Mercurial > hg > nginx-site
annotate xml/cn/docs/http/configuring_https_servers.xml @ 2768:9dd8c203a54a
Updated docs for the upcoming NGINX Plus release.
author | Yaroslav Zhuravlev <yar@nginx.com> |
---|---|
date | Wed, 22 Sep 2021 13:47:23 +0300 |
parents | 9934338f83af |
children |
rev | line source |
---|---|
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
1 <!-- |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
2 Copyright (C) Igor Sysoev |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
3 Copyright (C) Nginx, Inc. |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
4 --> |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
5 |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd"> |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
7 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 <article name="配置HTTPS服务器" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 link="/cn/docs/http/configuring_https_servers.html" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 lang="cn" |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
11 rev="3" |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
12 translator="cfsego" |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
13 author="Igor Sysoev" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 editor="Brian Mercer"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 <section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
17 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
18 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
19 配置HTTPS主机,必须在server配置块中打开SSL协议,还需要指定服务器端证书和密钥文件的位置: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
20 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
21 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
22 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
23 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
24 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
25 ssl <b>on</b>; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
26 ssl_certificate <b>www.example.com.crt</b>; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
27 ssl_certificate_key <b>www.example.com.key</b>; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
28 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
29 ssl_ciphers HIGH:!aNULL:!MD5; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
30 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
31 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
32 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
33 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
34 服务器证书是公开的,会被传送到每一个连接到服务器的客户端。而私钥不是公开的,需要存放在访问受限的文件中,当然,nginx主进程必须有读取密钥的权限。私钥和证书可以存放在同一个文件中: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
35 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
36 <programlisting> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
37 ssl_certificate www.example.com.cert; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
38 ssl_certificate_key www.example.com.cert; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
39 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
40 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
41 这种情况下,证书文件同样得设置访问限制。当然,虽然证书和密钥存放在同一个文件,只有证书会发送给客户端,密钥不会发送。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
42 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
43 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
44 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
45 <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/>和<link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>指令可以用来强制用户连接只能引入SSL/TLS那些强壮的协议版本和强大的加密算法。从1.0.5版本开始,nginx默认使用“<literal>ssl_protocols SSLv3 TLSv1</literal>”和“<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”,所以只有在之前的版本,明确地配置它们才是有意义的。从1.1.13和1.0.12版本开始,nginx默认使用“<literal>ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2</literal>”。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
46 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
47 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
48 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
49 CBC模式的加密算法容易受到一些攻击,尤其是BEAST攻击(参见<link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>)。可以通过下面配置调整为优先使用RC4-SHA加密算法: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
50 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
51 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
52 ssl_ciphers RC4:HIGH:!aNULL:!MD5; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
53 ssl_prefer_server_ciphers on; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
54 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
55 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
56 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
57 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
58 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
59 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
60 <section id="optimization" name="HTTPS服务器优化"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
61 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
62 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
63 SSL操作需要消耗CPU资源,所以在多处理器的系统,需要启动多个工作进程,而且数量需要不少于可用CPU的个数。最消耗CPU资源的SSL操作是SSL握手,有两种方法可以将每个客户端的握手操作数量降到最低:第一种是保持客户端长连接,在一个SSL连接发送多个请求,第二种是在并发的连接或者后续的连接中重用SSL会话参数,这样可以避免SSL握手的操作。会话缓存用于保存SSL会话,这些缓存在工作进程间共享,可以使用<link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>指令进行配置。1M缓存可以存放大约4000个会话。默认的缓存超时是5分钟,可以使用<link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>加大它。下面是一个针对4核系统的配置优化的例子,使用10M的共享会话缓存: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
64 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
65 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
66 <b>worker_processes 4</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
67 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
68 http { |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
69 <b>ssl_session_cache shared:SSL:10m</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
70 <b>ssl_session_timeout 10m</b>; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
71 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
72 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
73 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
74 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
75 <b>keepalive_timeout 70</b>; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
76 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
77 ssl on; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
78 ssl_certificate www.example.com.crt; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
79 ssl_certificate_key www.example.com.key; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
80 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
81 ssl_ciphers HIGH:!aNULL:!MD5; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
89 <section id="chains" name="SSL证书链"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
90 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 有些浏览器不接受那些众所周知的证书认证机构签署的证书,而另外一些浏览器却接受它们。这是由于证书签发使用了一些中间认证机构,这些中间机构被众所周知的证书认证机构授权代为签发证书,但是它们自己却不被广泛认知,所以有些客户端不予识别。针对这种情况,证书认证机构提供一个证书链的包裹,用来声明众所周知的认证机构和自己的关系,需要将这个证书链包裹与服务器证书合并成一个文件。在这个文件里,服务器证书需要出现在认证方证书链的前面: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 <programlisting> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
95 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
97 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
98 这个文件需要使用<link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>指令来引用: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
99 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
100 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
101 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
102 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
103 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
104 ssl on; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
105 ssl_certificate www.example.com.chained.crt; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
106 ssl_certificate_key www.example.com.key; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
107 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
108 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
109 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
110 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
111 如果服务器证书和认证方证书链合并时顺序弄错了,nginx就不能正常启动,而且会显示下面的错误信息: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
112 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
113 <programlisting> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
114 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
115 (SSL: error:0B080074:x509 certificate routines: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
116 X509_check_private_key:key values mismatch) |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
117 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
118 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
119 因为nginx首先需要用私钥去解密服务器证书,而遇到的却是认证方的证书。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
120 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
121 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
122 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
123 浏览器通常会将那些被受信的认证机构认证的中间认证机构保存下来,那么这些浏览器以后在遇到使用这些中间认证机构但不包含证书链的情况时,因为已经保存了这些中间认证机构的信息,所以不会报错。可以使用<command>openssl</command>命令行工具来确认服务器发送了完整的证书链: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
124 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
125 $ openssl s_client -connect www.godaddy.com:443 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
126 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
127 Certificate chain |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
128 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
129 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
130 /OU=MIS Department/<b>CN=www.GoDaddy.com</b> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
131 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b) |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
132 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
133 /OU=http://certificates.godaddy.com/repository |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
134 /CN=Go Daddy Secure Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
135 /serialNumber=07969287 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
136 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
137 /OU=http://certificates.godaddy.com/repository |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
138 /CN=Go Daddy Secure Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
139 /serialNumber=07969287 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
140 i:/C=US/O=The Go Daddy Group, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 /OU=Go Daddy Class 2 Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 2 s:/C=US/O=The Go Daddy Group, Inc. |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
143 /OU=Go Daddy Class 2 Certification Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
145 /OU=ValiCert Class 2 Policy Validation Authority |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
146 /CN=http://www.valicert.com//emailAddress=info@valicert.com |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
147 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
150 在这个例子中,www.GoDaddy.com的服务器证书(#0)的受签者(“s”)是被签发机构(“i”)签名的,而这个签发机构又是证书(#1)的受签者,接着证书(#1)的签发机构又是证书(#2)的受签者,最后证书(#2)是被众所周知的签发机构ValiCert, Inc签发。ValiCert, Inc的证书内嵌在浏览器中,被浏览器自动识别(这段话神似英国诗《在Jack盖的房子里》里面的内容)。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
151 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
152 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
153 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
154 如果没有加入认证方证书链,就只会显示服务器证书(#0)。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
155 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
156 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
157 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
158 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
159 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
160 <section id="single_http_https_server" name="合并HTTP/HTTPS主机"> |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
161 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
162 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
163 如果HTTP和HTTPS虚拟主机的功能是一致的,可以配置一个虚拟主机,既处理HTTP请求,又处理HTTPS请求。 |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
164 配置的方法是删除<literal>ssl on</literal>的指令,并在*:443端口添加参数<literal>ssl</literal>: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
165 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
166 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
167 listen 80; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
168 listen 443 ssl; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
169 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
170 ssl_certificate www.example.com.crt; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
171 ssl_certificate_key www.example.com.key; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
172 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
173 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
174 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
175 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
176 <note> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
177 在0.8.21版本以前,只有添加了<literal>default</literal>参数的监听端口才能添加<literal>ssl</literal>参数: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
178 <programlisting> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
179 listen 443 default ssl; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
180 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
181 </note> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
182 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
183 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
184 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
185 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
186 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
187 <section id="name_based_https_servers" name="基于名字的HTTPS主机"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
188 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
189 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
190 如果在同一个IP上配置多个HTTPS主机,会出现一个很普遍的问题: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
191 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
192 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
193 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
194 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
195 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
196 ssl on; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
197 ssl_certificate www.example.com.crt; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
198 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
199 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
200 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
201 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
202 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
203 server_name www.example.org; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
204 ssl on; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
205 ssl_certificate www.example.org.crt; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
206 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
207 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
208 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
209 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
210 使用上面的配置,不论浏览器请求哪个主机,都只会收到默认主机<literal>www.example.com</literal>的证书。这是由SSL协议本身的行为引起的——先建立SSL连接,再发送HTTP请求,所以nginx建立SSL连接时不知道所请求主机的名字,因此,它只会返回默认主机的证书。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
211 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
212 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
213 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 最古老的也是最稳定的解决方法就是每个HTTPS主机使用不同的IP地址: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
217 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
218 listen 192.168.1.1:443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
219 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
220 ssl on; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
221 ssl_certificate www.example.com.crt; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
222 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
223 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
224 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
225 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
226 listen 192.168.1.2:443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
227 server_name www.example.org; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
228 ssl on; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
229 ssl_certificate www.example.org.crt; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
230 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
231 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
232 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
233 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
234 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
235 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
236 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
237 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
238 <section id="certificate_with_several_names" |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
239 name="带有多个主机名的SSL证书"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
240 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
241 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
242 也有其他一些方法可以实现多个HTTPS主机共享一个IP地址,但都有不足。其中一种方法是使用在“SubjectAltName”字段中存放多个名字的证书,比如<literal>www.example.com</literal>和<literal>www.example.org</literal>。但是,“SubjectAltName”字段的长度有限制。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
243 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
244 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
245 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
246 另一种方式是使用主机名中含有通配符的证书,比如<literal>*.example.org</literal>。这个证书匹配<literal>www.example.org</literal>,但是不匹配<literal>example.org</literal>和<literal>www.sub.example.org</literal>。这两种方法可以结合在一起——使用在“SubjectAltName”字段中存放的多个名字的证书,这些名字既可以是确切的名字,也可以是通配符,比如<literal>example.org</literal>和<literal>*.example.org</literal>。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
247 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
248 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
249 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
250 最好将带有多个名字的证书和它的密钥文件配置在<i>http</i>配置块中,这样可以只保存一份内容拷贝,所有主机的配置都从中继承: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
251 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
253 ssl_certificate common.crt; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
254 ssl_certificate_key common.key; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
257 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
258 server_name www.example.com; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
259 ssl on; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 server { |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
264 listen 443; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
265 server_name www.example.org; |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
266 ssl on; |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
267 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
268 } |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
269 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
270 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
271 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
272 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
273 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
274 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
275 <section id="sni" name="主机名指示"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
277 <para> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
278 在一个IP上运行多个HTTPS主机的更通用的方案是<link url="http://en.wikipedia.org/wiki/Server_Name_Indication">TLS主机名指示扩展</link>(SNI,RFC6066),它允许浏览器和服务器进行SSL握手时,将请求的主机名传递给服务器,因此服务器可以知道使用哪一个证书来服务这个连接。但SNI只得到有限的浏览器的支持。下面列举支持SNI的浏览器最低版本和平台信息: |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
279 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
280 |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
281 <para> |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
285 Opera 8.0; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
286 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
287 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
288 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
289 MSIE 7.0(仅在Windows Vista操作系统及后续操作系统); |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
290 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
291 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
292 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
293 Firefox 2.0和使用Mozilla平台1.8.1版本的其他浏览器; |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
294 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
295 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
296 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 Safari 3.2.1(Windows版需要最低Vista操作系统); |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
299 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
300 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
301 Chrome(Windows版需要最低Vista操作系统)。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
302 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
303 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
304 </list> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
305 <note> |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
306 通过SNI只能传递域名,但是,当请求中包含可读的IP地址时,某些浏览器将服务器的IP地址作为服务器的名字进行了传送。这是一个错误,大家不应该依赖于这个。 |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
307 </note> |
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
308 </para> |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
309 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
310 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
311 为了在nginx中使用SNI,那么无论是在编译nginx时使用的OpenSSL类库,还是在运行nginx时使用的OpenSSL运行库,都必须支持SNI。从0.9.8f版本开始,OpenSSL通过<nobr>“--enable-tlsext”</nobr>配置选项加入SNI支持,从0.9.8j版本开始,此选项成为默认选项。当nginx被编译成支持SNI时,在使用“-V”选项运行时会显示如下信息: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
312 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
313 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
314 $ nginx -V |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
315 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
316 TLS SNI support enabled |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
317 ... |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
318 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
319 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
320 但是,当开启SNI支持的nginx被动态链接到不支持SNI的OpenSSL库上时,nginx会显示如下警告: |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
321 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
322 <programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
323 nginx was built with SNI support, however, now it is linked |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
324 dynamically to an OpenSSL library which has no tlsext support, |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
325 therefore SNI is not available |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
326 </programlisting> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
327 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
328 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
329 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
330 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
331 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
332 <section id="compatibility" name="兼容性"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
333 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
334 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
335 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
336 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
337 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
338 从0.8.21和0.7.62版本开始,使用“-V”选项运行nginx时,将显示SNI支持状态信息。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
339 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
340 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 <listitem> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
342 从0.7.14版本开始,<link doc="ngx_http_core_module.xml" id="listen"/>指令支持<literal>ssl</literal>参数。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
343 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
344 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
345 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
346 从0.5.32版本开始,支持SNI。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
347 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
348 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
349 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
350 从0.5.6版本开始,支持SSL会话缓存,并可在工作进程间共享。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
351 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
352 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
353 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
354 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
355 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
356 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
357 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
358 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
359 <listitem> |
720
9934338f83af
Updated the Chinese documentation.
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
360 0.7.65、0.8.19及以后版本,默认SSL协议是SSLv3、TLSv1、TLSc1.1和TLSv1.2(如果OpenSSL库支持)。 |
558
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
361 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
362 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
363 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
364 0.7.64、0.8.18及以前版本,默认SSL协议是SSLv2、SSLv3和TLSv1。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
365 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
366 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
367 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
368 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
369 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
370 <para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
371 <list type="bullet"> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
372 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
373 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
374 1.0.5及以后版本,默认SSL密码算法是<literal>HIGH:!aNULL:!MD5</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
375 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
376 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
377 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
378 0.7.65、0.8.20及以后版本,默认SSL密码算法是<literal>HIGH:!ADH:!MD5</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
379 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
380 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
381 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
382 0.8.19版本,默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
383 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
384 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
385 <listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
386 0.7.64、0.8.18及以前版本,默认SSL密码算法是<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>。 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
387 </listitem> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
388 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
389 </list> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
390 </para> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
391 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
392 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
393 </section> |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
394 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
395 |
149f54c158f0
Added initial translation in simplified Chinese submitted by the
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
396 </article> |