@@ -605,6 +605,39 @@ OpenSSL 1.1.1 built with TLSv1.3 support + +on | off +off +http +server +1.19.4 + + +If enabled, SSL handshakes in +the block will be rejected. + + + +For example, in the following configuration, SSL handshakes with +server names other than example.com are rejected: + +server { + listen 443 ssl; + ssl_reject_handshake on; +} + +server { + listen 443 ssl; + server_name example.com; + ssl_certificate example.com.crt; + ssl_certificate_key example.com.key; +} + + + + + + off | diff --git a/xml/ru/docs/http/ngx_http_ssl_module.xml b/xml/ru/docs/http/ngx_http_ssl_module.xml --- a/xml/ru/docs/http/ngx_http_ssl_module.xml +++ b/xml/ru/docs/http/ngx_http_ssl_module.xml @@ -10,7 +10,7 @@ + rev="51">

@@ -609,6 +609,39 @@ http { + +on | off +off +http +server +1.19.4 + + +Если разрешено, то операции SSL handshake в +блоке будут отклонены. + + + +Например в этой конфигурации отклоняются все операции SSL handshake с +именем сервера, отличным от example.com: + +server { + listen 443 ssl; + ssl_reject_handshake on; +} + +server { + listen 443 ssl; + server_name example.com; + ssl_certificate example.com.crt; + ssl_certificate_key example.com.key; +} + + + + + + off |