Mercurial > hg > nginx-site
annotate xml/en/docs/mail/ngx_mail_ssl_module.xml @ 2635:bf8e98fe085f
Linux packages: use $releasever_major in SLES repository instructions.
On SLES service packs, $releasever holds a major number (e.g. 12), a dot and a
minor number of a service pack (e.g. 5). Since we don't ship packages per-SP
for that distribution, but rather the lowest common, we should point our users
accordingly.
author | Konstantin Pavlov <thresh@nginx.com> |
---|---|
date | Tue, 08 Dec 2020 14:07:49 +0300 |
parents | d8bf37d20449 |
children | 78161967514f |
rev | line source |
---|---|
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
1 <?xml version="1.0"?> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
2 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
3 <!-- |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
4 Copyright (C) 2006, 2007 Anton Yuzhaninov |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
5 Copyright (C) Nginx, Inc. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
6 --> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
7 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
9 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
10 <module name="Module ngx_mail_ssl_module" |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
11 link="/en/docs/mail/ngx_mail_ssl_module.html" |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
12 lang="en" |
2616
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
13 rev="21"> |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
14 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
15 <section id="summary"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
16 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
17 <para> |
966 | 18 The <literal>ngx_mail_ssl_module</literal> module provides the necessary |
19 support for a mail proxy server to work with the SSL/TLS protocol. | |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
20 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
21 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
22 <para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
23 This module is not built by default, it should be enabled with |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
24 the <literal>--with-mail_ssl_module</literal> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
25 configuration parameter. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
26 <note> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
27 This module requires the <link url="http://www.openssl.org">OpenSSL</link> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
28 library. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
29 </note> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
30 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
31 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
32 </section> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
33 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
34 |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
35 <section id="example" name="Example Configuration"> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
36 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
37 <para> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
38 To reduce the processor load, it is recommended to |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
39 <list type="bullet"> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
40 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
41 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
42 set the number of |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
43 <link doc="../ngx_core_module.xml" id="worker_processes">worker processes</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
44 equal to the number of processors, |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
45 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
46 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
47 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
48 enable the <link id="ssl_session_cache_shared">shared</link> session cache, |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
49 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
50 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
51 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
52 disable the <link id="ssl_session_cache_builtin">built-in</link> session cache, |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
53 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
54 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
55 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
56 and possibly increase the session <link id="ssl_session_timeout">lifetime</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
57 (by default, 5 minutes): |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
58 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
59 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
60 </list> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
61 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
62 <example> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
63 <emphasis>worker_processes auto;</emphasis> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
64 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
65 mail { |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
66 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
67 ... |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
68 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
69 server { |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
70 listen 993 ssl; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
71 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
72 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
73 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
74 ssl_certificate /usr/local/nginx/conf/cert.pem; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
75 ssl_certificate_key /usr/local/nginx/conf/cert.key; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
76 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
77 <emphasis>ssl_session_timeout 10m;</emphasis> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
78 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
79 ... |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
80 } |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
81 </example> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
82 </para> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
83 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
84 </section> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
85 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
86 |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
87 <section id="directives" name="Directives"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
88 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
89 <directive name="ssl"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
90 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
91 <default>off</default> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
92 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
93 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
94 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
95 <para> |
2168
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2068
diff
changeset
|
96 This directive was made obsolete in version 1.15.0. |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2068
diff
changeset
|
97 The <literal>ssl</literal> parameter |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2068
diff
changeset
|
98 of the <link doc="ngx_mail_core_module.xml" id="listen"/> directive |
3535437f97d2
Deprecated the "ssl" directive for http and mail.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2068
diff
changeset
|
99 should be used instead. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
100 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
101 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
102 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
103 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
104 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
105 <directive name="ssl_certificate"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
106 <syntax><value>file</value></syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
107 <default/> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
108 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
109 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
110 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
111 <para> |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
112 Specifies a <value>file</value> with the certificate in the PEM format |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
113 for the given server. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
114 If intermediate certificates should be specified in addition to a primary |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
115 certificate, they should be specified in the same file in the following |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
116 order: the primary certificate comes first, then the intermediate certificates. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
117 A secret key in the PEM format may be placed in the same file. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
118 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
119 |
1726
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
120 <para> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
121 Since version 1.11.0, |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
122 this directive can be specified multiple times |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
123 to load certificates of different types, for example, RSA and ECDSA: |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
124 <example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
125 server { |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
126 listen 993 ssl; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
127 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
128 ssl_certificate example.com.rsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
129 ssl_certificate_key example.com.rsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
130 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
131 ssl_certificate example.com.ecdsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
132 ssl_certificate_key example.com.ecdsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
133 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
134 ... |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
135 } |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
136 </example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
137 <note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
138 Only OpenSSL 1.0.2 or higher supports separate certificate chains |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
139 for different certificates. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
140 With older versions, only one certificate chain can be used. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
141 </note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
142 </para> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
143 |
2350
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
144 <para id="ssl_certificate_data"> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
145 The value |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
146 <literal>data</literal>:<value>certificate</value> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
147 can be specified instead of the <value>file</value> (1.15.10), |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
148 which loads a certificate without using intermediate files. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
149 Note that inappropriate use of this syntax may have its security implications, |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
150 such as writing secret key data to |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
151 <link doc="../ngx_core_module.xml" id="error_log">error log</link>. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
152 </para> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
153 |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
154 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
155 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
156 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
157 <directive name="ssl_certificate_key"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
158 <syntax><value>file</value></syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
159 <default/> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
160 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
161 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
162 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
163 <para> |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
164 Specifies a <value>file</value> with the secret key in the PEM format |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
165 for the given server. |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
166 </para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
167 |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
168 <para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
169 The value |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
170 <literal>engine</literal>:<value>name</value>:<value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
171 can be specified instead of the <value>file</value> (1.7.9), |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
172 which loads a secret key with a specified <value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1429
diff
changeset
|
173 from the OpenSSL engine <value>name</value>. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
174 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
175 |
2350
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
176 <para id="ssl_certificate_key_data"> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
177 The value |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
178 <literal>data</literal>:<value>key</value> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
179 can be specified instead of the <value>file</value> (1.15.10), |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
180 which loads a secret key without using intermediate files. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
181 Note that inappropriate use of this syntax may have its security implications, |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
182 such as writing secret key data to |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
183 <link doc="../ngx_core_module.xml" id="error_log">error log</link>. |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
184 </para> |
8e35f3af574b
Documented the "data:" syntax for ssl_certificate and key.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2296
diff
changeset
|
185 |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
186 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
187 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
188 |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
189 <directive name="ssl_ciphers"> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
190 <syntax><value>ciphers</value></syntax> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
191 <default>HIGH:!aNULL:!MD5</default> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
192 <context>mail</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
193 <context>server</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
194 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
195 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
196 Specifies the enabled ciphers. |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
197 The ciphers are specified in the format understood by the |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
198 OpenSSL library, for example: |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
199 <example> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
200 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
201 </example> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
202 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
203 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
204 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
205 The full list can be viewed using the |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
206 “<command>openssl ciphers</command>” command. |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
207 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
208 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
209 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
210 <note> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
211 The previous versions of nginx used |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
212 <link doc="../http/configuring_https_servers.xml" id="compatibility">different</link> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
213 ciphers by default. |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
214 </note> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
215 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
216 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
217 </directive> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
218 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
219 |
1429
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
220 <directive name="ssl_client_certificate"> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
221 <syntax><value>file</value></syntax> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
222 <default/> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
223 <context>mail</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
224 <context>server</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
225 <appeared-in>1.7.11</appeared-in> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
226 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
227 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
228 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
229 used to <link id="ssl_verify_client">verify</link> client certificates. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
230 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
231 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
232 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
233 The list of certificates will be sent to clients. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
234 If this is not desired, the <link id="ssl_trusted_certificate"/> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
235 directive can be used. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
236 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
237 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
238 </directive> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
239 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
240 |
2616
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
241 <directive name="ssl_conf_command"> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
242 <syntax><value>command</value></syntax> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
243 <default/> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
244 <context>mail</context> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
245 <context>server</context> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
246 <appeared-in>1.19.4</appeared-in> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
247 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
248 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
249 Sets arbitrary OpenSSL configuration |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
250 <link url="https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html">commands</link>. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
251 <note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
252 The directive is supported when using OpenSSL 1.0.2 or higher. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
253 </note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
254 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
255 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
256 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
257 Several <literal>ssl_conf_command</literal> directives |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
258 can be specified on the same level: |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
259 <example> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
260 ssl_conf_command Options PrioritizeChaCha; |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
261 ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
262 </example> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
263 These directives are inherited from the previous configuration level |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
264 if and only if there are no <literal>ssl_conf_command</literal> directives |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
265 defined on the current level. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
266 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
267 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
268 <para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
269 <note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
270 Note that configuring OpenSSL directly |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
271 might result in unexpected behavior. |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
272 </note> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
273 </para> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
274 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
275 </directive> |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
276 |
d8bf37d20449
Documented the ssl_conf_command directive.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
2350
diff
changeset
|
277 |
1429
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
278 <directive name="ssl_crl"> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
279 <syntax><value>file</value></syntax> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
280 <default/> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
281 <context>mail</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
282 <context>server</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
283 <appeared-in>1.7.11</appeared-in> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
284 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
285 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
286 Specifies a <value>file</value> with revoked certificates (CRL) |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
287 in the PEM format used to <link id="ssl_verify_client">verify</link> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
288 client certificates. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
289 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
290 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
291 </directive> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
292 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
293 |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
294 <directive name="ssl_dhparam"> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
295 <syntax><value>file</value></syntax> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
296 <default/> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
297 <context>mail</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
298 <context>server</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
299 <appeared-in>0.7.2</appeared-in> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
300 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
301 <para> |
1706
6f5497797cde
Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents:
1521
diff
changeset
|
302 Specifies a <value>file</value> with DH parameters for DHE ciphers. |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
303 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
304 |
2296
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
305 <para> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
306 By default no parameters are set, |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
307 and therefore DHE ciphers will not be used. |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
308 <note> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
309 Prior to version 1.11.0, builtin parameters were used by default. |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
310 </note> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
311 </para> |
e2e71f9477a8
Added note about ssl_dhparam defaults.
Sergey Kandaurov <pluknet@nginx.com>
parents:
2168
diff
changeset
|
312 |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
313 </directive> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
314 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
315 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
316 <directive name="ssl_ecdh_curve"> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
317 <syntax><value>curve</value></syntax> |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
318 <default>auto</default> |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
319 <context>mail</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
320 <context>server</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
321 <appeared-in>1.1.0</appeared-in> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
322 <appeared-in>1.0.6</appeared-in> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
323 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
324 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
325 Specifies a <value>curve</value> for ECDHE ciphers. |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
326 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
327 |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
328 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
329 When using OpenSSL 1.0.2 or higher, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
330 it is possible to specify multiple curves (1.11.0), for example: |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
331 <example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
332 ssl_ecdh_curve prime256v1:secp384r1; |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
333 </example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
334 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
335 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
336 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
337 The special value <literal>auto</literal> (1.11.0) instructs nginx to use |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
338 a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
339 or <literal>prime256v1</literal> with older versions. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
340 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
341 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
342 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
343 <note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
344 Prior to version 1.11.0, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
345 the <literal>prime256v1</literal> curve was used by default. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
346 </note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
347 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
348 |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
349 </directive> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
350 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
351 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
352 <directive name="ssl_password_file"> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
353 <syntax><value>file</value></syntax> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
354 <default/> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
355 <context>mail</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
356 <context>server</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
357 <appeared-in>1.7.3</appeared-in> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
358 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
359 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
360 Specifies a <value>file</value> with passphrases for |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
361 <link id="ssl_certificate_key">secret keys</link> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
362 where each passphrase is specified on a separate line. |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
363 Passphrases are tried in turn when loading the key. |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
364 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
365 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
366 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
367 Example: |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
368 <example> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
369 mail { |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
370 ssl_password_file /etc/keys/global.pass; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
371 ... |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
372 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
373 server { |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
374 server_name mail1.example.com; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
375 ssl_certificate_key /etc/keys/first.key; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
376 } |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
377 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
378 server { |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
379 server_name mail2.example.com; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
380 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
381 # named pipe can also be used instead of a file |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
382 ssl_password_file /etc/keys/fifo; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
383 ssl_certificate_key /etc/keys/second.key; |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
384 } |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
385 } |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
386 </example> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
387 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
388 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
389 </directive> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
390 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
391 |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
392 <directive name="ssl_prefer_server_ciphers"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
393 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
394 <default>off</default> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
395 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
396 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
397 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
398 <para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
399 Specifies that server ciphers should be preferred over client ciphers |
966 | 400 when the SSLv3 and TLS protocols are used. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
401 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
402 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
403 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
404 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
405 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
406 <directive name="ssl_protocols"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
407 <syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
408 [<literal>SSLv2</literal>] |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
409 [<literal>SSLv3</literal>] |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
410 [<literal>TLSv1</literal>] |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
411 [<literal>TLSv1.1</literal>] |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
412 [<literal>TLSv1.2</literal>] |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
413 [<literal>TLSv1.3</literal>]</syntax> |
1499
3687cc9a3592
Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1456
diff
changeset
|
414 <default>TLSv1 TLSv1.1 TLSv1.2</default> |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
415 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
416 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
417 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
418 <para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
419 Enables the specified protocols. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
420 <note> |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
421 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
422 (1.1.13, 1.0.12) work only when OpenSSL 1.0.1 or higher is used. |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
423 </note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
424 <note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
425 The <literal>TLSv1.3</literal> parameter (1.13.0) works only when |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1924
diff
changeset
|
426 OpenSSL 1.1.1 built with TLSv1.3 support is used. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
427 </note> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
428 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
429 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
430 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
431 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
432 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
433 <directive name="ssl_session_cache"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
434 <syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
435 <literal>off</literal> | |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
436 <literal>none</literal> | |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
437 [<literal>builtin</literal>[:<value>size</value>]] |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
438 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
439 <default>none</default> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
440 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
441 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
442 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
443 <para> |
966 | 444 Sets the types and sizes of caches that store session parameters. |
445 A cache can be of any of the following types: | |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
446 <list type="tag"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
447 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
448 <tag-name><literal>off</literal></tag-name> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
449 <tag-desc> |
966 | 450 the use of a session cache is strictly prohibited: |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
451 nginx explicitly tells a client that sessions may not be reused. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
452 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
453 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
454 <tag-name><literal>none</literal></tag-name> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
455 <tag-desc> |
966 | 456 the use of a session cache is gently disallowed: |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
457 nginx tells a client that sessions may be reused, but does not |
966 | 458 actually store session parameters in the cache. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
459 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
460 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
461 <tag-name id="ssl_session_cache_builtin"><literal>builtin</literal></tag-name> |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
462 <tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
463 a cache built in OpenSSL; used by one worker process only. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
464 The cache size is specified in sessions. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
465 If size is not given, it is equal to 20480 sessions. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
466 Use of the built-in cache can cause memory fragmentation. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
467 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
468 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
469 <tag-name id="ssl_session_cache_shared"><literal>shared</literal></tag-name> |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
470 <tag-desc> |
966 | 471 a cache shared between all worker processes. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
472 The cache size is specified in bytes; one megabyte can store |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
473 about 4000 sessions. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
474 Each shared cache should have an arbitrary name. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
475 A cache with the same name can be used in several |
751
9c1ffd02f1b7
Removed "virtual" and HTTPS references from mail modules.
Vladimir Homutov <vl@nginx.com>
parents:
664
diff
changeset
|
476 servers. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
477 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
478 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
479 </list> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
480 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
481 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
482 <para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
483 Both cache types can be used simultaneously, for example: |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
484 <example> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
485 ssl_session_cache builtin:1000 shared:SSL:10m; |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
486 </example> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
487 but using only shared cache without the built-in cache should |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
488 be more efficient. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
489 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
490 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
491 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
492 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
493 |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
494 <directive name="ssl_session_ticket_key"> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
495 <syntax><value>file</value></syntax> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
496 <default/> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
497 <context>mail</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
498 <context>server</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
499 <appeared-in>1.5.7</appeared-in> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
500 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
501 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
502 Sets a <value>file</value> with the secret key used to encrypt |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
503 and decrypt TLS session tickets. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
504 The directive is necessary if the same key has to be shared between |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
505 multiple servers. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
506 By default, a randomly generated key is used. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
507 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
508 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
509 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
510 If several keys are specified, only the first key is |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
511 used to encrypt TLS session tickets. |
1144
ac131944d349
Changed infinitive to gerund after "allow".
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1019
diff
changeset
|
512 This allows configuring key rotation, for example: |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
513 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
514 ssl_session_ticket_key current.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
515 ssl_session_ticket_key previous.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
516 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
517 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
518 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
519 <para> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1785
diff
changeset
|
520 The <value>file</value> must contain 80 or 48 bytes |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1785
diff
changeset
|
521 of random data and can be created using the following command: |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
522 <example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1785
diff
changeset
|
523 openssl rand 80 > ticket.key |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
524 </example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1785
diff
changeset
|
525 Depending on the file size either AES256 (for 80-byte keys, 1.11.8) |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1785
diff
changeset
|
526 or AES128 (for 48-byte keys) is used for encryption. |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
527 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
528 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
529 </directive> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
530 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
531 |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
532 <directive name="ssl_session_tickets"> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
533 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
534 <default>on</default> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
535 <context>mail</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
536 <context>server</context> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
537 <appeared-in>1.5.9</appeared-in> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
538 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
539 <para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
540 Enables or disables session resumption through |
1923
66a30a380fba
Fixed links to tools.ietf.org.
Ruslan Ermilov <ru@nginx.com>
parents:
1877
diff
changeset
|
541 <link url="https://tools.ietf.org/html/rfc5077">TLS session tickets</link>. |
1266
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
542 </para> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
543 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
544 </directive> |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
545 |
35d6ac64bf27
Documented five directives in the mail ssl module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1144
diff
changeset
|
546 |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
547 <directive name="ssl_session_timeout"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
548 <syntax><value>time</value></syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
549 <default>5m</default> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
550 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
551 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
552 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
553 <para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
554 Specifies a time during which a client may reuse the |
1785
3fa0944ddc6a
Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
555 session parameters. |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
556 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
557 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
558 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
559 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
560 |
1429
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
561 <directive name="ssl_trusted_certificate"> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
562 <syntax><value>file</value></syntax> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
563 <default/> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
564 <context>mail</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
565 <context>server</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
566 <appeared-in>1.7.11</appeared-in> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
567 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
568 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
569 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
570 used to <link id="ssl_verify_client">verify</link> client certificates. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
571 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
572 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
573 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
574 In contrast to the certificate set by <link id="ssl_client_certificate"/>, |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
575 the list of these certificates will not be sent to clients. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
576 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
577 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
578 </directive> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
579 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
580 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
581 <directive name="ssl_verify_client"> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
582 <syntax> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
583 <literal>on</literal> | <literal>off</literal> | |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
584 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
585 <default>off</default> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
586 <context>mail</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
587 <context>server</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
588 <appeared-in>1.7.11</appeared-in> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
589 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
590 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
591 Enables verification of client certificates. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
592 The verification result is passed in the |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
593 <header>Auth-SSL-Verify</header> header of the |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
594 <link doc="ngx_mail_auth_http_module.xml" id="auth_http">authentication</link> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
595 request. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
596 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
597 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
598 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
599 The <literal>optional</literal> parameter requests the client |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
600 certificate and verifies it if the certificate is present. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
601 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
602 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
603 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
604 The <literal>optional_no_ca</literal> parameter |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
605 requests the client |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
606 certificate but does not require it to be signed by a trusted CA certificate. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
607 This is intended for the use in cases when a service that is external to nginx |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
608 performs the actual certificate verification. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
609 The contents of the certificate is accessible through requests |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
610 <link doc="ngx_mail_auth_http_module.xml" |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
611 id="auth_http_pass_client_cert">sent</link> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
612 to the authentication server. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
613 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
614 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
615 </directive> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
616 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
617 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
618 <directive name="ssl_verify_depth"> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
619 <syntax><value>number</value></syntax> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
620 <default>1</default> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
621 <context>mail</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
622 <context>server</context> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
623 <appeared-in>1.7.11</appeared-in> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
624 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
625 <para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
626 Sets the verification depth in the client certificates chain. |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
627 </para> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
628 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
629 </directive> |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
630 |
06322891b4e3
Client certificate directives in mail_ssl_module and associates.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1266
diff
changeset
|
631 |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
632 <directive name="starttls"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
633 <syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
634 <literal>on</literal> | |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
635 <literal>off</literal> | |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
636 <literal>only</literal></syntax> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
637 <default>off</default> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
638 <context>mail</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
639 <context>server</context> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
640 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
641 <para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
642 <list type="tag"> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
643 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
644 <tag-name><literal>on</literal></tag-name> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
645 <tag-desc> |
966 | 646 allow usage of the <literal>STLS</literal> command for the POP3 |
1924
237a10fb98d2
Clarified imap/pop3/smtp_capabilities and starttls interaction.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
647 and the <literal>STARTTLS</literal> command for the IMAP and SMTP; |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
648 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
649 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
650 <tag-name><literal>off</literal></tag-name> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
651 <tag-desc> |
966 | 652 deny usage of the <literal>STLS</literal> |
664
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
653 and <literal>STARTTLS</literal> commands; |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
654 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
655 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
656 <tag-name><literal>only</literal></tag-name> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
657 <tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
658 require preliminary TLS transition. |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
659 </tag-desc> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
660 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
661 </list> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
662 </para> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
663 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
664 </directive> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
665 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
666 </section> |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
667 |
8283b1048b27
Translated mail modules into English.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
668 </module> |