annotate conf/scgi_params @ 7732:59e1c73fe02b

SSL: ssl_reject_handshake directive (ticket #195). In some cases it might be needed to reject SSL handshake based on SNI server name provided, for example, to make sure an invalid certificate is not returned to clients trying to contact a name-based virtual server without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for this. This workaround, however, is not compatible with TLSv1.3, in particular, when using BoringSSL, where it is not possible to configure TLSv1.3 ciphers at all. With this change, the ssl_reject_handshake directive is introduced, which instructs nginx to reject SSL handshakes with an "unrecognized_name" alert in a particular server block. For example, to reject handshake with names other than example.com, one can use the following configuration: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; } The following configuration can be used to reject all SSL handshakes without SNI server name provided: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name ~^; ssl_certificate example.crt; ssl_certificate_key example.key; } Additionally, the ssl_reject_handshake directive makes configuring certificates for the default server block optional. If no certificates are configured in the default server for a given listening socket, certificates must be defined in all non-default server blocks with the listening socket in question.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 22 Oct 2020 18:02:28 +0300
parents 62869a9b2e7d
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
3637
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
1
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
2 scgi_param REQUEST_METHOD $request_method;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
3 scgi_param REQUEST_URI $request_uri;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
4 scgi_param QUERY_STRING $query_string;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
5 scgi_param CONTENT_TYPE $content_type;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
6
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
7 scgi_param DOCUMENT_URI $document_uri;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
8 scgi_param DOCUMENT_ROOT $document_root;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
9 scgi_param SCGI 1;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
10 scgi_param SERVER_PROTOCOL $server_protocol;
6168
62869a9b2e7d Added the REQUEST_SCHEME parameter.
Maxim Dounin <mdounin@mdounin.ru>
parents: 4333
diff changeset
11 scgi_param REQUEST_SCHEME $scheme;
4333
352a7b025f2e Added HTTPS param with Apache-like behaviour to fastcgi/scgi/uwsgi_params (fixes #38).
Valentin Bartenev <vbart@nginx.com>
parents: 3637
diff changeset
12 scgi_param HTTPS $https if_not_empty;
3637
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
13
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
14 scgi_param REMOTE_ADDR $remote_addr;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
15 scgi_param REMOTE_PORT $remote_port;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
16 scgi_param SERVER_PORT $server_port;
d656caa72ec9 ngx_http_scgi_module
Igor Sysoev <igor@sysoev.ru>
parents:
diff changeset
17 scgi_param SERVER_NAME $server_name;