Mercurial > hg > nginx-site
annotate xml/en/docs/stream/ngx_stream_ssl_module.xml @ 2254:d765ffffd08c
Documented proxy_socket_keepalive and friends.
author | Yaroslav Zhuravlev <yar@nginx.com> |
---|---|
date | Tue, 09 Oct 2018 19:56:33 +0300 |
parents | 3d9e7993c201 |
children | e2e71f9477a8 |
rev | line source |
---|---|
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1 <?xml version="1.0"?> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
2 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
3 <!-- |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
4 Copyright (C) Nginx, Inc. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
5 --> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
6 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
7 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 <module name="Module ngx_stream_ssl_module" |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 link="/en/docs/stream/ngx_stream_ssl_module.html" |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
11 lang="en" |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
12 rev="18"> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
13 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 <section id="summary"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 <para> |
1462
e69e4dbcc760
Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents:
1456
diff
changeset
|
17 The <literal>ngx_stream_ssl_module</literal> module (1.9.0) |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
18 provides the necessary support for a stream proxy server to work with |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
19 the SSL/TLS protocol. |
1462
e69e4dbcc760
Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents:
1456
diff
changeset
|
20 This module is not built by default, it should be enabled with the |
e69e4dbcc760
Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents:
1456
diff
changeset
|
21 <literal>--with-stream_ssl_module</literal> |
e69e4dbcc760
Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents:
1456
diff
changeset
|
22 configuration parameter. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
23 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
24 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
25 </section> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
26 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
27 |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
28 <section id="example" name="Example Configuration"> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
29 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
30 <para> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
31 To reduce the processor load, it is recommended to |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
32 <list type="bullet"> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
33 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
34 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
35 set the number of |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
36 <link doc="../ngx_core_module.xml" id="worker_processes">worker processes</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
37 equal to the number of processors, |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
38 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
39 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
40 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
41 enable the <link id="ssl_session_cache_shared">shared</link> session cache, |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
42 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
43 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
44 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
45 disable the <link id="ssl_session_cache_builtin">built-in</link> session cache, |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
46 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
47 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
48 <listitem> |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
49 and possibly increase the session <link id="ssl_session_timeout">lifetime</link> |
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
50 (by default, 5 minutes): |
1521
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
51 </listitem> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
52 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
53 </list> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
54 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
55 <example> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
56 <emphasis>worker_processes auto;</emphasis> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
57 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
58 stream { |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
59 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
60 ... |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
61 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
62 server { |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
63 listen 12345 ssl; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
64 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
65 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
66 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
67 ssl_certificate /usr/local/nginx/conf/cert.pem; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
68 ssl_certificate_key /usr/local/nginx/conf/cert.key; |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
69 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
70 <emphasis>ssl_session_timeout 10m;</emphasis> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
71 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
72 ... |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
73 } |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
74 </example> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
75 </para> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
76 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
77 </section> |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
78 |
e3d3e2ed4275
Added example configuration to mail and stream ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1499
diff
changeset
|
79 |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
80 <section id="directives" name="Directives"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
81 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 <directive name="ssl_certificate"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 <syntax><value>file</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 <default/> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 <para> |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
89 Specifies a <value>file</value> with the certificate in the PEM format |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
90 for the given server. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 If intermediate certificates should be specified in addition to a primary |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 certificate, they should be specified in the same file in the following |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 order: the primary certificate comes first, then the intermediate certificates. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 A secret key in the PEM format may be placed in the same file. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
95 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 |
1726
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
97 <para> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
98 Since version 1.11.0, |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
99 this directive can be specified multiple times |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
100 to load certificates of different types, for example, RSA and ECDSA: |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
101 <example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
102 server { |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
103 listen 12345 ssl; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
104 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
105 ssl_certificate example.com.rsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
106 ssl_certificate_key example.com.rsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
107 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
108 ssl_certificate example.com.ecdsa.crt; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
109 ssl_certificate_key example.com.ecdsa.key; |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
110 |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
111 ... |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
112 } |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
113 </example> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
114 <note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
115 Only OpenSSL 1.0.2 or higher supports separate certificate chains |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
116 for different certificates. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
117 With older versions, only one certificate chain can be used. |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
118 </note> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
119 </para> |
a0bc284941f6
Documented multiple certificates support.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1711
diff
changeset
|
120 |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
121 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
122 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
123 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
124 <directive name="ssl_certificate_key"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
125 <syntax><value>file</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
126 <default/> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
127 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
128 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
129 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
130 <para> |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
131 Specifies a <value>file</value> with the secret key in the PEM format |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
132 for the given server. |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
133 </para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
134 |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
135 <para> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
136 The value |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
137 <literal>engine</literal>:<value>name</value>:<value>id</value> |
1462
e69e4dbcc760
Documented OSS stream modules.
Vladimir Homutov <vl@nginx.com>
parents:
1456
diff
changeset
|
138 can be specified instead of the <value>file</value>, |
1456
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
139 which loads a secret key with a specified <value>id</value> |
acba294382d6
Documented engine support in ssl_certificate_key and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1450
diff
changeset
|
140 from the OpenSSL engine <value>name</value>. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
143 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
145 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
146 <directive name="ssl_ciphers"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
147 <syntax><value>ciphers</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 <default>HIGH:!aNULL:!MD5</default> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
150 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
151 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
152 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
153 Specifies the enabled ciphers. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
154 The ciphers are specified in the format understood by the |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
155 OpenSSL library, for example: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
156 <example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
157 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
158 </example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
159 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
160 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
161 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
162 The full list can be viewed using the |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
163 “<command>openssl ciphers</command>” command. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
164 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
165 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
166 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
167 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
168 |
1869
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
169 <directive name="ssl_client_certificate"> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
170 <syntax><value>file</value></syntax> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
171 <default/> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
172 <context>stream</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
173 <context>server</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
174 <appeared-in>1.11.8</appeared-in> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
175 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
176 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
177 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
178 used to <link id="ssl_verify_client">verify</link> client certificates. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
179 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
180 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
181 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
182 The list of certificates will be sent to clients. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
183 If this is not desired, the <link id="ssl_trusted_certificate"/> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
184 directive can be used. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
185 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
186 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
187 </directive> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
188 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
189 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
190 <directive name="ssl_crl"> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
191 <syntax><value>file</value></syntax> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
192 <default/> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
193 <context>stream</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
194 <context>server</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
195 <appeared-in>1.11.8</appeared-in> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
196 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
197 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
198 Specifies a <value>file</value> with revoked certificates (CRL) |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
199 in the PEM format used to <link id="ssl_verify_client">verify</link> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
200 client certificates. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
201 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
202 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
203 </directive> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
204 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
205 |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
206 <directive name="ssl_dhparam"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
207 <syntax><value>file</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
208 <default/> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
209 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
210 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
211 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
212 <para> |
1706
6f5497797cde
Changed "EDH ciphers" to "DHE ciphers".
Maxim Dounin <mdounin@mdounin.ru>
parents:
1521
diff
changeset
|
213 Specifies a <value>file</value> with DH parameters for DHE ciphers. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
217 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
218 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
219 <directive name="ssl_ecdh_curve"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
220 <syntax><value>curve</value></syntax> |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
221 <default>auto</default> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
222 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
223 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
224 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
225 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
226 Specifies a <value>curve</value> for ECDHE ciphers. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
227 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
228 |
1711
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
229 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
230 When using OpenSSL 1.0.2 or higher, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
231 it is possible to specify multiple curves (1.11.0), for example: |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
232 <example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
233 ssl_ecdh_curve prime256v1:secp384r1; |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
234 </example> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
235 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
236 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
237 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
238 The special value <literal>auto</literal> (1.11.0) instructs nginx to use |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
239 a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
240 or <literal>prime256v1</literal> with older versions. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
241 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
242 |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
243 <para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
244 <note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
245 Prior to version 1.11.0, |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
246 the <literal>prime256v1</literal> curve was used by default. |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
247 </note> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
248 </para> |
38fb3e6b71e8
Documented ssl_ecdh_curve changes in 1.11.0.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1706
diff
changeset
|
249 |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
250 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
251 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
253 <directive name="ssl_handshake_timeout"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
254 <syntax><value>time</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 <default>60s</default> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
257 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
258 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
259 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 Specifies a timeout for the SSL handshake to complete. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
264 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
265 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
266 <directive name="ssl_password_file"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
267 <syntax><value>file</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
268 <default/> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
269 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
270 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
271 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
272 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
273 Specifies a <value>file</value> with passphrases for |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
274 <link id="ssl_certificate_key">secret keys</link> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
275 where each passphrase is specified on a separate line. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 Passphrases are tried in turn when loading the key. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
277 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
278 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
279 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
280 Example: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
281 <example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 stream { |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 ssl_password_file /etc/keys/global.pass; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 ... |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
285 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
286 server { |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
287 listen 127.0.0.1:12345; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
288 ssl_certificate_key /etc/keys/first.key; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
289 } |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
290 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
291 server { |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
292 listen 127.0.0.1:12346; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
293 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
294 # named pipe can also be used instead of a file |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
295 ssl_password_file /etc/keys/fifo; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
296 ssl_certificate_key /etc/keys/second.key; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 } |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 } |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
299 </example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
300 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
301 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
302 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
303 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
304 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
305 <directive name="ssl_prefer_server_ciphers"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
306 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
307 <default>off</default> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
308 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
309 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
310 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
311 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
312 Specifies that server ciphers should be preferred over client ciphers |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
313 when the SSLv3 and TLS protocols are used. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
314 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
315 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
316 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
317 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
318 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
319 <directive name="ssl_protocols"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
320 <syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
321 [<literal>SSLv2</literal>] |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
322 [<literal>SSLv3</literal>] |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
323 [<literal>TLSv1</literal>] |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
324 [<literal>TLSv1.1</literal>] |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
325 [<literal>TLSv1.2</literal>] |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
326 [<literal>TLSv1.3</literal>]</syntax> |
1499
3687cc9a3592
Removed SSLv3 from the default value of ssl_protocols and friends.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1462
diff
changeset
|
327 <default>TLSv1 TLSv1.1 TLSv1.2</default> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
328 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
329 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
330 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
331 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
332 Enables the specified protocols. |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
333 <note> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
334 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters work |
1978
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
335 only when OpenSSL 1.0.1 or higher is used. |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
336 </note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
337 <note> |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
338 The <literal>TLSv1.3</literal> parameter (1.13.0) works only when |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
339 OpenSSL 1.1.1 built with TLSv1.3 support is used. |
8f1a568a8bbf
Documented "TLSv1.3" parameter of the "ssl_protocols" directive.
Sergey Kandaurov <pluknet@nginx.com>
parents:
1923
diff
changeset
|
340 </note> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
342 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
343 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
344 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
345 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
346 <directive name="ssl_session_cache"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
347 <syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
348 <literal>off</literal> | |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
349 <literal>none</literal> | |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
350 [<literal>builtin</literal>[:<value>size</value>]] |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
351 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
352 <default>none</default> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
353 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
354 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
355 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
356 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
357 Sets the types and sizes of caches that store session parameters. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
358 A cache can be of any of the following types: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
359 <list type="tag"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
360 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
361 <tag-name><literal>off</literal></tag-name> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
362 <tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
363 the use of a session cache is strictly prohibited: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
364 nginx explicitly tells a client that sessions may not be reused. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
365 </tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
366 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
367 <tag-name><literal>none</literal></tag-name> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
368 <tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
369 the use of a session cache is gently disallowed: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
370 nginx tells a client that sessions may be reused, but does not |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
371 actually store session parameters in the cache. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
372 </tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
373 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
374 <tag-name id="ssl_session_cache_builtin"><literal>builtin</literal></tag-name> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
375 <tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
376 a cache built in OpenSSL; used by one worker process only. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
377 The cache size is specified in sessions. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
378 If size is not given, it is equal to 20480 sessions. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
379 Use of the built-in cache can cause memory fragmentation. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
380 </tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
381 |
2068
3d9e7993c201
Added links to directives in the example of ssl modules.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1978
diff
changeset
|
382 <tag-name id="ssl_session_cache_shared"><literal>shared</literal></tag-name> |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
383 <tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
384 a cache shared between all worker processes. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
385 The cache size is specified in bytes; one megabyte can store |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
386 about 4000 sessions. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
387 Each shared cache should have an arbitrary name. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
388 A cache with the same name can be used in several |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
389 servers. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
390 </tag-desc> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
391 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
392 </list> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
393 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
394 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
395 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
396 Both cache types can be used simultaneously, for example: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
397 <example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
398 ssl_session_cache builtin:1000 shared:SSL:10m; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
399 </example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
400 but using only shared cache without the built-in cache should |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
401 be more efficient. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
402 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
403 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
404 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
405 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
406 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
407 <directive name="ssl_session_ticket_key"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
408 <syntax><value>file</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
409 <default/> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
410 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
411 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
412 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
413 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
414 Sets a <value>file</value> with the secret key used to encrypt |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
415 and decrypt TLS session tickets. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
416 The directive is necessary if the same key has to be shared between |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
417 multiple servers. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
418 By default, a randomly generated key is used. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
419 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
420 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
421 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
422 If several keys are specified, only the first key is |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
423 used to encrypt TLS session tickets. |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
424 This allows configuring key rotation, for example: |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
425 <example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
426 ssl_session_ticket_key current.key; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
427 ssl_session_ticket_key previous.key; |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
428 </example> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
429 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
430 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
431 <para> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1876
diff
changeset
|
432 The <value>file</value> must contain 80 or 48 bytes |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1876
diff
changeset
|
433 of random data and can be created using the following command: |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
434 <example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1876
diff
changeset
|
435 openssl rand 80 > ticket.key |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
436 </example> |
1877
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1876
diff
changeset
|
437 Depending on the file size either AES256 (for 80-byte keys, 1.11.8) |
aa29a64a5e9d
Documented ssl_session_ticket_key 80-byte keys.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1876
diff
changeset
|
438 or AES128 (for 48-byte keys) is used for encryption. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
439 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
440 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
441 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
442 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
443 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
444 <directive name="ssl_session_tickets"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
445 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
446 <default>on</default> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
447 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
448 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
449 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
450 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
451 Enables or disables session resumption through |
1923
66a30a380fba
Fixed links to tools.ietf.org.
Ruslan Ermilov <ru@nginx.com>
parents:
1877
diff
changeset
|
452 <link url="https://tools.ietf.org/html/rfc5077">TLS session tickets</link>. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
453 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
454 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
455 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
456 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
457 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
458 <directive name="ssl_session_timeout"> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
459 <syntax><value>time</value></syntax> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
460 <default>5m</default> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
461 <context>stream</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
462 <context>server</context> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
463 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
464 <para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
465 Specifies a time during which a client may reuse the |
1785
3fa0944ddc6a
Removed info about session cache from ssl_session_timeout.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1745
diff
changeset
|
466 session parameters. |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
467 </para> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
468 |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
469 </directive> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
470 |
1869
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
471 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
472 <directive name="ssl_trusted_certificate"> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
473 <syntax><value>file</value></syntax> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
474 <default/> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
475 <context>stream</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
476 <context>server</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
477 <appeared-in>1.11.8</appeared-in> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
478 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
479 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
480 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
481 used to <link id="ssl_verify_client">verify</link> client certificates. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
482 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
483 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
484 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
485 In contrast to the certificate set by <link id="ssl_client_certificate"/>, |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
486 the list of these certificates will not be sent to clients. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
487 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
488 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
489 </directive> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
490 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
491 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
492 <directive name="ssl_verify_client"> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
493 <syntax> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
494 <literal>on</literal> | <literal>off</literal> | |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
495 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
496 <default>off</default> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
497 <context>stream</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
498 <context>server</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
499 <appeared-in>1.11.8</appeared-in> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
500 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
501 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
502 Enables verification of client certificates. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
503 The verification result is stored in the |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
504 <link id="var_ssl_client_verify">$ssl_client_verify</link> variable. |
1876
b451f03e0a4b
Described behavior of stream ssl_verify_client in case of error.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1869
diff
changeset
|
505 If an error has occurred during the client certificate verification |
b451f03e0a4b
Described behavior of stream ssl_verify_client in case of error.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1869
diff
changeset
|
506 or a client has not presented the required certificate, |
b451f03e0a4b
Described behavior of stream ssl_verify_client in case of error.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1869
diff
changeset
|
507 the connection is closed. |
1869
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
508 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
509 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
510 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
511 The <literal>optional</literal> parameter requests the client |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
512 certificate and verifies it if the certificate is present. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
513 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
514 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
515 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
516 The <literal>optional_no_ca</literal> parameter |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
517 requests the client |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
518 certificate but does not require it to be signed by a trusted CA certificate. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
519 This is intended for the use in cases when a service that is external to nginx |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
520 performs the actual certificate verification. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
521 The contents of the certificate is accessible through the |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
522 <link id="var_ssl_client_cert">$ssl_client_cert</link> variable. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
523 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
524 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
525 </directive> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
526 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
527 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
528 <directive name="ssl_verify_depth"> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
529 <syntax><value>number</value></syntax> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
530 <default>1</default> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
531 <context>stream</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
532 <context>server</context> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
533 <appeared-in>1.11.8</appeared-in> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
534 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
535 <para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
536 Sets the verification depth in the client certificates chain. |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
537 </para> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
538 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
539 </directive> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
540 |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
541 </section> |
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
542 |
1745
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
543 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
544 <section id="variables" name="Embedded Variables"> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
545 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
546 <para> |
1790
6da8d19f89c0
Corrected module name in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1785
diff
changeset
|
547 The <literal>ngx_stream_ssl_module</literal> module supports variables |
1745
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
548 since 1.11.2. |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
549 <list type="tag"> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
550 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
551 <tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
552 <tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
553 returns the string of ciphers used |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
554 for an established SSL connection; |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
555 </tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
556 |
1857
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
557 <tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
558 <tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
559 returns the list of ciphers supported by the client (1.11.7). |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
560 Known ciphers are listed by names, unknown are shown in hexadecimal, |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
561 for example: |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
562 <example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
563 AES128-SHA:AES256-SHA:0x00ff |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
564 </example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
565 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
566 The variable is fully supported only when using OpenSSL version 1.0.2 or higher. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
567 With older versions, the variable is available |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
568 only for new sessions and lists only known ciphers. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
569 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
570 </tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
571 |
1869
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
572 <tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
573 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
574 returns the client certificate in the PEM format |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
575 for an established SSL connection, with each line except the first |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
576 prepended with the tab character (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
577 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
578 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
579 <tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
580 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
581 returns the SHA1 fingerprint of the client certificate |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
582 for an established SSL connection (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
583 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
584 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
585 <tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
586 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
587 returns the “issuer DN” string of the client certificate |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
588 for an established SSL connection according to |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
589 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
590 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
591 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
592 <tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
593 </tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
594 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
595 returns the client certificate in the PEM format |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
596 for an established SSL connection (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
597 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
598 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
599 <tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
600 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
601 returns the “subject DN” string of the client certificate |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
602 for an established SSL connection according to |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
603 <link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
604 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
605 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
606 <tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
607 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
608 returns the serial number of the client certificate |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
609 for an established SSL connection (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
610 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
611 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
612 <tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
613 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
614 returns the end date of the client certificate (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
615 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
616 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
617 <tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
618 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
619 returns the number of days |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
620 until the client certificate expires (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
621 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
622 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
623 <tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
624 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
625 returns the start date of the client certificate (1.11.8); |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
626 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
627 |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
628 <tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
629 <tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
630 returns the result of client certificate verification (1.11.8): |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
631 “<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”, |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
632 and “<literal>NONE</literal>” if a certificate was not present; |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
633 </tag-desc> |
e1d0b56c0310
Documented support for client certificate verification in stream.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1857
diff
changeset
|
634 |
1857
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
635 <tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
636 <tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
637 returns the list of curves supported by the client (1.11.7). |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
638 Known curves are listed by names, unknown are shown in hexadecimal, |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
639 for example: |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
640 <example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
641 0x001d:prime256v1:secp521r1:secp384r1 |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
642 </example> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
643 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
644 The variable is supported only when using OpenSSL version 1.0.2 or higher. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
645 With older versions, the variable value will be an empty string. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
646 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
647 <note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
648 The variable is available only for new sessions. |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
649 </note> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
650 </tag-desc> |
0882ccb0c00f
Documented the $ssl_curves and $ssl_ciphers variables.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1790
diff
changeset
|
651 |
1745
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
652 <tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
653 <tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
654 returns the protocol of an established SSL connection; |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
655 </tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
656 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
657 <tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
658 <tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
659 returns the server name requested through |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
660 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>; |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
661 </tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
662 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
663 <tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
664 <tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
665 returns the session identifier of an established SSL connection; |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
666 </tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
667 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
668 <tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
669 <tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
670 returns “<literal>r</literal>” if an SSL session was reused, |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
671 or “<literal>.</literal>” otherwise. |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
672 </tag-desc> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
673 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
674 </list> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
675 </para> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
676 |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
677 </section> |
0dfb7628bfee
Documented variables in ngx_stream_ssl_module.
Yaroslav Zhuravlev <yar@nginx.com>
parents:
1726
diff
changeset
|
678 |
1450
f5b5eefc43cb
Updated commercial docs for the upcoming release.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
679 </module> |