annotate xml/en/docs/http/configuring_https_servers.xml @ 580:be54c443235a

Added copyright markers to documentation sources.
author Ruslan Ermilov <ru@nginx.com>
date Tue, 10 Jul 2012 12:59:42 +0000
parents 9913f1d51c07
children 764fbac1b8b4
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 490
diff changeset
1 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 490
diff changeset
2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 490
diff changeset
3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 490
diff changeset
4 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 490
diff changeset
5
50
9d544687d02c Fixed DOCTYPE declaration.
Ruslan Ermilov <ru@nginx.com>
parents: 46
diff changeset
6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 121
diff changeset
8 <article name="Configuring HTTPS servers"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 link="/en/docs/http/configuring_https_servers.html"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 lang="en"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 author="Igor Sysoev"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12 editor="Brian Mercer">
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14 <section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 To configure an HTTPS server you must enable the SSL protocol
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 in the server block, and specify the locations of the server certificate
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 and private key files:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
24 server_name www.example.com;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
26 ssl_certificate www.example.com.crt;
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
27 ssl_certificate_key www.example.com.key;
314
95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents: 271
diff changeset
28 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
37
b33866d80056 - Marketing data fixed to reflect latest September Netcraft survey
Andrey Alexeev <andrew@nginx.com>
parents: 0
diff changeset
29 ssl_ciphers HIGH:!aNULL:!MD5;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34 The server certificate is a public entity.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 It is sent to every client that connects to the server.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 The private key is a secure entity and should be stored in a file with
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 restricted access, however, it must be readable by nginx&rsquo;s master process.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 The private key may alternately be stored in the same file as the certificate:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40 <programlisting>
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
41 ssl_certificate www.example.com.cert;
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
42 ssl_certificate_key www.example.com.cert;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 in which case the file access rights should also be restricted.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 Although the certificate and the key are stored in one file,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 only the certificate is sent to a client.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50 <para>
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
51 The directives <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> and
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
52 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
53 can be used to limit connections
56
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
54 to include only the strong versions and ciphers of SSL/TLS.
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
55 Since version 1.0.5, nginx uses “<literal>ssl_protocols SSLv3 TLSv1</literal>”
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
56 and “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>” by default,
56
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
57 so configuring them explicitly only makes sense for the earlier nginx versions.
393
b83d332fbdaa Documented SSL changes in the upcoming 1.0.12 release.
Ruslan Ermilov <ru@nginx.com>
parents: 374
diff changeset
58 Since versions 1.1.13 and 1.0.12, nginx uses
314
95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents: 271
diff changeset
59 “<literal>ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2</literal>” by default.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61
56
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
62 <para>
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
63 CBC-mode ciphers might be vulnerable to a number of attacks and to
98
a10bc0cb0a6a Whitespace cleanup.
Ruslan Ermilov <ru@nginx.com>
parents: 59
diff changeset
64 the BEAST attack in particular (see
374
a413dffb0557 Replaced "a href" with "link doc" / "link url".
Ruslan Ermilov <ru@nginx.com>
parents: 314
diff changeset
65 <link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>).
56
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
66 Configuration of ciphers can be adjusted to prefer RC4-SHA as the following:
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
67
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
68 <programlisting>
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
69 ssl_ciphers RC4:HIGH:!aNULL:!MD5;
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
70 ssl_prefer_server_ciphers on;
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
71 </programlisting>
59
bd9f103036a0 Put <programlisting> inside <para>.
Ruslan Ermilov <ru@nginx.com>
parents: 56
diff changeset
72 </para>
56
b706454b2ab8 - About RC4-SHA
Andrey Alexeev <andrew@nginx.com>
parents: 50
diff changeset
73
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
77 <section id="optimization" name="HTTPS server optimization">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 SSL operations consume extra CPU resources.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 On multi-processor systems you should run several worker processes:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 no less than the number of available CPU cores.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 The most CPU-intensive operation is the SSL handshake.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 There are two ways to minimize the number of these operations per client:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 the first is by enabling keepalive connections to send several
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 requests via one connection and the second is to reuse SSL session
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 parameters to avoid SSL handshakes for parallel and subsequent connections.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 The sessions are stored in an SSL session cache shared between workers
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
89 and configured by the
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
90 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
91 directive.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 One megabyte of the cache contains about 4000 sessions.
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
93 The default cache timeout is 5 minutes.
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
94 It can be increased by using the
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
95 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
96 directive.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 Here is a sample configuration optimized for a quad core system
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 with 10M shared session cache:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 <b>worker_processes 4</b>;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103 http {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 <b>ssl_session_cache shared:SSL:10m</b>;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105 <b>ssl_session_timeout 10m</b>;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
109 server_name www.example.com;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110 <b>keepalive_timeout 70</b>;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
113 ssl_certificate www.example.com.crt;
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
114 ssl_certificate_key www.example.com.key;
314
95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents: 271
diff changeset
115 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
46
f13ce54a5909 Changing !ADH to !aNULL in another example section to conform to modern state.
Igor Sysoev <igor@sysoev.ru>
parents: 43
diff changeset
116 ssl_ciphers HIGH:!aNULL:!MD5;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
124 <section id="chains" name="SSL certificate chains">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 Some browsers may complain about a certificate signed by a well-known
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 certificate authority, while other browsers may accept the certificate
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 without issues.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 This occurs because the issuing authority has signed the server certificate
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 using an intermediate certificate that is not present in the certificate
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 base of well-known trusted certificate authorities which is distributed
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 with a particular browser.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 In this case the authority provides a bundle of chained certificates
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 which should be concatenated to the signed server certificate.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 The server certificate must appear before the chained certificates
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 in the combined file:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139 <programlisting>
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
140 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
143 The resulting file should be used in the
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
144 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 directive:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
150 server_name www.example.com;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
152 ssl_certificate www.example.com.chained.crt;
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
153 ssl_certificate_key www.example.com.key;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 If the server certificate and the bundle have been concatenated in the wrong
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 order, nginx will fail to start and will display the error message:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 <programlisting>
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
162 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 (SSL: error:0B080074:x509 certificate routines:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164 X509_check_private_key:key values mismatch)
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 because nginx has tried to use the private key with the bundle&rsquo;s
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 first certificate instead of the server certificate.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 Browsers usually store intermediate certificates which they receive
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 and which are signed by trusted authorities, so actively used browsers
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 may already have the required intermediate certificates and
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 may not complain about a certificate sent without a chained bundle.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 To ensure the server sends the complete certificate chain,
266
c09d374c86c6 Cosmetics.
Ruslan Ermilov <ru@nginx.com>
parents: 148
diff changeset
177 you may use the <command>openssl</command> command-line utility, for example:
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180 $ openssl s_client -connect www.godaddy.com:443
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
182 Certificate chain
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
186 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
187 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
188 /OU=http://certificates.godaddy.com/repository
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
189 /CN=Go Daddy Secure Certification Authority
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
190 /serialNumber=07969287
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192 /OU=http://certificates.godaddy.com/repository
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 /CN=Go Daddy Secure Certification Authority
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 /serialNumber=07969287
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195 i:/C=US/O=The Go Daddy Group, Inc.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196 /OU=Go Daddy Class 2 Certification Authority
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197 2 s:/C=US/O=The Go Daddy Group, Inc.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 /OU=Go Daddy Class 2 Certification Authority
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200 /OU=ValiCert Class 2 Policy Validation Authority
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 /CN=http://www.valicert.com//emailAddress=info@valicert.com
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
202 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205 In this example the subject (&ldquo;<i>s</i>&rdquo;) of the
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206 <url>www.GoDaddy.com</url> server certificate #0 is signed by an issuer
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 (&ldquo;<i>i</i>&rdquo;) which itself is the subject of the certificate #1,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208 which is signed by an issuer which itself is the subject of the certificate #2,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 which signed by the well-known issuer <i>ValiCert, Inc.</i>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 whose certificate is stored in the browsers&rsquo; built-in
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 certificate base (that lay in the house that Jack built).
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215 If you have not added the certificates bundle, you will see only your server
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 certificate #0.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
218
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
222 <section id="single_http_https_server" name="A single HTTP/HTTPS server">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225 It is good practice to configure separate servers for HTTP and HTTPS
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
226 protocols from the very start. Although their functionalities currently
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227 seem equal, this may change significantly in the future
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228 and using a consolidated server may become problematic.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229 However, if HTTP and HTTPS servers are equal,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 and you prefer not to think about the future,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231 you may configure a single server that handles both HTTP and HTTPS requests
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
232 by deleting the directive “<literal>ssl on</literal>”
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
233 and adding the <literal>ssl</literal> parameter for *:443 port:
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
234
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
237 listen 80;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238 listen 443 ssl;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
239 server_name www.example.com;
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
240 ssl_certificate www.example.com.crt;
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
241 ssl_certificate_key www.example.com.key;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
242 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
243 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
246 <note>
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
247 Prior to 0.8.21, nginx only allows the <literal>ssl</literal> parameter
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
248 to be set on listen sockets with the <literal>default</literal> parameter:
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250 listen 443 default ssl;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 </note>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
258 <section id="name_based_https_servers" name="Name-based HTTPS servers">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261 A common issue arises when configuring two or more HTTPS servers
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262 listening on a single IP address:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
267 server_name www.example.com;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
269 ssl_certificate www.example.com.crt;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
275 server_name www.example.org;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
277 ssl_certificate www.example.org.crt;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282 With this configuration a browser receives the certificate of the default
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
283 server, i.e., <url>www.example.com</url> regardless of the requested server name.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 This is caused by SSL protocol behaviour. The SSL connection is established
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285 before the browser sends an HTTP request and nginx does not know
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286 the name of the requested server. Therefore, it may only offer the certificate
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287 of the default server.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291 The oldest and most robust method to resolve the issue
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 is to assign a separate IP address for every HTTPS server:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 listen 192.168.1.1:443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
297 server_name www.example.com;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
299 ssl_certificate www.example.com.crt;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 listen 192.168.1.2:443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
305 server_name www.example.org;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 ssl on;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
307 ssl_certificate www.example.org.crt;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
308 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
316 <section id="certificate_with_several_names"
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
317 name="A SSL certificate with several names">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 There are other ways to share a single IP address between several
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321 HTTPS servers, however, all of them have drawbacks.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 One way is to use a certificate with several names in
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
323 the SubjectAltName certificate field, for example, <url>www.example.com</url>
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
324 and <url>www.example.org</url>.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 However, the SubjectAltName field length is limited.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
327
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
328 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329 Another way is to use a certificate with a wildcard name, for example,
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
330 <url>*.example.org</url>. This certificate matches
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
331 <url>www.example.org</url>, but does not match <url>example.org</url>
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
332 and <url>www.sub.example.org</url>. These two methods can also be combined.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333 A certificate may contain exact and wildcard names in the SubjectAltName field,
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
334 for example, <url>example.org</url> and <url>*.example.org</url>.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 It is better to place a certificate file with several names and
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339 its private key file at the <i>http</i> level of configuration
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 to inherit their single memory copy in all servers:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
342 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 ssl_certificate common.crt;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344 ssl_certificate_key common.key;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
348 server_name www.example.com;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349 ssl on;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 server {
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 listen 443;
490
9913f1d51c07 Replaced "nginx" domain names with example domains.
Ruslan Ermilov <ru@nginx.com>
parents: 461
diff changeset
355 server_name www.example.org;
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356 ssl on;
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358 }
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
365 <section id="sni" name="Server Name Indication">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368 A more generic solution for running several HTTPS servers on a single
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369 IP address is
374
a413dffb0557 Replaced "a href" with "link doc" / "link url".
Ruslan Ermilov <ru@nginx.com>
parents: 314
diff changeset
370 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">TLSv1.1
a413dffb0557 Replaced "a href" with "link doc" / "link url".
Ruslan Ermilov <ru@nginx.com>
parents: 314
diff changeset
371 Server Name Indication extension</link> (SNI, RFC3546),
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 which allows a browser to pass a requested server name during the SSL handshake
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 and, therefore, the server will know which certificate it should use
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374 for the connection.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 However, SNI has limited browser support.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 Currently it is supported starting with the following browsers versions:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
379 <list type="bullet">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
381 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 Opera 8.0;
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
383 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
385 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386 MSIE 7.0 (but only on Windows Vista or higher);
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
387 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
389 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 Firefox 2.0 and other browsers using Mozilla Platform rv:1.8.1;
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
391 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
393 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394 Safari 3.2.1 (Windows version supports SNI on Vista or higher);
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
395 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
397 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398 and Chrome (Windows version supports SNI on Vista or higher, too).
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
399 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401 </list>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 <para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 In order to use SNI in nginx, it must be supported in both the
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405 OpenSSL library with which the nginx binary has been built as well as
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 the library to which it is being dynamically linked at run time.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407 OpenSSL supports SNI since 0.9.8f version if it was built with config option
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 <nobr>&ldquo;--enable-tlsext&rdquo;.</nobr>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409 Since OpenSSL 0.9.8j this option is enabled by default.
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410 If nginx was built with SNI support, then nginx will show this
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 when run with the &ldquo;-V&rdquo; switch:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
413 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 $ nginx -V
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 TLS SNI support enabled
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 ...
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420 However, if the SNI-enabled nginx is linked dynamically to
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
421 an OpenSSL library without SNI support, nginx displays the warning:
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
422
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423 <programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 nginx was built with SNI support, however, now it is linked
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425 dynamically to an OpenSSL library which has no tlsext support,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 therefore SNI is not available
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427 </programlisting>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432
121
49443032011c Unified <section> syntax for "article" and "module" documents.
Ruslan Ermilov <ru@nginx.com>
parents: 98
diff changeset
433 <section id="compatibility" name="Compatibility">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435 <para>
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
436 <list type="bullet">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
438 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439 The SNI support status has been shown by the &ldquo;-V&rdquo; switch
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
440 since 0.8.21 and 0.7.62.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
441 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
442
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
443 <listitem>
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
444 The <literal>ssl</literal> parameter of the
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
445 <link doc="ngx_http_core_module.xml" id="listen"/>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446 directive has been supported since 0.7.14.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
447 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
449 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450 SNI has been supported since 0.5.32.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
451 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
453 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454 The shared SSL session cache has been supported since 0.5.6.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
455 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 </list>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 <para>
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
461 <list type="bullet">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
463 <listitem>
314
95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents: 271
diff changeset
464 Version 0.7.65, 0.8.19 and later: the default SSL protocols are SSLv3, TLSv1,
95d5dc7c9884 Documented the new "TLSv1.1" and "TLSv1.2" parameters of the
Ruslan Ermilov <ru@nginx.com>
parents: 271
diff changeset
465 TLSv1.1, and TLSv1.2 (if supported by the OpenSSL library).
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
466 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
468 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469 Version 0.7.64, 0.8.18 and earlier: the default SSL protocols are SSLv2,
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
470 SSLv3, and TLSv1.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
471 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
472
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473 </list>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476 <para>
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
477 <list type="bullet">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
479 <listitem>
43
662995d3e647 Update of SSL ciphers in latest nginx versions.
Igor Sysoev <igor@sysoev.ru>
parents: 42
diff changeset
480 Version 1.0.5 and later: the default SSL ciphers are
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
481 “<literal>HIGH:!aNULL:!MD5</literal>”.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
482 </listitem>
43
662995d3e647 Update of SSL ciphers in latest nginx versions.
Igor Sysoev <igor@sysoev.ru>
parents: 42
diff changeset
483
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
484 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485 Version 0.7.65, 0.8.20 and later: the default SSL ciphers are
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
486 “<literal>HIGH:!ADH:!MD5</literal>”.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
487 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
489 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490 Version 0.8.19: the default SSL ciphers are
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
491 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
492 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
494 <listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 Version 0.7.64, 0.8.18 and earlier: the default SSL ciphers are<br/>
271
4c6d2c614d2c Cleaned up XML tag mess:
Ruslan Ermilov <ru@nginx.com>
parents: 266
diff changeset
496 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”.
461
6135f3c95bf6 Unified markup for lists.
Ruslan Ermilov <ru@nginx.com>
parents: 393
diff changeset
497 </listitem>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
498
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
499 </list>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
500 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
501
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
502
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
503 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
504
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
505
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
506 </article>