Mercurial > hg > nginx-site
annotate xml/en/docs/http/ngx_http_ssl_module.xml @ 1027:dd64ce140de2
Status: virtual servers, caches, load_timestamp.
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Wed, 23 Oct 2013 13:36:17 +0400 |
parents | 2b6a858c60dc |
children | f7ca80263893 |
rev | line source |
---|---|
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
1 <?xml version="1.0"?> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
2 |
580
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
3 <!-- |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
4 Copyright (C) Igor Sysoev |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
5 Copyright (C) Nginx, Inc. |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
6 --> |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
538
diff
changeset
|
7 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 <!DOCTYPE module SYSTEM "../../../../dtd/module.dtd"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 <module name="Module ngx_http_ssl_module" |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
11 link="/en/docs/http/ngx_http_ssl_module.html" |
589 | 12 lang="en" |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
13 rev="8"> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 <section id="summary"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
17 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
18 The <literal>ngx_http_ssl_module</literal> module provides the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
19 necessary support for HTTPS. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
20 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
21 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
22 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
23 This module is not built by default, it should be enabled with the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
24 <literal>--with-http_ssl_module</literal> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
25 configuration parameter. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
26 <note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
27 This module requires the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
28 <link url="http://www.openssl.org">OpenSSL</link> library. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
29 </note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
30 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
31 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
32 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
33 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
34 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
35 <section id="example" name="Example Configuration"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
36 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
37 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
38 To reduce the processor load it is recommended to |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
39 <list type="bullet"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
40 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
41 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
42 set the number of worker processes equal to the number of processors, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
43 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
44 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
45 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
46 enable keep-alive connections, |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
47 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
48 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
49 <listitem> |
966 | 50 enable the shared session cache, |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
51 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
52 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
53 <listitem> |
966 | 54 disable the built-in session cache, |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
55 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
56 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
57 <listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
58 and possibly increase the session lifetime (by default, 5 minutes): |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
59 </listitem> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
60 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
61 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
62 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
63 <example> |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
64 <emphasis>worker_processes auto;</emphasis> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
65 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
66 http { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
67 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
68 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
69 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
70 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
71 listen 443 ssl; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
72 <emphasis>keepalive_timeout 70;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
73 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
74 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
75 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
76 ssl_certificate /usr/local/nginx/conf/cert.pem; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
77 ssl_certificate_key /usr/local/nginx/conf/cert.key; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
78 <emphasis>ssl_session_cache shared:SSL:10m;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
79 <emphasis>ssl_session_timeout 10m;</emphasis> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
80 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
81 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
89 <section id="directives" name="Directives"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
90 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 <directive name="ssl"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
95 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
97 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
98 Enables the HTTPS protocol for the given virtual server. |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
99 <note> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
100 It is recommended to use the <literal>ssl</literal> parameter of the |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
101 <link doc="ngx_http_core_module.xml" id="listen"/> directive instead |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
102 of this directive. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
763
diff
changeset
|
103 </note> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
104 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
105 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
106 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
107 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
108 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
109 <directive name="ssl_certificate"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
110 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
111 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
112 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
113 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
114 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
115 <para> |
966 | 116 Specifies a <value>file</value> with the certificate in the PEM format |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
117 for the given virtual server. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
118 If intermediate certificates should be specified in addition |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
119 to a primary certificate, they should be specified in the same file |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
120 in the following order: the primary certificate comes first, then |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
121 the intermediate certificates. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
122 A secret key in the PEM format may be placed in the same file. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
123 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
124 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
125 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
126 It should be kept in mind that due to the HTTPS protocol limitations |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
127 virtual servers should listen on different IP addresses: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
128 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
129 server { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
130 listen 192.168.1.1:443; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
131 server_name one.example.com; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
132 ssl_certificate /usr/local/nginx/conf/one.example.com.cert; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
133 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
134 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
135 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
136 server { |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
137 listen 192.168.1.2:443; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
138 server_name two.example.com; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
139 ssl_certificate /usr/local/nginx/conf/two.example.com.cert; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
140 ... |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 } |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
143 otherwise |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 <link doc="configuring_https_servers.xml" |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
145 id="name_based_https_servers">the first server’s certificate</link> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
146 will be issued for the second site. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
147 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
150 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
151 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
152 <directive name="ssl_certificate_key"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
153 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
154 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
155 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
156 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
157 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
158 <para> |
966 | 159 Specifies a <value>file</value> with the secret key in the PEM format |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
160 for the given virtual server. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
161 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
162 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
163 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
164 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
165 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
166 <directive name="ssl_ciphers"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
167 <syntax><value>ciphers</value></syntax> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
168 <default>HIGH:!aNULL:!MD5</default> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
169 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
170 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
171 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
172 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
173 Specifies the enabled ciphers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
174 The ciphers are specified in the format understood by the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
175 OpenSSL library, for example: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
176 <example> |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
177 ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
178 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
179 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
180 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
181 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
182 The full list can be viewed using the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
183 “<command>openssl ciphers</command>” command. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
184 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
185 |
538
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
186 <para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
187 <note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
188 The previous versions of nginx used |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
189 <link doc="configuring_https_servers.xml" id="compatibility">different</link> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
190 ciphers by default. |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
191 </note> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
192 </para> |
58dd64aef626
Documented ciphers used by default in modern nginx versions (closes #177).
Ruslan Ermilov <ru@nginx.com>
parents:
393
diff
changeset
|
193 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
194 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
195 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
196 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
197 <directive name="ssl_client_certificate"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
198 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
199 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
200 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
201 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
202 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
203 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
204 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
205 used to verify client certificates and |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
206 OCSP responses if <link id="ssl_stapling"/> is enabled. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
207 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
208 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
209 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
210 The list of certificates will be sent to clients. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
211 If this is not desired, the <link id="ssl_trusted_certificate"/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
212 directive can be used. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
213 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
217 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
218 <directive name="ssl_crl"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
219 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
220 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
221 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
222 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
223 <appeared-in>0.8.7</appeared-in> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
224 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
225 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
226 Specifies a <value>file</value> with revoked certificates (CRL) |
881
d7f2325fa832
Fix up wording in the description of "ssl_crl".
Ruslan Ermilov <ru@nginx.com>
parents:
817
diff
changeset
|
227 in the PEM format used to verify client certificates. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
228 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
229 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
230 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
231 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
232 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
233 <directive name="ssl_dhparam"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
234 <syntax><value>file</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
235 <default/> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
236 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
237 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
238 <appeared-in>0.7.2</appeared-in> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
239 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
240 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
241 Specifies a <value>file</value> with DH parameters for EDH ciphers. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
242 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
243 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
244 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
245 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
246 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
247 <directive name="ssl_prefer_server_ciphers"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
248 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
249 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
250 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
251 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
253 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
254 Specifies that server ciphers should be preferred over client |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 ciphers when using the SSLv3 and TLS protocols. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
257 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
258 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
259 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 <directive name="ssl_protocols"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 [<literal>SSLv2</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
264 [<literal>SSLv3</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
265 [<literal>TLSv1</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
266 [<literal>TLSv1.1</literal>] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
267 [<literal>TLSv1.2</literal>]</syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
268 <default>SSLv3 TLSv1 TLSv1.1 TLSv1.2</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
269 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
270 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
271 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
272 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
273 Enables the specified protocols. |
966 | 274 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters work |
275 only when the OpenSSL library of version 1.0.1 or higher is used. | |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 <note> |
966 | 277 The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters are |
278 supported starting from versions 1.1.13 and 1.0.12, | |
279 so when the OpenSSL version 1.0.1 or higher | |
280 is used on older nginx versions, these protocols work, but cannot | |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
281 be disabled. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 </note> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
285 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
286 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
287 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
288 <directive name="ssl_session_cache"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
289 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
290 <literal>off</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
291 <literal>none</literal> | |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
292 [<literal>builtin</literal>[:<value>size</value>]] |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
293 [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
294 <default>none</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
295 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
296 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 <para> |
966 | 299 Sets the types and sizes of caches that store session parameters. |
300 A cache can be of any of the following types: | |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
301 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
302 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
303 <tag-name><literal>off</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
304 <tag-desc> |
966 | 305 the use of a session cache is strictly prohibited: |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
306 nginx explicitly tells a client that sessions may not be reused. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
307 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
308 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
309 <tag-name><literal>none</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
310 <tag-desc> |
966 | 311 the use of a session cache is gently disallowed: |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
312 nginx tells a client that sessions may be reused, but does not |
966 | 313 actually store session parameters in the cache. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
314 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
315 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
316 <tag-name><literal>builtin</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
317 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
318 a cache built in OpenSSL; used by one worker process only. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
319 The cache size is specified in sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
320 If size is not given, it is equal to 20480 sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
321 Use of the built-in cache can cause memory fragmentation. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
322 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
323 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
324 <tag-name><literal>shared</literal></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
325 <tag-desc> |
966 | 326 a cache shared between all worker processes. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
327 The cache size is specified in bytes; one megabyte can store |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
328 about 4000 sessions. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
329 Each shared cache should have an arbitrary name. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
330 A cache with the same name can be used in several virtual servers. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
331 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
332 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
333 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
334 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
335 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
336 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
337 Both cache types can be used simultaneously, for example: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
338 <example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
339 ssl_session_cache builtin:1000 shared:SSL:10m; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
340 </example> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 but using only shared cache without the built-in cache should |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
342 be more efficient. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
343 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
344 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
345 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
346 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
347 |
1019
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
348 <directive name="ssl_session_ticket_key"> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
349 <syntax><value>file</value></syntax> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
350 <default/> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
351 <context>http</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
352 <context>server</context> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
353 <appeared-in>1.5.7</appeared-in> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
354 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
355 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
356 Sets a <value>file</value> with the secret key used to encrypt |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
357 and decrypt TLS session tickets. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
358 The directive is necessary if the same key has to be shared between |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
359 multiple servers. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
360 By default, a randomly generated key is used. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
361 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
362 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
363 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
364 If several keys are specified, only the first key is |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
365 used to encrypt TLS session tickets. |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
366 This allows to configure key rotation, for example: |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
367 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
368 ssl_session_ticket_key current.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
369 ssl_session_ticket_key previous.key; |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
370 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
371 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
372 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
373 <para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
374 The <value>file</value> must contain 48 bytes of random data and can |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
375 be created using the following command: |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
376 <example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
377 openssl rand 48 > ticket.key |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
378 </example> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
379 </para> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
380 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
381 </directive> |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
382 |
2b6a858c60dc
Documented the "ssl_session_ticket_key" directive in http and mail.
Vladimir Homutov <vl@nginx.com>
parents:
966
diff
changeset
|
383 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
384 <directive name="ssl_session_timeout"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
385 <syntax><value>time</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
386 <default>5m</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
387 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
388 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
389 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
390 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
391 Specifies a time during which a client may reuse the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
392 session parameters stored in a cache. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
393 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
394 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
395 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
396 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
397 |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
398 <directive name="ssl_stapling"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
399 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
400 <default>off</default> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
401 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
402 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
403 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
404 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
405 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
406 Enables or disables |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
407 <link url="http://tools.ietf.org/html/rfc4366#section-3.6">stapling |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
408 of OCSP responses</link> by the server. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
409 Example: |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
410 <example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
411 ssl_stapling on; |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
412 resolver 192.0.2.1; |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
413 </example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
414 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
415 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
416 <para> |
966 | 417 For the OCSP stapling to work, the certificate of the server certificate |
418 issuer should be known. | |
712
2c9e8facc761
Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents:
696
diff
changeset
|
419 If the <link id="ssl_certificate"/> file does |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
420 not contain intermediate certificates, |
966 | 421 the certificate of the server certificate issuer should be |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
422 present in the |
712
2c9e8facc761
Resolved ambiguity regarding lists of certificates and fixed links.
Vladimir Homutov <vl@nginx.com>
parents:
696
diff
changeset
|
423 <link id="ssl_trusted_certificate"/> file. |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
424 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
425 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
426 <para> |
966 | 427 For a resolution of the OCSP responder hostname, |
428 the <link doc="ngx_http_core_module.xml" id="resolver"/> directive | |
429 should also be specified. | |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
430 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
431 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
432 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
433 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
434 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
435 <directive name="ssl_stapling_file"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
436 <syntax><value>file</value></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
437 <default/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
438 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
439 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
440 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
441 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
442 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
443 When set, the stapled OCSP response will be taken from the |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
444 specified <value>file</value> instead of querying |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
445 the OCSP responder specified in the server certificate. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
446 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
447 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
448 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
449 The file should be in the DER format as produced by the |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
450 “<literal>openssl ocsp</literal>” command. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
451 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
452 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
453 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
454 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
455 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
456 <directive name="ssl_stapling_responder"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
457 <syntax><value>url</value></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
458 <default/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
459 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
460 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
461 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
462 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
463 <para> |
966 | 464 Overrides the URL of the OCSP responder specified in the |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
465 “<link url="http://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
466 Information Access</link>” certificate extension. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
467 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
468 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
469 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
470 Only “<literal>http://</literal>” OCSP responders are supported: |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
471 <example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
472 ssl_stapling_responder http://ocsp.example.com/; |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
473 </example> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
474 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
475 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
476 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
477 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
478 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
479 <directive name="ssl_stapling_verify"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
480 <syntax><literal>on</literal> | <literal>off</literal></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
481 <default>off</default> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
482 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
483 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
484 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
485 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
486 <para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
487 Enables or disables verification of OCSP responses by the server. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
488 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
489 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
490 <para> |
966 | 491 For verification to work, the certificate of the server certificate |
492 issuer, the root certificate, and all intermediate certificates | |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
493 should be configured as trusted using the |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
494 <link id="ssl_trusted_certificate"/> directive. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
495 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
496 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
497 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
498 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
499 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
500 <directive name="ssl_trusted_certificate"> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
501 <syntax><value>file</value></syntax> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
502 <default/> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
503 <context>http</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
504 <context>server</context> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
505 <appeared-in>1.3.7</appeared-in> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
506 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
507 <para> |
715
3f25469cbc49
Highlighted 'file' parameters in the http_ssl_module directives.
Vladimir Homutov <vl@nginx.com>
parents:
712
diff
changeset
|
508 Specifies a <value>file</value> with trusted CA certificates in the PEM format |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
509 used to verify client certificates and |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
510 OCSP responses if <link id="ssl_stapling"/> is enabled. |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
511 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
512 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
513 <para> |
966 | 514 In contrast to the certificate set by <link id="ssl_client_certificate"/>, |
515 the list of these certificates will not be sent to clients. | |
695
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
516 </para> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
517 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
518 </directive> |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
519 |
2eb83e89b239
Added the OCSP stapling documentation in English.
Vladimir Homutov <vl@nginx.com>
parents:
589
diff
changeset
|
520 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
521 <directive name="ssl_verify_client"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
522 <syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
523 <literal>on</literal> | <literal>off</literal> | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
524 <literal>optional</literal> | <literal>optional_no_ca</literal></syntax> |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
525 <default>off</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
526 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
527 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
528 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
529 <para> |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
530 Enables verification of client certificates. |
966 | 531 The verification result is stored in the |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
532 <var>$ssl_client_verify</var> variable. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
533 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
534 |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
535 <para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
536 The <literal>optional</literal> parameter (0.8.7+) requests the client |
966 | 537 certificate and verifies it if the certificate is present. |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
538 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
539 |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
540 <para> |
763
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
541 The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5) |
cd581dbdaf76
The "optional_no_ca" parameter of the "ssl_verify_client" directive
Ruslan Ermilov <ru@nginx.com>
parents:
717
diff
changeset
|
542 requests the client |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
543 certificate but does not require it to be signed by a trusted CA certificate. |
966 | 544 This is intended for the use in cases when a service that is external to nginx |
545 performs the actual certificate verification. | |
546 The contents of the certificate is accessible through the | |
717
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
547 <var>$ssl_client_cert</var> variable. |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
548 </para> |
c5facf2eff6f
Documented the recently added "optional_no_ca" parameter of the
Ruslan Ermilov <ru@nginx.com>
parents:
715
diff
changeset
|
549 |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
550 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
551 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
552 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
553 <directive name="ssl_verify_depth"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
554 <syntax><value>number</value></syntax> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
555 <default>1</default> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
556 <context>http</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
557 <context>server</context> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
558 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
559 <para> |
966 | 560 Sets the verification depth in the client certificates chain. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
561 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
562 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
563 </directive> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
564 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
565 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
566 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
567 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
568 <section id="errors" name="Error Processing"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
569 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
570 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
571 The <literal>ngx_http_ssl_module</literal> module supports several |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
572 non-standard error codes that can be used for redirects using the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
573 <link doc="ngx_http_core_module.xml" id="error_page"/> directive: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
574 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
575 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
576 <tag-name>495</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
577 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
578 an error has occurred during the client certificate verification; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
579 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
580 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
581 <tag-name>496</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
582 <tag-desc> |
966 | 583 a client has not presented the required certificate; |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
584 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
585 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
586 <tag-name>497</tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
587 <tag-desc> |
966 | 588 a regular request has been sent to the HTTPS port. |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
589 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
590 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
591 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
592 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
593 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
594 <para> |
966 | 595 The redirection happens after the request is fully parsed and |
596 the variables, such as <var>$request_uri</var>, | |
597 <var>$uri</var>, <var>$args</var> and others, are available. | |
384
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
598 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
599 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
600 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
601 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
602 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
603 <section id="variables" name="Embedded Variables"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
604 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
605 <para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
606 The <literal>ngx_http_ssl_module</literal> module supports |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
607 several embedded variables: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
608 <list type="tag"> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
609 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
610 <tag-name><var>$ssl_cipher</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
611 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
612 returns the string of ciphers used |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
613 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
614 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
615 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
616 <tag-name><var>$ssl_client_cert</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
617 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
618 returns the client certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
619 for an established SSL connection, with each line except the first |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
620 prepended with the tab character; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
621 this is intended for the use in the |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
622 <link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
623 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
624 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
625 <tag-name><var>$ssl_client_raw_cert</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
626 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
627 returns the client certificate in the PEM format |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
628 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
629 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
630 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
631 <tag-name><var>$ssl_client_serial</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
632 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
633 returns the serial number of the client certificate |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
634 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
635 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
636 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
637 <tag-name><var>$ssl_client_s_dn</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
638 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
639 returns the “subject DN” string of the client certificate |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
640 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
641 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
642 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
643 <tag-name><var>$ssl_client_i_dn</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
644 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
645 returns the “issuer DN” string of the client certificate |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
646 for an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
647 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
648 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
649 <tag-name><var>$ssl_client_verify</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
650 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
651 returns the result of client certificate verification: |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
652 “<literal>SUCCESS</literal>”, “<literal>FAILED</literal>”, and |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
653 “<literal>NONE</literal>” if a certificate was not present; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
654 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
655 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
656 <tag-name><var>$ssl_protocol</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
657 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
658 returns the protocol of an established SSL connection; |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
659 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
660 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
661 <tag-name><var>$ssl_session_id</var></tag-name> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
662 <tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
663 returns the session identifier of an established SSL connection. |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
664 </tag-desc> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
665 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
666 </list> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
667 </para> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
668 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
669 </section> |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
670 |
331a86bc51ff
English translation of ngx_http_ssl_module.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
671 </module> |