nginx-site: xml/en/docs/http/configuring_https

annotate xml/en/docs/http/configuring_https_servers.xml @ 1757:40e461a34187

Fixed a typo in nginx version number.

author	Valentin Bartenev <vbart@nginx.com>
date	Thu, 28 Jul 2016 18:08:51 +0300
parents	ecf2dd95ceb6
children	093855e77388

rev	line source
580 be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 490 diff changeset	1 <!--
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 490 diff changeset	2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 490 diff changeset	3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 490 diff changeset	4 -->
be54c443235a Added copyright markers to documentation sources. Ruslan Ermilov <ru@nginx.com> parents: 490 diff changeset	5
50 9d544687d02c Fixed DOCTYPE declaration. Ruslan Ermilov <ru@nginx.com> parents: 46 diff changeset	6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	7
123 7db449e89e92 Unified the use of the "name" attribute instead of "title". Ruslan Ermilov <ru@nginx.com> parents: 121 diff changeset	8 <article name="Configuring HTTPS servers"
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	9 link="/en/docs/http/configuring_https_servers.html"
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	10 lang="en"
1757 40e461a34187 Fixed a typo in nginx version number. Valentin Bartenev <vbart@nginx.com> parents: 1733 diff changeset	11 rev="11"
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	12 author="Igor Sysoev"
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	13 editor="Brian Mercer">
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	14
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	15 <section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	16
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	17 <para>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	18 To configure an HTTPS server, the <literal>ssl</literal> parameter
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	19 must be enabled on
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	20 <link doc="ngx_http_core_module.xml" id="listen">listening sockets</link>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	21 in the <link doc="ngx_http_core_module.xml" id="server"/> block,
1733 ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	22 and the locations of the
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	23 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate">server certificate</link>
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	24 and
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	25 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate_key">private key</link>
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	26 files should be specified:
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	27
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	28 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	29 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	30 listen 443 <b>ssl</b>;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	31 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	32 ssl_certificate <b>www.example.com.crt</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	33 ssl_certificate_key <b>www.example.com.key</b>;
1411 8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example. Sergey Budnevitch <sb@waeme.net> parents: 1144 diff changeset	34 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	35 ssl_ciphers HIGH:!aNULL:!MD5;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	36 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	37 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	38 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	39
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	40 The server certificate is a public entity.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	41 It is sent to every client that connects to the server.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	42 The private key is a secure entity and should be stored in a file with
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	43 restricted access, however, it must be readable by nginx’s master process.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	44 The private key may alternately be stored in the same file as the certificate:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	45
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	46 <programlisting>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	47 ssl_certificate www.example.com.cert;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	48 ssl_certificate_key www.example.com.cert;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	49 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	50
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	51 in which case the file access rights should also be restricted.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	52 Although the certificate and the key are stored in one file,
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	53 only the certificate is sent to a client.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	54 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	55
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	56 <para>
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	57 The directives <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> and
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	58 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	59 can be used to limit connections
56 b706454b2ab8 - About RC4-SHA Andrey Alexeev <andrew@nginx.com> parents: 50 diff changeset	60 to include only the strong versions and ciphers of SSL/TLS.
1499 3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	61 By default nginx uses
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	62 “<literal>ssl_protocols TLSv1 TLSv1.1 TLSv1.2</literal>”
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	63 and “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”,
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	64 so configuring them explicitly is generally not needed.
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	65 Note that default values of these directives were
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	66 <link id="compatibility">changed</link> several times.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	67 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	68
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	69 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	70
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	71
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	72 <section id="optimization" name="HTTPS server optimization">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	73
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	74 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	75 SSL operations consume extra CPU resources.
1733 ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	76 On multi-processor systems several
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	77 <link doc="../ngx_core_module.xml" id="worker_processes">worker processes</link>
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	78 should be run,
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	79 no less than the number of available CPU cores.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	80 The most CPU-intensive operation is the SSL handshake.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	81 There are two ways to minimize the number of these operations per client:
1733 ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	82 the first is by enabling
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	83 <link doc="ngx_http_core_module.xml" id="keepalive_timeout">keepalive</link>
ecf2dd95ceb6 Added links in "Configuring HTTPS servers". Yaroslav Zhuravlev <yar@nginx.com> parents: 1505 diff changeset	84 connections to send several
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	85 requests via one connection and the second is to reuse SSL session
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	86 parameters to avoid SSL handshakes for parallel and subsequent connections.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	87 The sessions are stored in an SSL session cache shared between workers
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	88 and configured by the
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	89 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	90 directive.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	91 One megabyte of the cache contains about 4000 sessions.
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	92 The default cache timeout is 5 minutes.
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	93 It can be increased by using the
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	94 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	95 directive.
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	96 Here is a sample configuration optimized for a multi-core system
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	97 with 10 megabyte shared session cache:
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	98
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	99 <programlisting>
817 4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples. Andrei Belov <defan@nginx.com> parents: 801 diff changeset	100 <b>worker_processes auto</b>;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	101
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	102 http {
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	103 <b>ssl_session_cache shared:SSL:10m</b>;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	104 <b>ssl_session_timeout 10m</b>;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	105
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	106 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	107 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	108 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	109 <b>keepalive_timeout 70</b>;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	110
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	111 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	112 ssl_certificate_key www.example.com.key;
1411 8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example. Sergey Budnevitch <sb@waeme.net> parents: 1144 diff changeset	113 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	114 ssl_ciphers HIGH:!aNULL:!MD5;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	115 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	116 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	117 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	118
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	119 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	120
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	121
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	122 <section id="chains" name="SSL certificate chains">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	123
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	124 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	125 Some browsers may complain about a certificate signed by a well-known
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	126 certificate authority, while other browsers may accept the certificate
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	127 without issues.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	128 This occurs because the issuing authority has signed the server certificate
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	129 using an intermediate certificate that is not present in the certificate
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	130 base of well-known trusted certificate authorities which is distributed
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	131 with a particular browser.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	132 In this case the authority provides a bundle of chained certificates
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	133 which should be concatenated to the signed server certificate.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	134 The server certificate must appear before the chained certificates
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	135 in the combined file:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	136
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	137 <programlisting>
490 9913f1d51c07 Replaced "nginx" domain names with example domains. Ruslan Ermilov <ru@nginx.com> parents: 461 diff changeset	138 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	139 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	140
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	141 The resulting file should be used in the
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	142 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/> directive:
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	143
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	144 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	145 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	146 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	147 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	148 ssl_certificate www.example.com.chained.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	149 ssl_certificate_key www.example.com.key;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	150 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	151 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	152 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	153
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	154 If the server certificate and the bundle have been concatenated in the wrong
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	155 order, nginx will fail to start and will display the error message:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	156
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	157 <programlisting>
490 9913f1d51c07 Replaced "nginx" domain names with example domains. Ruslan Ermilov <ru@nginx.com> parents: 461 diff changeset	158 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	159 (SSL: error:0B080074:x509 certificate routines:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	160 X509_check_private_key:key values mismatch)
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	161 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	162
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	163 because nginx has tried to use the private key with the bundle’s
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	164 first certificate instead of the server certificate.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	165 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	166
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	167 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	168 Browsers usually store intermediate certificates which they receive
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	169 and which are signed by trusted authorities, so actively used browsers
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	170 may already have the required intermediate certificates and
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	171 may not complain about a certificate sent without a chained bundle.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	172 To ensure the server sends the complete certificate chain,
659 77a3314c74a7 Avoid the uses of second person. Ruslan Ermilov <ru@nginx.com> parents: 658 diff changeset	173 the <command>openssl</command> command-line utility may be used, for example:
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	174
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	175 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	176 $ openssl s_client -connect www.godaddy.com:443
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	177 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	178 Certificate chain
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	179 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	180 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	181 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	182 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	183 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	184 /OU=http://certificates.godaddy.com/repository
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	185 /CN=Go Daddy Secure Certification Authority
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	186 /serialNumber=07969287
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	187 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	188 /OU=http://certificates.godaddy.com/repository
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	189 /CN=Go Daddy Secure Certification Authority
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	190 /serialNumber=07969287
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	191 i:/C=US/O=The Go Daddy Group, Inc.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	192 /OU=Go Daddy Class 2 Certification Authority
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	193 2 s:/C=US/O=The Go Daddy Group, Inc.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	194 /OU=Go Daddy Class 2 Certification Authority
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	195 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	196 /OU=ValiCert Class 2 Policy Validation Authority
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	197 /CN=http://www.valicert.com//emailAddress=info@valicert.com
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	198 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	199 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	200
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	201 In this example the subject (“<i>s</i>”) of the
593 130fad6dc1b4 Replaced the uses of "url" element with "literal". Ruslan Ermilov <ru@nginx.com> parents: 589 diff changeset	202 <literal>www.GoDaddy.com</literal> server certificate #0 is signed by an issuer
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	203 (“<i>i</i>”) which itself is the subject of the certificate #1,
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	204 which is signed by an issuer which itself is the subject of the certificate #2,
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	205 which signed by the well-known issuer <i>ValiCert, Inc.</i>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	206 whose certificate is stored in the browsers’ built-in
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	207 certificate base (that lay in the house that Jack built).
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	208 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	209
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	210 <para>
659 77a3314c74a7 Avoid the uses of second person. Ruslan Ermilov <ru@nginx.com> parents: 658 diff changeset	211 If a certificate bundle has not been added, only the server certificate #0
77a3314c74a7 Avoid the uses of second person. Ruslan Ermilov <ru@nginx.com> parents: 658 diff changeset	212 will be shown.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	213 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	214
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	215 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	216
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	217
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	218 <section id="single_http_https_server" name="A single HTTP/HTTPS server">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	219
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	220 <para>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	221 It is possible to configure a single server that handles both HTTP
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	222 and HTTPS requests:
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	223
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	224 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	225 server {
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	226 listen 80;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	227 listen 443 ssl;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	228 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	229 ssl_certificate www.example.com.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	230 ssl_certificate_key www.example.com.key;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	231 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	232 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	233 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	234
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	235 <note>
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	236 Prior to 0.7.14 SSL could not be enabled selectively for
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	237 individual listening sockets, as shown above.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	238 SSL could only be enabled for the entire server using the
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	239 <link doc="ngx_http_ssl_module.xml" id="ssl"/> directive,
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	240 making it impossible to set up a single HTTP/HTTPS server.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	241 The <literal>ssl</literal> parameter of the
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	242 <link doc="ngx_http_core_module.xml" id="listen"/> directive
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	243 was added to solve this issue.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	244 The use of the
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	245 <link doc="ngx_http_ssl_module.xml" id="ssl"/> directive
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	246 in modern versions is thus discouraged.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	247 </note>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	248 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	249
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	250 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	251
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	252
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	253 <section id="name_based_https_servers" name="Name-based HTTPS servers">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	254
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	255 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	256 A common issue arises when configuring two or more HTTPS servers
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	257 listening on a single IP address:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	258
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	259 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	260 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	261 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	262 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	263 ssl_certificate www.example.com.crt;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	264 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	265 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	266
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	267 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	268 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	269 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	270 ssl_certificate www.example.org.crt;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	271 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	272 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	273 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	274
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	275 With this configuration a browser receives the default server’s certificate,
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	276 i.e. <literal>www.example.com</literal> regardless of the requested server name.
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	277 This is caused by SSL protocol behaviour.
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	278 The SSL connection is established before the browser sends an HTTP request
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	279 and nginx does not know the name of the requested server.
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	280 Therefore, it may only offer the default server’s certificate.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	281 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	282
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	283 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	284 The oldest and most robust method to resolve the issue
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	285 is to assign a separate IP address for every HTTPS server:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	286
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	287 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	288 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	289 listen 192.168.1.1:443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	290 server_name www.example.com;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	291 ssl_certificate www.example.com.crt;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	292 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	293 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	294
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	295 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	296 listen 192.168.1.2:443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	297 server_name www.example.org;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	298 ssl_certificate www.example.org.crt;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	299 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	300 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	301 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	302 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	303
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	304
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	305 <section id="certificate_with_several_names"
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	306 name="An SSL certificate with several names">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	307
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	308 <para>
1144 ac131944d349 Changed infinitive to gerund after "allow". Yaroslav Zhuravlev <yar@nginx.com> parents: 817 diff changeset	309 There are other ways that allow sharing a single IP address
782 2ceaef0e84a1 Added a phrase about wildcard certificates into the English version of Ruslan Ermilov <ru@nginx.com> parents: 661 diff changeset	310 between several HTTPS servers.
2ceaef0e84a1 Added a phrase about wildcard certificates into the English version of Ruslan Ermilov <ru@nginx.com> parents: 661 diff changeset	311 However, all of them have their drawbacks.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	312 One way is to use a certificate with several names in
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	313 the SubjectAltName certificate field, for example,
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	314 <literal>www.example.com</literal> and <literal>www.example.org</literal>.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	315 However, the SubjectAltName field length is limited.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	316 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	317
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	318 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	319 Another way is to use a certificate with a wildcard name, for example,
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	320 <literal>*.example.org</literal>.
782 2ceaef0e84a1 Added a phrase about wildcard certificates into the English version of Ruslan Ermilov <ru@nginx.com> parents: 661 diff changeset	321 A wildcard certificate secures all subdomains of the specified domain,
2ceaef0e84a1 Added a phrase about wildcard certificates into the English version of Ruslan Ermilov <ru@nginx.com> parents: 661 diff changeset	322 but only on one level.
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	323 This certificate matches <literal>www.example.org</literal>, but does not match
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	324 <literal>example.org</literal> and <literal>www.sub.example.org</literal>.
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	325 These two methods can also be combined.
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	326 A certificate may contain exact and wildcard names in the
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	327 SubjectAltName field, for example,
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	328 <literal>example.org</literal> and <literal>*.example.org</literal>.
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	329 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	330
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	331 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	332 It is better to place a certificate file with several names and
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	333 its private key file at the <i>http</i> level of configuration
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	334 to inherit their single memory copy in all servers:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	335
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	336 <programlisting>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	337 ssl_certificate common.crt;
ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	338 ssl_certificate_key common.key;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	339
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	340 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	341 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	342 server_name www.example.com;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	343 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	344 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	345
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	346 server {
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	347 listen 443 ssl;
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	348 server_name www.example.org;
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	349 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	350 }
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	351 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	352 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	353
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	354 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	355
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	356
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	357 <section id="sni" name="Server Name Indication">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	358
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	359 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	360 A more generic solution for running several HTTPS servers on a single
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	361 IP address is
661 e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	362 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">TLS
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	363 Server Name Indication extension</link> (SNI, RFC 6066),
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	364 which allows a browser to pass a requested server name during the SSL handshake
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	365 and, therefore, the server will know which certificate it should use
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	366 for the connection.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	367 However, SNI has limited browser support.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	368 Currently it is supported starting with the following browsers versions:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	369 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	370
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	371 <para>
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	372 <list type="bullet">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	373
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	374 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	375 Opera 8.0;
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	376 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	377
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	378 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	379 MSIE 7.0 (but only on Windows Vista or higher);
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	380 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	381
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	382 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	383 Firefox 2.0 and other browsers using Mozilla Platform rv:1.8.1;
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	384 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	385
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	386 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	387 Safari 3.2.1 (Windows version supports SNI on Vista or higher);
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	388 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	389
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	390 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	391 and Chrome (Windows version supports SNI on Vista or higher, too).
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	392 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	393
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	394 </list>
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	395 <note>
661 e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	396 Only domain names can be passed in SNI,
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	397 however some browsers may erroneously pass an IP address of the server
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	398 as its name if a request includes literal IP address.
e1579b244800 SNI: expressed more clearly that passing of literal IP addresses in Ruslan Ermilov <ru@nginx.com> parents: 660 diff changeset	399 One should not rely on this.
658 bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	400 </note>
bd81a71006fe Documented that most browsers won't pass an IP address Ruslan Ermilov <ru@nginx.com> parents: 593 diff changeset	401 </para>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	402
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	403 <para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	404 In order to use SNI in nginx, it must be supported in both the
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	405 OpenSSL library with which the nginx binary has been built as well as
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	406 the library to which it is being dynamically linked at run time.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	407 OpenSSL supports SNI since 0.9.8f version if it was built with config option
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	408 <nobr>“--enable-tlsext”.</nobr>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	409 Since OpenSSL 0.9.8j this option is enabled by default.
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	410 If nginx was built with SNI support, then nginx will show this
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	411 when run with the “-V” switch:
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	412
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	413 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	414 $ nginx -V
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	415 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	416 TLS SNI support enabled
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	417 ...
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	418 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	419
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	420 However, if the SNI-enabled nginx is linked dynamically to
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	421 an OpenSSL library without SNI support, nginx displays the warning:
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	422
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	423 <programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	424 nginx was built with SNI support, however, now it is linked
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	425 dynamically to an OpenSSL library which has no tlsext support,
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	426 therefore SNI is not available
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	427 </programlisting>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	428 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	429
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	430 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	431
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	432 </section>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	433
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	434
121 49443032011c Unified <section> syntax for "article" and "module" documents. Ruslan Ermilov <ru@nginx.com> parents: 98 diff changeset	435 <section id="compatibility" name="Compatibility">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	436
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	437 <para>
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	438 <list type="bullet">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	439
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	440 <listitem>
660 ba45bd0fc71e configuring_https_servers: markup changes (mostly). Ruslan Ermilov <ru@nginx.com> parents: 659 diff changeset	441 The SNI support status has been shown by the “-V” switch
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	442 since 0.8.21 and 0.7.62.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	443 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	444
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	445 <listitem>
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	446 The <literal>ssl</literal> parameter of the
4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	447 <link doc="ngx_http_core_module.xml" id="listen"/>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	448 directive has been supported since 0.7.14.
801 b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	449 Prior to 0.8.21 it could only be specified along with the
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on". Ruslan Ermilov <ru@nginx.com> parents: 782 diff changeset	450 <literal>default</literal> parameter.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	451 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	452
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	453 <listitem>
1757 40e461a34187 Fixed a typo in nginx version number. Valentin Bartenev <vbart@nginx.com> parents: 1733 diff changeset	454 SNI has been supported since 0.5.23.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	455 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	456
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	457 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	458 The shared SSL session cache has been supported since 0.5.6.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	459 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	460
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	461 </list>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	462 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	463
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	464 <para>
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	465 <list type="bullet">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	466
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	467 <listitem>
1499 3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	468 Version 1.9.1 and later: the default SSL protocols are TLSv1,
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	469 TLSv1.1, and TLSv1.2 (if supported by the OpenSSL library).
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	470 </listitem>
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	471
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends. Yaroslav Zhuravlev <yar@nginx.com> parents: 1411 diff changeset	472 <listitem>
314 95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the Ruslan Ermilov <ru@nginx.com> parents: 271 diff changeset	473 Version 0.7.65, 0.8.19 and later: the default SSL protocols are SSLv3, TLSv1,
95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the Ruslan Ermilov <ru@nginx.com> parents: 271 diff changeset	474 TLSv1.1, and TLSv1.2 (if supported by the OpenSSL library).
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	475 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	476
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	477 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	478 Version 0.7.64, 0.8.18 and earlier: the default SSL protocols are SSLv2,
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	479 SSLv3, and TLSv1.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	480 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	481
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	482 </list>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	483 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	484
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	485 <para>
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	486 <list type="bullet">
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	487
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	488 <listitem>
43 662995d3e647 Update of SSL ciphers in latest nginx versions. Igor Sysoev <igor@sysoev.ru> parents: 42 diff changeset	489 Version 1.0.5 and later: the default SSL ciphers are
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	490 “<literal>HIGH:!aNULL:!MD5</literal>”.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	491 </listitem>
43 662995d3e647 Update of SSL ciphers in latest nginx versions. Igor Sysoev <igor@sysoev.ru> parents: 42 diff changeset	492
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	493 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	494 Version 0.7.65, 0.8.20 and later: the default SSL ciphers are
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	495 “<literal>HIGH:!ADH:!MD5</literal>”.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	496 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	497
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	498 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	499 Version 0.8.19: the default SSL ciphers are
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	500 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	501 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	502
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	503 <listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	504 Version 0.7.64, 0.8.18 and earlier: the default SSL ciphers are<br/>
271 4c6d2c614d2c Cleaned up XML tag mess: Ruslan Ermilov <ru@nginx.com> parents: 266 diff changeset	505 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”.
461 6135f3c95bf6 Unified markup for lists. Ruslan Ermilov <ru@nginx.com> parents: 393 diff changeset	506 </listitem>
0 61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	507
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	508 </list>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	509 </para>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	510
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	511
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	512 </section>
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	513
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	514
61e04fc01027 Initial import of the nginx.org website. Ruslan Ermilov <ru@nginx.com> parents: diff changeset	515 </article>

Mercurial > hg > nginx-site

annotate xml/en/docs/http/configuring_https_servers.xml @ 1757:40e461a34187