Mercurial > hg > nginx-site

annotate xml/ru/docs/http/configuring_https_servers.xml @ 580:be54c443235a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Added copyright markers to documentation sources.
author Ruslan Ermilov <ru@nginx.com>
date Tue, 10 Jul 2012 12:59:42 +0000
parents 32dd85720515
children 764fbac1b8b4
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
1 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
4 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 547
diff changeset
5
547
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
8 <article name="Настройка HTTPS-серверов"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 link="/ru/docs/http/configuring_https_servers.html"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
10 lang="ru"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
11 author="Игорь Сысоев"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12 editor="Brian Mercer">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14 <section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
16 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
17 Чтобы настроить HTTPS-сервер, необходимо включить протокол SSL
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
18 в блоке server, а также указать местоположение файлов с
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
19 сертификатом сервера и секретным ключом:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
20
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
21 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
22 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26 ssl_certificate www.example.com.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
27 ssl_certificate_key www.example.com.key;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
28 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
29 ssl_ciphers HIGH:!aNULL:!MD5;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
30 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
31 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
32 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
33
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
34 Сертификат сервера является публичным.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
35 Он посылается каждому клиенту, соединяющемуся с сервером.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
36 Секретный ключ следует хранить в файле с ограниченным доступом
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
37 (права доступа должны позволять основному процессу nginx читать этот файл).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
38 Секретный ключ можно также хранить в одном файле с сертификатом:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
39
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
40 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
41 ssl_certificate www.example.com.cert;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
42 ssl_certificate_key www.example.com.cert;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
43 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
44
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
45 при этом права доступа к файлу следует также ограничить.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
46 Несмотря на то, что и сертификат, и ключ хранятся в одном файле,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
47 клиенту посылается только сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
48 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
49
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
50 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
51 С помощью директив <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
52 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
53 можно ограничить соединения
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
54 использованием только “сильных” версий и шифров SSL/TLS.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
55 Начиная с версии 1.0.5 nginx по умолчанию использует
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
56 “<literal>ssl_protocols SSLv3 TLSv1</literal>” и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
57 “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
58 поэтому явная их настройка имеет смысл только для более ранних версий nginx.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
59 Начиная с версий 1.1.13 и 1.0.12 nginx по умолчанию использует
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
60 “<literal>ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
61 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
62
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
63 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
64 Известно, что шифры с CBC-режимом уязвимы к ряду атак, в частности
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
65 к BEAST-атаке (см.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
66 <link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
67 Настройка шифров может быть изменена так, чтобы предпочитался RC4-SHA:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
68
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
69 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
70 ssl_ciphers RC4:HIGH:!aNULL:!MD5;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
71 ssl_prefer_server_ciphers on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
72 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
73 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78 <section id="optimization" name="Оптимизация HTTPS-сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
79
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 SSL-операции потребляют дополнительные ресурсы процессора.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 На мультипроцессорных системах следует запускать несколько рабочих процессов,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 не меньше числа доступных процессорных ядер.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84 Наиболее ресурсоёмкой для процессора является операция SSL handshake, в рамках
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
85 которой формируются криптографические параметры сессии.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 Существует два способа уменьшения числа этих операций, производимых для каждого
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 клиента: включение постоянных (keepalive) соединений, позволяющих в рамках
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 одного соединения обрабатывать сразу несколько запросов, и повторное
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 использование параметров SSL-сессии для предотвращения необходимости выполнения
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 SSL handshake для параллельных и последующих соединений.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91 Сессии хранятся в кэше SSL-сессий, разделяемом между рабочими процессами и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
92 настраиваемом директивой
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 В 1 мегабайт кэша помещается около 4000 сессий.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95 Таймаут кэша по умолчанию равен 5 минутам.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 Он может быть увеличен с помощью директивы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
98 Вот пример конфигурации, оптимизированной под 4-ядерную систему
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 с 10M разделяемого кэша сессий:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102 <b>worker_processes 4</b>;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
103
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
104 http {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
105 <b>ssl_session_cache shared:SSL:10m</b>;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106 <b>ssl_session_timeout 10m</b>;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
107
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 <b>keepalive_timeout 70</b>;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
113 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114 ssl_certificate www.example.com.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 ssl_certificate_key www.example.com.key;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 ssl_ciphers HIGH:!aNULL:!MD5;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
118 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
119 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
120 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
122 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 <section id="chains" name="Цепочки SSL-сертификатов">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
126
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
127 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
128 Некоторые браузеры могут выдавать предупреждение о сертификате, подписанном
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129 общеизвестным центром сертификации, в то время как другие браузеры без
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 проблем принимают этот же сертификат.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131 Так происходит потому, что центр, выдавший сертификат, подписал его
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 промежуточным сертификатом, которого нет в базе данных сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133 общеизвестных доверенных центров сертификации, распространяемой
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 вместе с браузером.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
135 В подобном случае центр сертификации предоставляет “связку” сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
136 которую следует присоединить к сертификату сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
137 Сертификат сервера следует разместить перед связкой сертификатов
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
138 в скомбинированном файле:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
139
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
140 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
141 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
142 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
143
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
144 Полученный файл следует указать в директиве
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
145 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
146
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
147 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
148 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
149 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
150 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
151 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
152 ssl_certificate www.example.com.chained.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
153 ssl_certificate_key www.example.com.key;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
154 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
155 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
156 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
157
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
158 Если сертификат сервера и связка сертификатов были соединены в неправильном
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
159 порядке, nginx откажется запускаться и выдаст сообщение об ошибке:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
160
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
161 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
162 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
163 (SSL: error:0B080074:x509 certificate routines:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
164 X509_check_private_key:key values mismatch)
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
165 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
166
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
167 поскольку nginx попытается использовать секретный ключ с первым
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
168 сертификатом из связки вместо сертификата сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
169 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
170
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
171 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
172 Браузеры обычно сохраняют полученные промежуточные сертификаты, подписанные
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
173 доверенными центрами сертификации, поэтому активно используемые браузеры
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
174 уже могут иметь требуемые промежуточные сертификаты и не выдать предупреждение
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
175 о сертификате, присланном без связанной с ним цепочки сертификатов.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
176 Убедиться в том, что сервер присылает полную цепочку сертификатов,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
177 можно при помощи утилиты командной строки <command>openssl</command>, например:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
178
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
179 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
180 $ openssl s_client -connect www.godaddy.com:443
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
181 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
182 Certificate chain
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
183 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
184 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
185 /OU=MIS Department/<b>CN=www.GoDaddy.com</b>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
186 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b)
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
187 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
188 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
189 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
190 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
191 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
192 /OU=http://certificates.godaddy.com/repository
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
193 /CN=Go Daddy Secure Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
194 /serialNumber=07969287
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
195 i:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
196 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
197 2 s:/C=US/O=The Go Daddy Group, Inc.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
198 /OU=Go Daddy Class 2 Certification Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
199 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
200 /OU=ValiCert Class 2 Policy Validation Authority
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
201 /CN=http://www.valicert.com//emailAddress=info@valicert.com
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
202 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
203 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
204
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
205 В этом примере субъект (&ldquo;<i>s</i>&rdquo;) сертификата №0 сервера
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
206 <url>www.GoDaddy.com</url> подписан издателем (&ldquo;<i>i</i>&rdquo;),
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
207 который в свою очередь является субъектом сертификата №1, подписанного
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
208 издателем, который в свою очередь является субъектом сертификата №2,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
209 подписанного общеизвестным издателем <i>ValiCert, Inc.</i>,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
210 чей сертификат хранится во встроенной в браузеры базе данных
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
211 сертификатов (которая в тёмном чулане хранится в доме, который построил Джек).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
212 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
213
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
214 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
215 Если связку сертификатов не добавили, будет показан только сертификат
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
216 сервера №0.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
217 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
218
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
219 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
220
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
221
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
222 <section id="single_http_https_server" name="Единый HTTP/HTTPS сервер">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
223
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
224 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
225 На практике рекомендуется с самого начала настраивать отдельные серверы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
226 для протоколов HTTP и HTTPS.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
227 И хотя сегодня их функциональность может казаться идентичной, в будущем
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
228 это может измениться и использование консолидированного сервера может
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
229 стать проблематичным.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
230 Однако, если серверы HTTP и HTTPS идентичны, и думать о будущем не
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
231 хочется, можно настроить единый сервер, который обслуживает
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
232 как HTTP-, так и HTTPS-запросы.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
233 Для этого следует исключить директиву “<literal>ssl on</literal>”
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
234 и добавить параметр <literal>ssl</literal> к порту *:443:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
235
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
236 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
237 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
238 listen 80;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
239 listen 443 ssl;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
240 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
241 ssl_certificate www.example.com.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
242 ssl_certificate_key www.example.com.key;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
243 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
244 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
245 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
246
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
247 <note>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
248 До версии 0.8.21 nginx допускал указание параметра <literal>ssl</literal>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
249 на слушающем сокете только совместно с параметром <literal>default</literal>:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
250 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
251 listen 443 default ssl;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
252 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
253 </note>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
254 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
255
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
256 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
257
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
258
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
259 <section id="name_based_https_servers" name="Выбор HTTPS-сервера по имени">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
260
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
261 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
262 Типичная проблема возникает при настройке двух и более серверов HTTPS,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
263 слушающих на одном и том же IP-адресе:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
264
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
265 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
266 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
267 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
268 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
269 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
270 ssl_certificate www.example.com.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
271 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
272 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
273
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
274 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
275 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
276 server_name www.example.org;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
277 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
278 ssl_certificate www.example.org.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
279 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
280 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
281 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
282
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
283 В такой конфигурации браузер получит сертификат первого сервера, т.е.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
284 <url>www.example.com</url>, независимо от запрашиваемого имени сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
285 Это связано с поведением протокола SSL.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
286 SSL-соединение устанавливается до того, как браузер посылает HTTP-запрос,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
287 и nginx не знает имени запрашиваемого сервера.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
288 Следовательно, он лишь может предложить сертификат сервера по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
289 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
290
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
291 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
292 Наиболее старым и надёжным способом решения этой проблемы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
293 является назначение каждому HTTPS-серверу своего IP-адреса:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
294
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
295 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
296 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
297 listen 192.168.1.1:443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
298 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
299 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
300 ssl_certificate www.example.com.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
301 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
302 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
303
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
304 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
305 listen 192.168.1.2:443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
306 server_name www.example.org;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
307 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
308 ssl_certificate www.example.org.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
309 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
310 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
311 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
312 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
313
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
314 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
315
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
316
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
317 <section id="certificate_with_several_names"
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
318 name="SSL-сертификат с несколькими именами">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
319
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
320 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
321 Существуют и другие способы, которые позволяют использовать один и тот же
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
322 IP-адрес сразу для нескольких HTTPS-серверов.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
323 Все они, однако, имеют свои недостатки.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
324 Одним из таких способов является использование сертификата с несколькими
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
325 именами в поле SubjectAltName сертификата, например <url>www.example.com</url>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
326 и <url>www.example.org</url>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
327 Однако, длина поля SubjectAltName ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
328 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
329
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
330 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
331 Другим способом является использование wildcard-сертификата, например
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
332 <url>*.example.org</url>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
333 Такой сертификат защищает все поддомены указанного домена, но только
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
334 на заданном уровне.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
335 Под такой сертификат подходит <url>www.example.org</url>, но не подходят
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
336 <url>example.org</url> и <url>www.sub.example.org</url>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
337 Два вышеуказанных способа можно комбинировать.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
338 Сертификат может одновременно содержать и точное, и wildcard имена в поле
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
339 SubjectAltName, например <url>example.org</url> и <url>*.example.org</url>.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
340 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
341
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
342 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
343 Лучше поместить сведения о файле сертификата с несколькими именами и
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
344 файле с его секретным ключом на уровне конфигурации <i>http</i>, чтобы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
345 все серверы унаследовали их единственную копию в памяти:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
346
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
347 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
348 ssl_certificate common.crt;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
349 ssl_certificate_key common.key;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
350
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
351 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
352 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
353 server_name www.example.com;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
354 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
355 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
356 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
357
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
358 server {
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
359 listen 443;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
360 server_name www.example.org;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
361 ssl on;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
362 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
363 }
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
364 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
365 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
366
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
367 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
368
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
369
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
370 <section id="sni" name="Указание имени сервера">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
371
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
372 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
373 Более общее решение для работы нескольких HTTPS-серверов на одном
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
374 IP-адресе —
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
375 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">расширение
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
376 TLSv1.1 Server Name Indication</link> (SNI, RFC3546),
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
377 которое позволяет браузеру передать запрашиваемое имя сервера во время
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
378 SSL handshake, а значит сервер будет знать, какой сертификат ему
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
379 следует использовать для соединения.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
380 Однако, поддержка SNI браузерами ограничена.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
381 Сейчас это поддерживается браузерами начиная со следующих версий:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
382 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
383
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
384 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
385
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
386 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
387 Opera 8.0;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
388 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
389
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
390 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
391 MSIE 7.0 (но только на Windows Vista и выше);
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
392 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
393
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
394 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
395 Firefox 2.0 и другие браузеры, использующие Mozilla Platform rv:1.8.1;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
396 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
397
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
398 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
399 Safari 3.2.1 (Windows-версия поддерживает SNI только на Vista и выше);
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
400 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
401
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
402 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
403 и Chrome (Windows-версия также поддерживает SNI только на Vista и выше).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
404 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
405
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
406 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
407
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
408 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
409 Чтобы использовать SNI в nginx, соответствующая поддержка должна
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
410 присутствовать как в библиотеке OpenSSL, использованной при сборке
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
411 бинарного файла nginx, так и в библиотеке, подгружаемой в момент
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
412 работы.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
413 OpenSSL поддерживает SNI начиная с версии 0.9.8f, если она была
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
414 собрана с опцией конфигурации <nobr>&ldquo;--enable-tlsext&rdquo;.</nobr>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
415 Начиная с OpenSSL 0.9.8j эта опция включена по умолчанию.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
416 Если nginx был собран с поддержкой SNI, то при запуске nginx с ключом
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
417 &ldquo;-V&rdquo; об этом сообщается:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
418
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
419 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
420 $ nginx -V
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
421 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
422 TLS SNI support enabled
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
423 ...
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
424 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
425
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
426 Однако, если nginx, собранный с поддержкой SNI, в процессе работы подгружает
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
427 библиотеку OpenSSL, в которой нет поддержки SNI, nginx выдаёт предупреждение:
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
428
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
429 <programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
430 nginx was built with SNI support, however, now it is linked
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
431 dynamically to an OpenSSL library which has no tlsext support,
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
432 therefore SNI is not available
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
433 </programlisting>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
434 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
435
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
436 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
437
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
438
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
439 <section id="compatibility" name="Совместимость">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
440
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
441 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
442 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
443
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
444 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
445 Статус поддержки SNI отображается по ключу &ldquo;-V&rdquo;
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
446 начиная с версий 0.8.21 и 0.7.62.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
447 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
448
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
449 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
450 Параметр <literal>ssl</literal> директивы
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
451 <link doc="ngx_http_core_module.xml" id="listen"/>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
452 поддерживается начиная с версии 0.7.14.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
453 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
454
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
455 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
456 SNI поддерживается начиная с версии 0.5.32.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
457 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
458
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
459 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
460 Разделяемый кэш SSL-сессий поддерживается начиная с версии 0.5.6.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
461 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
462
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
463 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
464 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
465
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
466 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
467 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
468
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
469 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
470 Версия 0.7.65, 0.8.19 и более поздние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
471 SSLv3, TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL).
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
472 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
473
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
474 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
475 Версия 0.7.64, 0.8.18 и более ранние: протоколами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
476 SSLv2, SSLv3 и TLSv1.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
477 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
478
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
479 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
480 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
481
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
482 <para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
483 <list type="bullet">
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
484
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
485 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
486 Версия 1.0.5 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
487 “<literal>HIGH:!aNULL:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
488 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
489
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
490 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
491 Версия 0.7.65, 0.8.20 и более поздние: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
492 “<literal>HIGH:!ADH:!MD5</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
493 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
494
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
495 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
496 Версия 0.8.19: шифрами SSL по умолчанию являются
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
497 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
498 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
499
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
500 <listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
501 Версия 0.7.64, 0.8.18 и более ранние: шифрами SSL по умолчанию являются<br/>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
502 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”.
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
503 </listitem>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
504
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
505 </list>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
506 </para>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
507
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
508
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
509 </section>
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
510
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
511
32dd85720515 Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
512 </article>