Mercurial > hg > nginx-site

annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 1706:6f5497797cde

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Changed "EDH ciphers" to "DHE ciphers". These are synonyms and both mean "ephemeral Diffie-Hellman", though "DHE" is a variant preferred by relevant standards and recent versions of OpenSSL. It is also in line with "ECDHE" used elsewhere. Additionally, incorrect wording fixed in Russian descriptions.
author Maxim Dounin <mdounin@mdounin.ru>
date Tue, 24 May 2016 22:00:38 +0300
parents 3687cc9a3592
children 38fb3e6b71e8
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
1 <?xml version="1.0"?>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
2
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
3 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
4 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
5 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
6 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 538
diff changeset
7
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 <module name="Module ngx_http_ssl_module"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 link="/en/docs/http/ngx_http_ssl_module.html"
589
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
12 lang="en"
1706
6f5497797cde Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents: 1499
diff changeset
13 rev="20">
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 <section id="summary">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 The <literal>ngx_http_ssl_module</literal> module provides the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 necessary support for HTTPS.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 This module is not built by default, it should be enabled with the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24 <literal>--with-http_ssl_module</literal>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 configuration parameter.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26 <note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 This module requires the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28 <link url="http://www.openssl.org">OpenSSL</link> library.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
29 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 <section id="example" name="Example Configuration">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 To reduce the processor load it is recommended to
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39 <list type="bullet">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 set the number of worker processes equal to the number of processors,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 enable keep-alive connections,
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49 <listitem>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
50 enable the shared session cache,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 <listitem>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
54 disable the built-in session cache,
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 <listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 and possibly increase the session lifetime (by default, 5 minutes):
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 </listitem>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
63 <example>
817
4fecf0715bbf Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents: 801
diff changeset
64 <emphasis>worker_processes auto;</emphasis>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 http {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70 server {
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
71 listen 443 ssl;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72 <emphasis>keepalive_timeout 70;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73
1411
8fe28c6edaa1 Removed SSLv3 from ssl_protocols parameters list as insecure example.
Sergey Budnevitch <sb@waeme.net>
parents: 1239
diff changeset
74 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 ssl_certificate /usr/local/nginx/conf/cert.pem;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 ssl_certificate_key /usr/local/nginx/conf/cert.key;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 <emphasis>ssl_session_timeout 10m;</emphasis>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 <section id="directives" name="Directives">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 <directive name="ssl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 Enables the HTTPS protocol for the given virtual server.
801
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
99 <note>
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
100 It is recommended to use the <literal>ssl</literal> parameter of the
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
101 <link doc="ngx_http_core_module.xml" id="listen"/> directive instead
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
102 of this directive.
b95a6d779c89 Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents: 763
diff changeset
103 </note>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108
1039
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
109 <directive name="ssl_buffer_size">
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
110 <syntax><value>size</value></syntax>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
111 <default>16k</default>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
112 <context>http</context>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
113 <context>server</context>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
114 <appeared-in>1.5.9</appeared-in>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
115
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
116 <para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
117 Sets the size of the buffer used for sending data.
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
118 </para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
119
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
120 <para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
121 By default, the buffer size is 16k, which corresponds to minimal
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
122 overhead when sending big responses.
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
123 To minimize Time To First Byte it may be beneficial to use smaller values,
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
124 for example:
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
125 <example>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
126 ssl_buffer_size 4k;
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
127 </example>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
128 </para>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
129
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
130 </directive>
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
131
f7ca80263893 Documented the "ssl_buffer_size" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1019
diff changeset
132
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 <directive name="ssl_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
140 Specifies a <value>file</value> with the certificate in the PEM format
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 for the given virtual server.
1457
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
142 If intermediate certificates should be specified in addition to a primary
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
143 certificate, they should be specified in the same file in the following
78ccd1af1400 Minimized diffs between http, mail, and stream.
Ruslan Ermilov <ru@nginx.com>
parents: 1456
diff changeset
144 order: the primary certificate comes first, then the intermediate certificates.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 A secret key in the PEM format may be placed in the same file.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 It should be kept in mind that due to the HTTPS protocol limitations
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150 virtual servers should listen on different IP addresses:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 listen 192.168.1.1:443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 server_name one.example.com;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 ssl_certificate /usr/local/nginx/conf/one.example.com.cert;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 server {
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160 listen 192.168.1.2:443;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 server_name two.example.com;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 ssl_certificate /usr/local/nginx/conf/two.example.com.cert;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 ...
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164 }
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166 otherwise
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 <link doc="configuring_https_servers.xml"
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 id="name_based_https_servers">the first server’s certificate</link>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 will be issued for the second site.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 <directive name="ssl_certificate_key">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
182 Specifies a <value>file</value> with the secret key in the PEM format
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183 for the given virtual server.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185
1456
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
186 <para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
187 The value
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
188 <literal>engine</literal>:<value>name</value>:<value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
189 can be specified instead of the <value>file</value> (1.7.9),
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
190 which loads a secret key with a specified <value>id</value>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
191 from the OpenSSL engine <value>name</value>.
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
192 </para>
acba294382d6 Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1428
diff changeset
193
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197 <directive name="ssl_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 <syntax><value>ciphers</value></syntax>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
199 <default>HIGH:!aNULL:!MD5</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
202
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204 Specifies the enabled ciphers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205 The ciphers are specified in the format understood by the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206 OpenSSL library, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 <example>
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
208 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213 The full list can be viewed using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 “<command>openssl ciphers</command>” command.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216
538
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
217 <para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
218 <note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
219 The previous versions of nginx used
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
220 <link doc="configuring_https_servers.xml" id="compatibility">different</link>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
221 ciphers by default.
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
222 </note>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
223 </para>
58dd64aef626 Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
224
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
226
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228 <directive name="ssl_client_certificate">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
232 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
233
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
234 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
235 Specifies a <value>file</value> with trusted CA certificates in the PEM format
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
236 used to <link id="ssl_verify_client">verify</link> client certificates and
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
237 OCSP responses if <link id="ssl_stapling"/> is enabled.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
238 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
239
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
240 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
241 The list of certificates will be sent to clients.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
242 If this is not desired, the <link id="ssl_trusted_certificate"/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
243 directive can be used.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
246 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249 <directive name="ssl_crl">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 <appeared-in>0.8.7</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
257 Specifies a <value>file</value> with revoked certificates (CRL)
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
258 in the PEM format used to <link id="ssl_verify_client">verify</link>
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
259 client certificates.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 <directive name="ssl_dhparam">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266 <syntax><value>file</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
267 <default/>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 <appeared-in>0.7.2</appeared-in>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 <para>
1706
6f5497797cde Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents: 1499
diff changeset
273 Specifies a <value>file</value> with DH parameters for DHE ciphers.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278
1054
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
279 <directive name="ssl_ecdh_curve">
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
280 <syntax><value>curve</value></syntax>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
281 <default>prime256v1</default>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
282 <context>http</context>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
283 <context>server</context>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
284 <appeared-in>1.1.0</appeared-in>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
285 <appeared-in>1.0.6</appeared-in>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
286
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
287 <para>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
288 Specifies a <value>curve</value> for ECDHE ciphers.
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
289 </para>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
290
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
291 </directive>
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
292
c5793e5c30d4 Documented the "ssl_ecdh_curve" directive.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1039
diff changeset
293
1239
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
294 <directive name="ssl_password_file">
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
295 <syntax><value>file</value></syntax>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
296 <default/>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
297 <context>http</context>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
298 <context>server</context>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
299 <appeared-in>1.7.3</appeared-in>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
300
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
301 <para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
302 Specifies a <value>file</value> with passphrases for
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
303 <link id="ssl_certificate_key">secret keys</link>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
304 where each passphrase is specified on a separate line.
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
305 Passphrases are tried in turn when loading the key.
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
306 </para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
307
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
308 <para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
309 Example:
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
310 <example>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
311 http {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
312 ssl_password_file /etc/keys/global.pass;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
313 ...
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
314
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
315 server {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
316 server_name www1.example.com;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
317 ssl_certificate_key /etc/keys/first.key;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
318 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
319
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
320 server {
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
321 server_name www2.example.com;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
322
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
323 # named pipe can also be used instead of a file
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
324 ssl_password_file /etc/keys/fifo;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
325 ssl_certificate_key /etc/keys/second.key;
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
326 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
327 }
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
328 </example>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
329 </para>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
330
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
331 </directive>
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
332
35cf5dca5fa4 SSL: added the ssl_password_file directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1201
diff changeset
333
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334 <directive name="ssl_prefer_server_ciphers">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335 <syntax><literal>on</literal> | <literal>off</literal></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341 Specifies that server ciphers should be preferred over client
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
342 ciphers when using the SSLv3 and TLS protocols.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348 <directive name="ssl_protocols">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350 [<literal>SSLv2</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 [<literal>SSLv3</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352 [<literal>TLSv1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 [<literal>TLSv1.1</literal>]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 [<literal>TLSv1.2</literal>]</syntax>
1499
3687cc9a3592 Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1457
diff changeset
355 <default>TLSv1 TLSv1.1 TLSv1.2</default>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360 Enables the specified protocols.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
361 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters work
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
362 only when the OpenSSL library of version 1.0.1 or higher is used.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363 <note>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
364 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters are
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
365 supported starting from versions 1.1.13 and 1.0.12,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
366 so when the OpenSSL version 1.0.1 or higher
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
367 is used on older nginx versions, these protocols work, but cannot
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 be disabled.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369 </note>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 <directive name="ssl_session_cache">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 <literal>off</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 <literal>none</literal> |
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 [<literal>builtin</literal>[:<value>size</value>]]
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381 <default>none</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
386 Sets the types and sizes of caches that store session parameters.
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
387 A cache can be of any of the following types:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 <tag-name><literal>off</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
392 the use of a session cache is strictly prohibited:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393 nginx explicitly tells a client that sessions may not be reused.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 <tag-name><literal>none</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
398 the use of a session cache is gently disallowed:
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 nginx tells a client that sessions may be reused, but does not
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
400 actually store session parameters in the cache.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 <tag-name><literal>builtin</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 a cache built in OpenSSL; used by one worker process only.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 The cache size is specified in sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 If size is not given, it is equal to 20480 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 Use of the built-in cache can cause memory fragmentation.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 <tag-name><literal>shared</literal></tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
413 a cache shared between all worker processes.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 The cache size is specified in bytes; one megabyte can store
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 about 4000 sessions.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 Each shared cache should have an arbitrary name.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 A cache with the same name can be used in several virtual servers.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
421 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
422
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 Both cache types can be used simultaneously, for example:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425 <example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 ssl_session_cache builtin:1000 shared:SSL:10m;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427 </example>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 but using only shared cache without the built-in cache should
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 be more efficient.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
435 <directive name="ssl_session_ticket_key">
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
436 <syntax><value>file</value></syntax>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
437 <default/>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
438 <context>http</context>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
439 <context>server</context>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
440 <appeared-in>1.5.7</appeared-in>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
441
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
442 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
443 Sets a <value>file</value> with the secret key used to encrypt
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
444 and decrypt TLS session tickets.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
445 The directive is necessary if the same key has to be shared between
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
446 multiple servers.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
447 By default, a randomly generated key is used.
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
448 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
449
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
450 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
451 If several keys are specified, only the first key is
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
452 used to encrypt TLS session tickets.
1144
ac131944d349 Changed infinitive to gerund after "allow".
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1072
diff changeset
453 This allows configuring key rotation, for example:
1019
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
454 <example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
455 ssl_session_ticket_key current.key;
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
456 ssl_session_ticket_key previous.key;
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
457 </example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
458 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
459
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
460 <para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
461 The <value>file</value> must contain 48 bytes of random data and can
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
462 be created using the following command:
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
463 <example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
464 openssl rand 48 > ticket.key
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
465 </example>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
466 </para>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
467
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
468 </directive>
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
469
2b6a858c60dc Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents: 966
diff changeset
470
1055
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
471 <directive name="ssl_session_tickets">
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
472 <syntax><literal>on</literal> | <literal>off</literal></syntax>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
473 <default>on</default>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
474 <context>http</context>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
475 <context>server</context>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
476 <appeared-in>1.5.9</appeared-in>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
477
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
478 <para>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
479 Enables or disables session resumption through
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
480 <link url="http://tools.ietf.org/html/rfc5077">TLS session tickets</link>.
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
481 </para>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
482
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
483 </directive>
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
484
e26a9f598e40 Documented the "ssl_session_tickets" directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1054
diff changeset
485
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 <directive name="ssl_session_timeout">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487 <syntax><value>time</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 <default>5m</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
489 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
491
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
492 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493 Specifies a time during which a client may reuse the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
494 session parameters stored in a cache.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
496
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
497 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
498
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
499
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
500 <directive name="ssl_stapling">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
501 <syntax><literal>on</literal> | <literal>off</literal></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
502 <default>off</default>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
503 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
504 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
505 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
506
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
507 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
508 Enables or disables
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
509 <link url="http://tools.ietf.org/html/rfc4366#section-3.6">stapling
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
510 of OCSP responses</link> by the server.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
511 Example:
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
512 <example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
513 ssl_stapling on;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
514 resolver 192.0.2.1;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
515 </example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
516 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
517
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
518 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
519 For the OCSP stapling to work, the certificate of the server certificate
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
520 issuer should be known.
712
2c9e8facc761 Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents: 696
diff changeset
521 If the <link id="ssl_certificate"/> file does
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
522 not contain intermediate certificates,
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
523 the certificate of the server certificate issuer should be
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
524 present in the
712
2c9e8facc761 Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents: 696
diff changeset
525 <link id="ssl_trusted_certificate"/> file.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
526 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
527
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
528 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
529 For a resolution of the OCSP responder hostname,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
530 the <link doc="ngx_http_core_module.xml" id="resolver"/> directive
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
531 should also be specified.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
532 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
533
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
534 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
535
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
536
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
537 <directive name="ssl_stapling_file">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
538 <syntax><value>file</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
539 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
540 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
541 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
542 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
543
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
544 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
545 When set, the stapled OCSP response will be taken from the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
546 specified <value>file</value> instead of querying
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
547 the OCSP responder specified in the server certificate.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
548 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
549
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
550 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
551 The file should be in the DER format as produced by the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
552 “<literal>openssl ocsp</literal>” command.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
553 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
554
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
555 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
556
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
557
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
558 <directive name="ssl_stapling_responder">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
559 <syntax><value>url</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
560 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
561 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
562 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
563 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
564
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
565 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
566 Overrides the URL of the OCSP responder specified in the
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
567 “<link url="http://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
568 Information Access</link>” certificate extension.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
569 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
570
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
571 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
572 Only “<literal>http://</literal>” OCSP responders are supported:
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
573 <example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
574 ssl_stapling_responder http://ocsp.example.com/;
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
575 </example>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
576 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
577
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
578 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
579
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
580
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
581 <directive name="ssl_stapling_verify">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
582 <syntax><literal>on</literal> | <literal>off</literal></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
583 <default>off</default>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
584 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
585 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
586 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
587
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
588 <para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
589 Enables or disables verification of OCSP responses by the server.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
590 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
591
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
592 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
593 For verification to work, the certificate of the server certificate
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
594 issuer, the root certificate, and all intermediate certificates
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
595 should be configured as trusted using the
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
596 <link id="ssl_trusted_certificate"/> directive.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
597 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
598
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
599 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
600
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
601
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
602 <directive name="ssl_trusted_certificate">
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
603 <syntax><value>file</value></syntax>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
604 <default/>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
605 <context>http</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
606 <context>server</context>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
607 <appeared-in>1.3.7</appeared-in>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
608
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
609 <para>
715
3f25469cbc49 Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents: 712
diff changeset
610 Specifies a <value>file</value> with trusted CA certificates in the PEM format
1428
933831d7bf0b Link to "ssl_verify_client" from client certificate directives.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1411
diff changeset
611 used to <link id="ssl_verify_client">verify</link> client certificates and
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
612 OCSP responses if <link id="ssl_stapling"/> is enabled.
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
613 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
614
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
615 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
616 In contrast to the certificate set by <link id="ssl_client_certificate"/>,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
617 the list of these certificates will not be sent to clients.
695
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
618 </para>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
619
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
620 </directive>
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
621
2eb83e89b239 Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents: 589
diff changeset
622
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
623 <directive name="ssl_verify_client">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
624 <syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
625 <literal>on</literal> | <literal>off</literal> |
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
626 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
627 <default>off</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
628 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
629 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
630
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
631 <para>
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
632 Enables verification of client certificates.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
633 The verification result is stored in the
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
634 <var>$ssl_client_verify</var> variable.
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
635 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
636
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
637 <para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
638 The <literal>optional</literal> parameter (0.8.7+) requests the client
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
639 certificate and verifies it if the certificate is present.
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
640 </para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
641
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
642 <para>
763
cd581dbdaf76 The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents: 717
diff changeset
643 The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5)
cd581dbdaf76 The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents: 717
diff changeset
644 requests the client
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
645 certificate but does not require it to be signed by a trusted CA certificate.
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
646 This is intended for the use in cases when a service that is external to nginx
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
647 performs the actual certificate verification.
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
648 The contents of the certificate is accessible through the
717
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
649 <var>$ssl_client_cert</var> variable.
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
650 </para>
c5facf2eff6f Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents: 715
diff changeset
651
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
652 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
653
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
654
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
655 <directive name="ssl_verify_depth">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
656 <syntax><value>number</value></syntax>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
657 <default>1</default>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
658 <context>http</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
659 <context>server</context>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
660
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
661 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
662 Sets the verification depth in the client certificates chain.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
663 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
664
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
665 </directive>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
666
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
667 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
668
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
669
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
670 <section id="errors" name="Error Processing">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
671
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
672 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
673 The <literal>ngx_http_ssl_module</literal> module supports several
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
674 non-standard error codes that can be used for redirects using the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
675 <link doc="ngx_http_core_module.xml" id="error_page"/> directive:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
676 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
677
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
678 <tag-name>495</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
679 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
680 an error has occurred during the client certificate verification;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
681 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
682
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
683 <tag-name>496</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
684 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
685 a client has not presented the required certificate;
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
686 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
687
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
688 <tag-name>497</tag-name>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
689 <tag-desc>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
690 a regular request has been sent to the HTTPS port.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
691 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
692
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
693 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
694 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
695
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
696 <para>
966
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
697 The redirection happens after the request is fully parsed and
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
698 the variables, such as <var>$request_uri</var>,
95c3c3bbf1ce Text review.
Egor Nikitin <yegor.nikitin@gmail.com>
parents: 881
diff changeset
699 <var>$uri</var>, <var>$args</var> and others, are available.
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
700 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
701
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
702 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
703
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
704
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
705 <section id="variables" name="Embedded Variables">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
706
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
707 <para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
708 The <literal>ngx_http_ssl_module</literal> module supports
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
709 several embedded variables:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
710 <list type="tag">
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
711
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
712 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
713 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
714 returns the string of ciphers used
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
715 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
716 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
717
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
718 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
719 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
720 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
721 for an established SSL connection, with each line except the first
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
722 prepended with the tab character;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
723 this is intended for the use in the
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
724 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
725 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
726
1201
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
727 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
728 <tag-desc>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
729 returns the SHA1 fingerprint of the client certificate
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
730 for an established SSL connection (1.7.1);
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
731 </tag-desc>
db4b017b5796 SSL: documented the ssl_client_fingerprint variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1167
diff changeset
732
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
733 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var>
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
734 </tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
735 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
736 returns the client certificate in the PEM format
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
737 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
738 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
739
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
740 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
741 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
742 returns the serial number of the client certificate
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
743 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
744 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
745
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
746 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
747 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
748 returns the “subject DN” string of the client certificate
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
749 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
750 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
751
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
752 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
753 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
754 returns the “issuer DN” string of the client certificate
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
755 for an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
756 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
757
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
758 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
759 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
760 returns the result of client certificate verification:
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
761 “<literal>SUCCESS</literal>”, “<literal>FAILED</literal>”, and
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
762 “<literal>NONE</literal>” if a certificate was not present;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
763 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
764
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
765 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
766 <tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
767 returns the protocol of an established SSL connection;
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
768 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
769
1167
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
770 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
771 <tag-desc>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
772 returns the server name requested through
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
773 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
774 (1.7.0);
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
775 </tag-desc>
cac06b81957c Documented the $ssl_server_name variable.
Ruslan Ermilov <ru@nginx.com>
parents: 1155
diff changeset
776
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
777 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name>
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
778 <tag-desc>
1072
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
779 returns the session identifier of an established SSL connection;
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
780 </tag-desc>
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
781
1155
07402a11fd8d Assigned IDs to tags describing variables.
Vladimir Homutov <vl@nginx.com>
parents: 1144
diff changeset
782 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name>
1072
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
783 <tag-desc>
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
784 returns “<literal>r</literal>” if an SSL session was reused,
502f4be2d62e Documented the "ssl_session_reused" variable.
Yaroslav Zhuravlev <yar@nginx.com>
parents: 1055
diff changeset
785 or “<literal>.</literal>” otherwise (1.5.11).
384
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
786 </tag-desc>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
787
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
788 </list>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
789 </para>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
790
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
791 </section>
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
792
331a86bc51ff English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
793 </module>