 <tag-name id="var_ssl_client_i_dn_legacy"><var>$ssl_client_i_dn_legacy</var></tag-name> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1043 <tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1044 returns the “issuer DN” string of the client certificate |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1045 for an established SSL connection; |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1046 <note> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1047 Prior to version 1.11.6, the variable name was <var>$ssl_client_i_dn</var>. |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1048 </note> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1049 </tag-desc> |
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1050 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1051 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var> |
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1052 </tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1053 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1054 returns the client certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1055 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1056 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1057 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1058 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1059 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1060 returns the “subject DN” string of the client certificate |
1824
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1061 for an established SSL connection according to |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1062 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6); |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1063 </tag-desc> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1064 |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1065 <tag-name id="var_ssl_client_s_dn_legacy"><var>$ssl_client_s_dn_legacy</var></tag-name> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1066 <tag-desc> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1067 returns the “subject DN” string of the client certificate |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1068 for an established SSL connection; |
1824
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1069 <note> |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1070 Prior to version 1.11.6, the variable name was <var>$ssl_client_s_dn</var>. |
e8811a423130
Added RFC2253-compliant $ssl_client_s_dn, $ssl_client_i_dn and legacy vars.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
1071 </note> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1072 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1073 |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1074 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1075 <tag-desc> |
1870
fa7542e40381
Relocated $ssl_client_i_dn, $ssl_client_i_dn_legacy, $ssl_client_serial.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1863
diff
changeset
|
1076 returns the serial number of the client certificate |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1077 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1078 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1079 |
1855
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1080 <tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1081 <tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1082 returns the end date of the client certificate (1.11.7); |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1083 </tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1084 |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1085 <tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1086 <tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1087 returns the number of days |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1088 until the client certificate expires (1.11.7); |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1089 </tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1090 |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1091 <tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1092 <tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1093 returns the start date of the client certificate (1.11.7); |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1094 </tag-desc> |
2ef67c4d2226
Documented $ssl_client_v_end, $ssl_client_v_start, $ssl_client_v_remain variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1824
diff
changeset
|
1095 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1096 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1097 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1098 returns the result of client certificate verification: |
1856
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1099 “<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”, |
1863
fef4ab2d990c
Removed unnecessary version for "FAILED:reason" in $ssl_client_verify.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
1100 and “<literal>NONE</literal>” if a certificate was not present; |
1856
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1101 <note> |
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1102 Prior to version 1.11.7, the “<literal>FAILED</literal>” result |
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1103 did not contain the <value>reason</value> string. |
7133004fa5b3
$ssl_client_verify extended with a failure reason.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1855
diff
changeset
|
1104 </note> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1105 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1106 |
1857
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1107 <tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1108 <tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1109 returns the list of curves supported by the client (1.11.7). |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1110 Known curves are listed by names, unknown are shown in hexadecimal, |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1111 for example: |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1112 <example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1113 0x001d:prime256v1:secp521r1:secp384r1 |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1114 </example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1115 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1116 The variable is supported only when using OpenSSL version 1.0.2 or higher. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1117 With older versions, the variable value will be an empty string. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1118 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1119 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1120 The variable is available only for new sessions. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1121 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1122 </tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1856
diff
changeset
|
1123 |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1124 <tag-name id="var_ssl_early_data"><var>$ssl_early_data</var></tag-name> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1125 <tag-desc> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1126 returns “<literal>1</literal>” if |
2234
20a189bdb15f
Updated SSL early data documentation.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2219
diff
changeset
|
1127 TLS 1.3 <link id="ssl_early_data">early data</link> is used |
2219
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1128 and the handshake is not complete, otherwise “” (1.15.3). |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1129 </tag-desc> |
f1e12641fc8a
Documented TLS 1.3 early data.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2168
diff
changeset
|
1130 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1131 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1132 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1133 returns the protocol of an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1134 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1135 |
1167
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1136 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1137 <tag-desc> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1138 returns the server name requested through |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1139 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1140 (1.7.0); |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1141 </tag-desc> |
cac06b81957c
Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents:
1155
diff
changeset
|
1142 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1143 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1144 <tag-desc> |
1072
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1145 returns the session identifier of an established SSL connection; |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1146 </tag-desc> |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1147 |
1155
07402a11fd8d
Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents:
1144
diff
changeset
|
1148 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name> |
1072
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1149 <tag-desc> |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1150 returns “<literal>r</literal>” if an SSL session was reused, |
502f4be2d62e
Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1055
diff
changeset
|
1151 or “<literal>.</literal>” otherwise (1.5.11). |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1152 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1153 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1154 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1155 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1156 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1157 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1158 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1159 </module> |