Mercurial > hg > nginx-site
annotate xml/ru/docs/http/ngx_http_ssl_module.xml @ 801:b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Thu, 27 Dec 2012 17:16:39 +0000 |
parents | cd581dbdaf76 |
children | 4fecf0715bbf |
rev | line source |
---|---|
222
bfe3eff81d04
Removed redundant encoding specification.
Ruslan Ermilov <ru@nginx.com>
parents:
110
diff
changeset
|
1 <?xml version="1.0"?> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
2 |
580
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
3 <!-- |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
4 Copyright (C) Igor Sysoev |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
5 Copyright (C) Nginx, Inc. |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
6 --> |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
7 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
9 |
379 | 10 <module name="Модуль ngx_http_ssl_module" |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
11 link="/ru/docs/http/ngx_http_ssl_module.html" |
589 | 12 lang="ru" |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
13 rev="6"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
14 |
110
40eec261c2a6
Added proper support for anonymous sections, notably for the summary.
Ruslan Ermilov <ru@nginx.com>
parents:
106
diff
changeset
|
15 <section id="summary"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
16 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
17 <para> |
379 | 18 Модуль <literal>ngx_http_ssl_module</literal> обеспечивает работу |
19 по протоколу HTTPS. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
20 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
21 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
22 <para> |
379 | 23 По умолчанию этот модуль не собирается, его сборку необходимо |
24 разрешить с помощью конфигурационного параметра | |
271 | 25 <literal>--with-http_ssl_module</literal>. |
379 | 26 <note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
27 Для сборки и работы этого модуля нужна библиотека |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
28 <link url="http://www.openssl.org">OpenSSL</link>. |
379 | 29 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
30 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
31 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
32 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
33 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
34 |
379 | 35 <section id="example" name="Пример конфигурации"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
36 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
37 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
38 Для уменьшения загрузки процессора рекомендуется |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
39 <list type="bullet"> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
40 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
41 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
42 установить число рабочих процессов равным числу процессоров, |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
43 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
44 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
45 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
46 разрешить keep-alive соединения, |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
47 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
48 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
49 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
50 включить разделяемый кэш сессий, |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
51 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
52 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
53 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
54 выключить встроенный кэш сессий |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
55 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
56 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
57 <listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
58 и, возможно, увеличить время жизни сессии (по умолчанию 5 минут): |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
59 </listitem> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
60 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
61 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
62 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
63 <example> |
379 | 64 <emphasis>worker_processes 2;</emphasis> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
65 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
66 http { |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
67 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
68 ... |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
69 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
70 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
71 listen 443 ssl; |
379 | 72 <emphasis>keepalive_timeout 70;</emphasis> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
73 |
379 | 74 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
75 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; | |
76 ssl_certificate /usr/local/nginx/conf/cert.pem; | |
77 ssl_certificate_key /usr/local/nginx/conf/cert.key; | |
78 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> | |
79 <emphasis>ssl_session_timeout 10m;</emphasis> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
80 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
81 ... |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
82 } |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
83 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
84 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
85 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
86 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
87 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
88 |
379 | 89 <section id="directives" name="Директивы"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
90 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
91 <directive name="ssl"> |
271 | 92 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
93 <default>off</default> |
379 | 94 <context>http</context> |
95 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
96 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
97 <para> |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
98 Включает протокол HTTPS для данного виртуального сервера. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
99 <note> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
100 Вместо этой директивы рекомендуется использовать параметр |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
101 <literal>ssl</literal> директивы |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
102 <link doc="ngx_http_core_module.xml" id="listen"/>. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
103 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
104 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
105 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
106 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
107 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
108 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
109 <directive name="ssl_certificate"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
110 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
111 <default/> |
379 | 112 <context>http</context> |
113 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
114 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
115 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
116 Указывает <value>файл</value> с сертификатом в формате PEM |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
117 для данного виртуального сервера. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
118 Если вместе с основным сертификатом нужно указать промежуточные, |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
119 то они должны находиться в этом же файле в следующем порядке: сначала |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
120 основной сертификат, а затем промежуточные. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
121 В этом же файле может находиться секретный ключ в формате PEM. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
122 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
123 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
124 <para> |
280 | 125 Нужно иметь в виду, что из-за ограничения протокола HTTPS |
379 | 126 виртуальные серверы должны слушать на разных IP-адресах: |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
127 <example> |
379 | 128 server { |
129 listen 192.168.1.1:443; | |
130 server_name one.example.com; | |
131 ssl_certificate /usr/local/nginx/conf/one.example.com.cert; | |
132 ... | |
133 } | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
134 |
379 | 135 server { |
136 listen 192.168.1.2:443; | |
137 server_name two.example.com; | |
138 ssl_certificate /usr/local/nginx/conf/two.example.com.cert; | |
139 ... | |
140 } | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
141 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
142 иначе для второго сайта будет выдаваться |
379 | 143 <link doc="configuring_https_servers.xml" |
144 id="name_based_https_servers">сертификат первого сервера</link>. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
145 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
146 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
147 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
148 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
149 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
150 <directive name="ssl_certificate_key"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
151 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
152 <default/> |
379 | 153 <context>http</context> |
154 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
155 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
156 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
157 Указывает <value>файл</value> с секретным ключом в формате PEM |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
158 для данного виртуального сервера. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
159 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
160 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
161 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
162 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
163 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
164 <directive name="ssl_ciphers"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
165 <syntax><value>шифры</value></syntax> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
166 <default>HIGH:!aNULL:!MD5</default> |
379 | 167 <context>http</context> |
168 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
169 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
170 <para> |
379 | 171 Описывает разрешённые шифры. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
172 Шифры задаются в формате, поддерживаемом библиотекой |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
173 OpenSSL, например: |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
174 <example> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
175 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
176 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
177 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
178 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
179 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
180 Полный список можно посмотреть с помощью команды |
271 | 181 “<command>openssl ciphers</command>”. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
182 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
183 |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
184 <para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
185 <note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
186 В предыдущих версиях nginx по умолчанию использовались |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
187 <link doc="configuring_https_servers.xml" id="compatibility">другие</link> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
188 шифры. |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
189 </note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
190 </para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
191 |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
192 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
193 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
194 |
379 | 195 <directive name="ssl_client_certificate"> |
196 <syntax><value>файл</value></syntax> | |
197 <default/> | |
198 <context>http</context> | |
199 <context>server</context> | |
200 | |
201 <para> | |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
202 Указывает <value>файл</value> с доверенными сертификатами CA в формате |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
203 PEM, которые используются для проверки клиентских сертификатов и |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
204 ответов OCSP, если включён <link id="ssl_stapling"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
205 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
206 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
207 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
208 Список сертификатов будет отправляться клиентам. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
209 Если это нежелательно, можно воспользоваться директивой |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
210 <link id="ssl_trusted_certificate"/>. |
379 | 211 </para> |
212 | |
213 </directive> | |
214 | |
215 | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
216 <directive name="ssl_crl"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
217 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
218 <default/> |
379 | 219 <context>http</context> |
220 <context>server</context> | |
221 <appeared-in>0.8.7</appeared-in> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
222 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
223 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
224 Указывает <value>файл</value> с отозванными сертификатами (CRL) |
379 | 225 в формате PEM, используемыми для проверки клиентских сертификатов. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
226 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
227 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
228 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
229 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
230 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
231 <directive name="ssl_dhparam"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
232 <syntax><value>файл</value></syntax> |
99
1d315ef37215
The case <default/> is now language-agnostic.
Ruslan Ermilov <ru@nginx.com>
parents:
98
diff
changeset
|
233 <default/> |
379 | 234 <context>http</context> |
235 <context>server</context> | |
236 <appeared-in>0.7.2</appeared-in> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
237 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
238 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
239 Указывает <value>файл</value> с параметрами для шифров с обменом EDH-ключами. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
240 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
241 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
242 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
243 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
244 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
245 <directive name="ssl_prefer_server_ciphers"> |
271 | 246 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
247 <default>off</default> |
379 | 248 <context>http</context> |
249 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
250 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
251 <para> |
379 | 252 Указывает, чтобы при использовании протоколов SSLv3 и TLS |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
253 серверные шифры были более приоритетны, чем клиентские. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
254 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
255 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
256 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
257 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
258 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
259 <directive name="ssl_protocols"> |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
260 <syntax> |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
261 [<literal>SSLv2</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
262 [<literal>SSLv3</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
263 [<literal>TLSv1</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
264 [<literal>TLSv1.1</literal>] |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
265 [<literal>TLSv1.2</literal>]</syntax> |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
266 <default>SSLv3 TLSv1 TLSv1.1 TLSv1.2</default> |
379 | 267 <context>http</context> |
268 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
269 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
270 <para> |
379 | 271 Разрешает указанные протоколы. |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
272 Параметры <literal>TLSv1.1</literal> и <literal>TLSv1.2</literal> работают |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
273 только при использовании библиотеки OpenSSL версии 1.0.1 и выше. |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
274 <note> |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
275 Параметры <literal>TLSv1.1</literal> и <literal>TLSv1.2</literal> поддерживаются |
393
b83d332fbdaa
Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents:
383
diff
changeset
|
276 только начиная с версий 1.1.13 и 1.0.12, |
b83d332fbdaa
Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents:
383
diff
changeset
|
277 поэтому при использовании OpenSSL версии 1.0.1 |
314
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
278 и выше на старых версиях nginx эти протоколы работать будут, однако их нельзя |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
279 будет отключить. |
95d5dc7c9884
Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents:
285
diff
changeset
|
280 </note> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
281 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
282 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
283 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
284 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
285 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
286 <directive name="ssl_session_cache"> |
271 | 287 <syntax> |
379 | 288 <literal>off</literal> | |
289 <literal>none</literal> | | |
290 [<literal>builtin</literal>[:<value>размер</value>]] | |
291 [<literal>shared</literal>:<value>название</value>:<value>размер</value>]</syntax> | |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
292 <default>none</default> |
379 | 293 <context>http</context> |
294 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
295 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
296 <para> |
379 | 297 Задаёт тип и размеры кэшей для хранения параметров сессий. |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
298 Тип кэша может быть следующим: |
379 | 299 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
300 |
379 | 301 <tag-name><literal>off</literal></tag-name> |
302 <tag-desc> | |
303 жёсткое запрещение использования кэша сессий: | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
304 nginx явно говорит клиенту, что сессии не могут использоваться повторно. |
379 | 305 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
306 |
379 | 307 <tag-name><literal>none</literal></tag-name> |
308 <tag-desc> | |
309 мягкое запрещение использования кэша сессий: | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
310 nginx говорит клиенту, что сессии могут использоваться повторно, но |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
311 на самом деле не используются. |
379 | 312 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
313 |
379 | 314 <tag-name><literal>builtin</literal></tag-name> |
315 <tag-desc> | |
316 встроенный в OpenSSL кэш, используется в рамках только одного рабочего процесса. | |
317 Размер кэша задаётся в сессиях. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
318 Если размер не задан, то он равен 20480 сессиям. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
319 Использование встроенного кэша может вести к фрагментации памяти. |
379 | 320 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
321 |
379 | 322 <tag-name><literal>shared</literal></tag-name> |
323 <tag-desc> | |
324 разделяемый между всеми рабочими процессами. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
325 Размер кэша задаётся в байтах, в 1 мегабайт может поместиться |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
326 около 4000 сессий. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
327 У каждого разделяемого кэша должно быть произвольное название. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
328 Кэш с одинаковым названием может использоваться в нескольких |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
329 виртуальных серверах. |
379 | 330 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
331 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
332 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
333 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
334 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
335 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
336 Можно использовать одновременно оба типа кэша, например: |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
337 <example> |
379 | 338 ssl_session_cache builtin:1000 shared:SSL:10m; |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
339 </example> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
340 однако использование только разделяемого кэша без встроенного должно |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
341 быть более эффективным. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
342 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
343 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
344 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
345 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
346 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
347 <directive name="ssl_session_timeout"> |
102
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
348 <syntax><value>время</value></syntax> |
c76a257f3fd4
The directive name is now automatically printed in <default> and <syntax>.
Ruslan Ermilov <ru@nginx.com>
parents:
99
diff
changeset
|
349 <default>5m</default> |
379 | 350 <context>http</context> |
351 <context>server</context> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
352 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
353 <para> |
379 | 354 Задаёт время, в течение которого клиент может повторно |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
355 использовать параметры сессии, хранящейся в кэше. |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
356 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
357 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
358 </directive> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
359 |
379 | 360 |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
361 <directive name="ssl_stapling"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
362 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
363 <default>off</default> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
364 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
365 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
366 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
367 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
368 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
369 Разрешает или запрещает |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
370 <link url="http://tools.ietf.org/html/rfc4366#section-3.6">прикрепление |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
371 OCSP-ответов</link> сервером. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
372 Пример: |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
373 <example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
374 ssl_stapling on; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
375 resolver 192.0.2.1; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
376 </example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
377 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
378 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
379 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
380 Для работы OCSP stapling’а должен быть известен сертификат издателя |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
381 сертификата сервера. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
382 Если в заданном директивой <link id="ssl_certificate"/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
383 файле не содержится промежуточных сертификатов, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
384 то сертификат издателя сертификата сервера следует поместить в файл, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
385 заданный директивой <link id="ssl_trusted_certificate"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
386 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
387 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
388 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
389 Для преобразования имени хоста OCSP responder’а в адрес необходимо |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
390 дополнительно задать директиву |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
391 <link doc="ngx_http_core_module.xml" id="resolver"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
392 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
393 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
394 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
395 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
396 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
397 <directive name="ssl_stapling_file"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
398 <syntax><value>файл</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
399 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
400 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
401 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
402 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
403 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
404 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
405 Если задано, то вместо опроса OCSP responder’а, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
406 указанного в сертификате сервера, |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
407 ответ берётся из указанного <value>файла</value>. |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
408 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
409 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
410 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
411 Ответ должен быть в формате DER и может быть сгенерирован командой |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
412 “<literal>openssl ocsp</literal>”. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
413 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
414 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
415 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
416 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
417 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
418 <directive name="ssl_stapling_responder"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
419 <syntax><value>url</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
420 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
421 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
422 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
423 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
424 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
425 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
426 Переопределяет URL OCSP responder’а, указанный в расширении сертификата |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
427 “<link url="http://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
428 Information Access</link>”. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
429 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
430 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
431 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
432 Поддерживаются только “<literal>http://</literal>” OCSP responder’ы: |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
433 <example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
434 ssl_stapling_responder http://ocsp.example.com/; |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
435 </example> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
436 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
437 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
438 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
439 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
440 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
441 <directive name="ssl_stapling_verify"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
442 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
443 <default>off</default> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
444 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
445 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
446 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
447 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
448 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
449 Разрешает или запрещает проверку сервером ответов OCSP. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
450 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
451 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
452 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
453 Для работоспособности проверки сертификат издателя сертификата сервера, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
454 корневой сертификат и все промежуточные сертификаты должны быть указаны |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
455 как доверенные с помощью директивы |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
456 <link id="ssl_trusted_certificate"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
457 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
458 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
459 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
460 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
461 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
462 <directive name="ssl_trusted_certificate"> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
463 <syntax><value>файл</value></syntax> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
464 <default/> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
465 <context>http</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
466 <context>server</context> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
467 <appeared-in>1.3.7</appeared-in> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
468 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
469 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
713
diff
changeset
|
470 Задаёт <value>файл</value> с доверенными сертификатами CA в формате PEM, |
713
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
471 которые используются для проверки клиентских сертификатов и ответов OCSP, |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
472 если включён <link id="ssl_stapling"/>. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
473 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
474 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
475 <para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
476 В отличие от <link id="ssl_client_certificate"/>, список этих сертификатов |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
477 не будет отправляться клиентам. |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
478 </para> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
479 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
480 </directive> |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
481 |
1de09d81acd1
Translated OCSP docs into Russian.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
482 |
379 | 483 <directive name="ssl_verify_client"> |
484 <syntax> | |
485 <literal>on</literal> | <literal>off</literal> | | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
486 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
379 | 487 <default>off</default> |
488 <context>http</context> | |
489 <context>server</context> | |
490 | |
491 <para> | |
492 Разрешает проверку клиентских сертификатов. | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
493 Результат проверки доступен через переменную |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
494 <var>$ssl_client_verify</var>. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
495 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
496 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
497 <para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
498 Параметр <literal>optional</literal> (0.8.7+) запрашивает клиентский |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
499 сертификат, и если сертификат был предоставлен, проверяет его. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
500 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
501 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
502 <para> |
763
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
503 Параметр <literal>optional_no_ca</literal> (1.3.8, 1.2.5) |
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
504 запрашивает сертификат |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
505 клиента, но не требует, чтобы он был подписан доверенным сертификатом CA. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
506 Это предназначено для случаев, когда фактическая проверка сертификата |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
507 осуществляется внешним по отношению к nginx’у сервисом. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
508 Содержимое сертификата доступно через переменную |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
509 <var>$ssl_client_cert</var>. |
379 | 510 </para> |
511 | |
512 </directive> | |
513 | |
514 | |
515 <directive name="ssl_verify_depth"> | |
516 <syntax><value>число</value></syntax> | |
517 <default>1</default> | |
518 <context>http</context> | |
519 <context>server</context> | |
520 | |
521 <para> | |
522 Устанавливает глубину проверки в цепочке клиентских сертификатов. | |
523 </para> | |
524 | |
525 </directive> | |
526 | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
527 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
528 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
529 |
379 | 530 <section id="errors" name="Обработка ошибок"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
531 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
532 <para> |
379 | 533 Модуль <literal>ngx_http_ssl_module</literal> поддерживает несколько |
534 нестандартных кодов ошибок, которые можно использовать для | |
535 перенаправления с помощью директивы | |
106
56457a474903
If text of the link is not provided, the @id is used.
Ruslan Ermilov <ru@nginx.com>
parents:
102
diff
changeset
|
536 <link doc="ngx_http_core_module.xml" id="error_page"/>: |
379 | 537 <list type="tag"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
538 |
379 | 539 <tag-name>495</tag-name> |
540 <tag-desc> | |
541 при проверке клиентского сертификата произошла ошибка; | |
542 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
543 |
379 | 544 <tag-name>496</tag-name> |
545 <tag-desc> | |
546 клиент не предоставил требуемый сертификат; | |
547 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
548 |
379 | 549 <tag-name>497</tag-name> |
550 <tag-desc> | |
551 обычный запрос был послан на порт HTTPS. | |
552 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
553 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
554 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
555 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
556 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
557 <para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
558 Перенаправление делается после того, как запрос полностью разобран |
379 | 559 и доступны такие переменные, как <var>$request_uri</var>, |
560 <var>$uri</var>, <var>$args</var> и прочие. | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
561 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
562 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
563 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
564 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
565 |
379 | 566 <section id="variables" name="Встроенные переменные"> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
567 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
568 <para> |
379 | 569 Модуль <literal>ngx_http_ssl_module</literal> поддерживает |
570 несколько встроенных переменных: | |
571 <list type="tag"> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
572 |
379 | 573 <tag-name><var>$ssl_cipher</var></tag-name> |
574 <tag-desc> | |
575 возвращает строку используемых шифров для установленного SSL-соединения; | |
576 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
577 |
379 | 578 <tag-name><var>$ssl_client_cert</var></tag-name> |
579 <tag-desc> | |
580 возвращает клиентский сертификат | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
581 для установленного SSL-соединения в формате PEM |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
582 перед каждой строкой которого, кроме первой, вставляется символ табуляции; |
383
a73fa21add8a
Removed a misleading sentence.
Ruslan Ermilov <ru@nginx.com>
parents:
379
diff
changeset
|
583 предназначена для использования в директиве |
379 | 584 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/>; |
585 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
586 |
379 | 587 <tag-name><var>$ssl_client_raw_cert</var></tag-name> |
588 <tag-desc> | |
589 возвращает клиентский сертификат | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
590 для установленного SSL-соединения в формате PEM; |
379 | 591 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
592 |
379 | 593 <tag-name><var>$ssl_client_serial</var></tag-name> |
594 <tag-desc> | |
595 возвращает серийный номер клиентского сертификата | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
596 для установленного SSL-соединения; |
379 | 597 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
598 |
379 | 599 <tag-name><var>$ssl_client_s_dn</var></tag-name> |
600 <tag-desc> | |
601 возвращает строку “subject DN” клиентского сертификата | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
602 для установленного SSL-соединения; |
379 | 603 </tag-desc> |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
604 |
379 | 605 <tag-name><var>$ssl_client_i_dn</var></tag-name> |
606 <tag-desc> | |
607 возвращает строку “issuer DN” клиентского сертификата | |
608 для установленного SSL-соединения; | |
609 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
610 |
379 | 611 <tag-name><var>$ssl_client_verify</var></tag-name> |
612 <tag-desc> | |
613 возвращает результат проверки клиентского сертификата: | |
614 “<literal>SUCCESS</literal>”, “<literal>FAILED</literal>” и, | |
615 если сертификат не был предоставлен — “<literal>NONE</literal>”; | |
616 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
617 |
379 | 618 <tag-name><var>$ssl_protocol</var></tag-name> |
619 <tag-desc> | |
620 возвращает протокол установленного SSL-соединения; | |
621 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
622 |
379 | 623 <tag-name><var>$ssl_session_id</var></tag-name> |
624 <tag-desc> | |
625 возвращает идентификатор сессии установленного SSL-соединения. | |
626 </tag-desc> | |
76
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
627 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
628 </list> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
629 </para> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
630 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
631 </section> |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
632 |
4a4caa566120
Russian documentation import.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff
changeset
|
633 </module> |