Mercurial > hg > nginx-site
annotate xml/ru/docs/http/configuring_https_servers.xml @ 1410:f5dcc23b214f
Deleted info about hash and ip_hash from the down parameter.
author | Yaroslav Zhuravlev <yar@nginx.com> |
---|---|
date | Mon, 09 Feb 2015 21:46:50 +0300 |
parents | 4fecf0715bbf |
children | 8fe28c6edaa1 |
rev | line source |
---|---|
580
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
547
diff
changeset
|
1 <!-- |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
547
diff
changeset
|
2 Copyright (C) Igor Sysoev |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
547
diff
changeset
|
3 Copyright (C) Nginx, Inc. |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
547
diff
changeset
|
4 --> |
be54c443235a
Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents:
547
diff
changeset
|
5 |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
6 <!DOCTYPE article SYSTEM "../../../../dtd/article.dtd"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
7 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
8 <article name="Настройка HTTPS-серверов" |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
9 link="/ru/docs/http/configuring_https_servers.html" |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
10 lang="ru" |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
11 rev="6" |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
12 author="Игорь Сысоев" |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
13 editor="Brian Mercer"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
14 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
15 <section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
16 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
17 <para> |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
18 Чтобы настроить HTTPS-сервер, необходимо включить параметр |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
19 <literal>ssl</literal> на |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
20 <link doc="ngx_http_core_module.xml" id="listen">слушающих сокетах</link> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
21 в блоке <link doc="ngx_http_core_module.xml" id="server"/>, |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
22 а также указать местоположение файлов с |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
23 сертификатом сервера и секретным ключом: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
24 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
25 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
26 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
27 listen 443 <b>ssl</b>; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
28 server_name www.example.com; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
29 ssl_certificate <b>www.example.com.crt</b>; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
30 ssl_certificate_key <b>www.example.com.key</b>; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
31 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
32 ssl_ciphers HIGH:!aNULL:!MD5; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
33 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
34 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
35 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
36 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
37 Сертификат сервера является публичным. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
38 Он посылается каждому клиенту, соединяющемуся с сервером. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
39 Секретный ключ следует хранить в файле с ограниченным доступом |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
40 (права доступа должны позволять основному процессу nginx читать этот файл). |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
41 Секретный ключ можно также хранить в одном файле с сертификатом: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
42 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
43 <programlisting> |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
44 ssl_certificate www.example.com.cert; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
45 ssl_certificate_key www.example.com.cert; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
46 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
47 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
48 при этом права доступа к файлу следует также ограничить. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
49 Несмотря на то, что и сертификат, и ключ хранятся в одном файле, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
50 клиенту посылается только сертификат. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
51 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
52 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
53 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
54 С помощью директив <link doc="ngx_http_ssl_module.xml" id="ssl_protocols"/> и |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
55 <link doc="ngx_http_ssl_module.xml" id="ssl_ciphers"/> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
56 можно ограничить соединения |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
57 использованием только “сильных” версий и шифров SSL/TLS. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
58 Начиная с версии 1.0.5 nginx по умолчанию использует |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
59 “<literal>ssl_protocols SSLv3 TLSv1</literal>” и |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
60 “<literal>ssl_ciphers HIGH:!aNULL:!MD5</literal>”, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
61 поэтому явная их настройка имеет смысл только для более ранних версий nginx. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
62 Начиная с версий 1.1.13 и 1.0.12 nginx по умолчанию использует |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
63 “<literal>ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2</literal>”. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
64 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
65 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
66 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
67 Известно, что шифры с CBC-режимом уязвимы к ряду атак, в частности |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
68 к BEAST-атаке (см. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
69 <link url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389">CVE-2011-3389</link>). |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
70 Настройка шифров может быть изменена так, чтобы предпочитался RC4-SHA: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
71 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
72 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
73 ssl_ciphers RC4:HIGH:!aNULL:!MD5; |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
74 ssl_prefer_server_ciphers on; |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
75 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
76 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
77 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
78 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
79 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
80 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
81 <section id="optimization" name="Оптимизация HTTPS-сервера"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
82 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
83 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
84 SSL-операции потребляют дополнительные ресурсы процессора. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
85 На мультипроцессорных системах следует запускать несколько рабочих процессов, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
86 не меньше числа доступных процессорных ядер. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
87 Наиболее ресурсоёмкой для процессора является операция SSL handshake, в рамках |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
88 которой формируются криптографические параметры сессии. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
89 Существует два способа уменьшения числа этих операций, производимых для каждого |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
90 клиента: использование постоянных (keepalive) соединений, позволяющих в рамках |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
91 одного соединения обрабатывать сразу несколько запросов, и повторное |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
92 использование параметров SSL-сессии для предотвращения необходимости выполнения |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
93 SSL handshake для параллельных и последующих соединений. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
94 Сессии хранятся в кэше SSL-сессий, разделяемом между рабочими процессами и |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
95 настраиваемом директивой |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
96 <link doc="ngx_http_ssl_module.xml" id="ssl_session_cache"/>. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
97 В 1 мегабайт кэша помещается около 4000 сессий. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
98 Таймаут кэша по умолчанию равен 5 минутам. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
99 Он может быть увеличен с помощью директивы |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
100 <link doc="ngx_http_ssl_module.xml" id="ssl_session_timeout"/>. |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
101 Вот пример конфигурации, оптимизированной под многоядерную систему |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
102 с 10-мегабайтным разделяемым кэшем сессий: |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
103 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
104 <programlisting> |
817
4fecf0715bbf
Introducing "worker_processes auto" in SSL configuration examples.
Andrei Belov <defan@nginx.com>
parents:
801
diff
changeset
|
105 <b>worker_processes auto</b>; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
106 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
107 http { |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
108 <b>ssl_session_cache shared:SSL:10m</b>; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
109 <b>ssl_session_timeout 10m</b>; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
110 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
111 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
112 listen 443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
113 server_name www.example.com; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
114 <b>keepalive_timeout 70</b>; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
115 |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
116 ssl_certificate www.example.com.crt; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
117 ssl_certificate_key www.example.com.key; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
118 ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
119 ssl_ciphers HIGH:!aNULL:!MD5; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
120 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
121 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
122 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
123 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
124 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
125 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
126 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
127 <section id="chains" name="Цепочки SSL-сертификатов"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
128 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
129 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
130 Некоторые браузеры могут выдавать предупреждение о сертификате, подписанном |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
131 общеизвестным центром сертификации, в то время как другие браузеры без |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
132 проблем принимают этот же сертификат. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
133 Так происходит потому, что центр, выдавший сертификат, подписал его |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
134 промежуточным сертификатом, которого нет в базе данных сертификатов |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
135 общеизвестных доверенных центров сертификации, распространяемой |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
136 вместе с браузером. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
137 В подобном случае центр сертификации предоставляет “связку” сертификатов, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
138 которую следует присоединить к сертификату сервера. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
139 Сертификат сервера следует разместить перед связкой сертификатов |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
140 в скомбинированном файле: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
141 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
142 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
143 $ cat www.example.com.crt bundle.crt > www.example.com.chained.crt |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
144 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
145 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
146 Полученный файл следует указать в директиве |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
147 <link doc="ngx_http_ssl_module.xml" id="ssl_certificate"/>: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
148 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
149 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
150 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
151 listen 443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
152 server_name www.example.com; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
153 ssl_certificate www.example.com.chained.crt; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
154 ssl_certificate_key www.example.com.key; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
155 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
156 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
157 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
158 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
159 Если сертификат сервера и связка сертификатов были соединены в неправильном |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
160 порядке, nginx откажется запускаться и выдаст сообщение об ошибке: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
161 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
162 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
163 SSL_CTX_use_PrivateKey_file(" ... /www.example.com.key") failed |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
164 (SSL: error:0B080074:x509 certificate routines: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
165 X509_check_private_key:key values mismatch) |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
166 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
167 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
168 поскольку nginx попытается использовать секретный ключ с первым |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
169 сертификатом из связки вместо сертификата сервера. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
170 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
171 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
172 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
173 Браузеры обычно сохраняют полученные промежуточные сертификаты, подписанные |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
174 доверенными центрами сертификации, поэтому активно используемые браузеры |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
175 уже могут иметь требуемые промежуточные сертификаты и не выдать предупреждение |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
176 о сертификате, присланном без связанной с ним цепочки сертификатов. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
177 Убедиться в том, что сервер присылает полную цепочку сертификатов, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
178 можно при помощи утилиты командной строки <command>openssl</command>, например: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
179 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
180 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
181 $ openssl s_client -connect www.godaddy.com:443 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
182 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
183 Certificate chain |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
184 0 s:/C=US/ST=Arizona/L=Scottsdale/1.3.6.1.4.1.311.60.2.1.3=US |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
185 /1.3.6.1.4.1.311.60.2.1.2=AZ/O=GoDaddy.com, Inc |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
186 /OU=MIS Department/<b>CN=www.GoDaddy.com</b> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
187 /serialNumber=0796928-7/2.5.4.15=V1.0, Clause 5.(b) |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
188 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
189 /OU=http://certificates.godaddy.com/repository |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
190 /CN=Go Daddy Secure Certification Authority |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
191 /serialNumber=07969287 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
192 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
193 /OU=http://certificates.godaddy.com/repository |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
194 /CN=Go Daddy Secure Certification Authority |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
195 /serialNumber=07969287 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
196 i:/C=US/O=The Go Daddy Group, Inc. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
197 /OU=Go Daddy Class 2 Certification Authority |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
198 2 s:/C=US/O=The Go Daddy Group, Inc. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
199 /OU=Go Daddy Class 2 Certification Authority |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
200 i:/L=ValiCert Validation Network/O=<b>ValiCert, Inc.</b> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
201 /OU=ValiCert Class 2 Policy Validation Authority |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
202 /CN=http://www.valicert.com//emailAddress=info@valicert.com |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
203 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
204 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
205 |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
206 В этом примере субъект (“<i>s</i>”) сертификата №0 сервера |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
207 <literal>www.GoDaddy.com</literal> подписан издателем (“<i>i</i>”), |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
208 который в свою очередь является субъектом сертификата №1, подписанного |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
209 издателем, который в свою очередь является субъектом сертификата №2, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
210 подписанного общеизвестным издателем <i>ValiCert, Inc.</i>, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
211 чей сертификат хранится во встроенной в браузеры базе данных |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
212 сертификатов (которая в тёмном чулане хранится в доме, который построил Джек). |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
213 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
214 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
215 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
216 Если связку сертификатов не добавили, будет показан только сертификат |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
217 сервера №0. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
218 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
219 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
220 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
221 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
222 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
223 <section id="single_http_https_server" name="Единый HTTP/HTTPS сервер"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
224 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
225 <para> |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
226 Можно настроить единый сервер, который обслуживает как HTTP-, |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
227 так и HTTPS-запросы: |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
228 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
229 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
230 server { |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
231 listen 80; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
232 listen 443 ssl; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
233 server_name www.example.com; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
234 ssl_certificate www.example.com.crt; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
235 ssl_certificate_key www.example.com.key; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
236 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
237 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
238 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
239 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
240 <note> |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
241 До версии 0.7.14 SSL нельзя было включить выборочно для |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
242 отдельных слущающих сокетов, как показано выше. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
243 SSL можно было включить только для всего сервера целиком, |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
244 с помощью директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/>, |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
245 что не позволяло настроить единый HTTP/HTTPS сервер. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
246 Для решения этой задачи был добавлен |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
247 параметр <literal>ssl</literal> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
248 директивы <link doc="ngx_http_core_module.xml" id="listen"/>. |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
249 Поэтому использование |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
250 директивы <link doc="ngx_http_ssl_module.xml" id="ssl"/> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
251 в современных версиях не рекомендуется. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
252 </note> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
253 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
254 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
255 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
256 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
257 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
258 <section id="name_based_https_servers" name="Выбор HTTPS-сервера по имени"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
259 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
260 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
261 Типичная проблема возникает при настройке двух и более серверов HTTPS, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
262 слушающих на одном и том же IP-адресе: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
263 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
264 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
265 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
266 listen 443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
267 server_name www.example.com; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
268 ssl_certificate www.example.com.crt; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
269 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
270 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
271 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
272 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
273 listen 443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
274 server_name www.example.org; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
275 ssl_certificate www.example.org.crt; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
276 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
277 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
278 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
279 |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
280 В такой конфигурации браузер получит сертификат сервера по умолчанию, т.е. |
593
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
589
diff
changeset
|
281 <literal>www.example.com</literal>, независимо от запрашиваемого имени сервера. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
282 Это связано с поведением протокола SSL. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
283 SSL-соединение устанавливается до того, как браузер посылает HTTP-запрос, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
284 и nginx не знает имени запрашиваемого сервера. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
285 Следовательно, он лишь может предложить сертификат сервера по умолчанию. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
286 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
287 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
288 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
289 Наиболее старым и надёжным способом решения этой проблемы |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
290 является назначение каждому HTTPS-серверу своего IP-адреса: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
291 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
292 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
293 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
294 listen 192.168.1.1:443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
295 server_name www.example.com; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
296 ssl_certificate www.example.com.crt; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
297 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
298 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
299 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
300 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
301 listen 192.168.1.2:443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
302 server_name www.example.org; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
303 ssl_certificate www.example.org.crt; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
304 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
305 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
306 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
307 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
308 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
309 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
310 <section id="certificate_with_several_names" |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
311 name="SSL-сертификат с несколькими именами"> |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
312 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
313 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
314 Существуют и другие способы, которые позволяют использовать один и тот же |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
315 IP-адрес сразу для нескольких HTTPS-серверов. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
316 Все они, однако, имеют свои недостатки. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
317 Одним из таких способов является использование сертификата с несколькими |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
318 именами в поле SubjectAltName сертификата, например |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
319 <literal>www.example.com</literal> и <literal>www.example.org</literal>. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
320 Однако, длина поля SubjectAltName ограничена. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
321 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
322 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
323 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
324 Другим способом является использование wildcard-сертификата, например |
593
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
589
diff
changeset
|
325 <literal>*.example.org</literal>. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
326 Такой сертификат защищает все поддомены указанного домена, но только |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
327 на заданном уровне. |
593
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
589
diff
changeset
|
328 Под такой сертификат подходит <literal>www.example.org</literal>, но не подходят |
130fad6dc1b4
Replaced the uses of "url" element with "literal".
Ruslan Ermilov <ru@nginx.com>
parents:
589
diff
changeset
|
329 <literal>example.org</literal> и <literal>www.sub.example.org</literal>. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
330 Два вышеуказанных способа можно комбинировать. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
331 Сертификат может одновременно содержать и точное, и wildcard имена в поле |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
332 SubjectAltName, например |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
333 <literal>example.org</literal> и <literal>*.example.org</literal>. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
334 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
335 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
336 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
337 Лучше поместить сведения о файле сертификата с несколькими именами и |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
338 файле с его секретным ключом на уровне конфигурации <i>http</i>, чтобы |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
339 все серверы унаследовали их единственную копию в памяти: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
340 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
341 <programlisting> |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
342 ssl_certificate common.crt; |
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
343 ssl_certificate_key common.key; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
344 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
345 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
346 listen 443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
347 server_name www.example.com; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
348 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
349 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
350 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
351 server { |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
352 listen 443 ssl; |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
353 server_name www.example.org; |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
354 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
355 } |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
356 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
357 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
358 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
359 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
360 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
361 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
362 <section id="sni" name="Указание имени сервера"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
363 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
364 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
365 Более общее решение для работы нескольких HTTPS-серверов на одном |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
366 IP-адресе — |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
367 <link url="http://en.wikipedia.org/wiki/Server_Name_Indication">расширение |
661
e1579b244800
SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents:
660
diff
changeset
|
368 Server Name Indication протокола TLS</link> (SNI, RFC 6066), |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
369 которое позволяет браузеру передать запрашиваемое имя сервера во время |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
370 SSL handshake, а значит сервер будет знать, какой сертификат ему |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
371 следует использовать для соединения. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
372 Однако, поддержка SNI браузерами ограничена. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
373 Сейчас это поддерживается браузерами начиная со следующих версий: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
374 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
375 |
658
bd81a71006fe
Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
376 <para> |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
377 <list type="bullet"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
378 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
379 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
380 Opera 8.0; |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
381 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
382 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
383 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
384 MSIE 7.0 (но только на Windows Vista и выше); |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
385 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
386 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
387 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
388 Firefox 2.0 и другие браузеры, использующие Mozilla Platform rv:1.8.1; |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
389 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
390 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
391 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
392 Safari 3.2.1 (Windows-версия поддерживает SNI только на Vista и выше); |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
393 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
394 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
395 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
396 и Chrome (Windows-версия также поддерживает SNI только на Vista и выше). |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
397 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
398 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
399 </list> |
658
bd81a71006fe
Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
400 <note> |
661
e1579b244800
SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents:
660
diff
changeset
|
401 В SNI можно передавать только доменные имена, |
e1579b244800
SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents:
660
diff
changeset
|
402 однако некоторые браузеры могут ошибочно передавать IP-адрес сервера |
e1579b244800
SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents:
660
diff
changeset
|
403 в качестве его имени, если в запросе указан IP-адрес. |
e1579b244800
SNI: expressed more clearly that passing of literal IP addresses in
Ruslan Ermilov <ru@nginx.com>
parents:
660
diff
changeset
|
404 Полагаться на это не следует. |
658
bd81a71006fe
Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
405 </note> |
bd81a71006fe
Documented that most browsers won't pass an IP address
Ruslan Ermilov <ru@nginx.com>
parents:
593
diff
changeset
|
406 </para> |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
407 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
408 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
409 Чтобы использовать SNI в nginx, соответствующая поддержка должна |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
410 присутствовать как в библиотеке OpenSSL, использованной при сборке |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
411 бинарного файла nginx, так и в библиотеке, подгружаемой в момент работы. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
412 OpenSSL поддерживает SNI начиная с версии 0.9.8f, если она была |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
413 собрана с опцией конфигурации <nobr>“--enable-tlsext”.</nobr> |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
414 Начиная с OpenSSL 0.9.8j эта опция включена по умолчанию. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
415 Если nginx был собран с поддержкой SNI, то при запуске nginx с ключом |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
416 “-V” об этом сообщается: |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
417 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
418 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
419 $ nginx -V |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
420 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
421 TLS SNI support enabled |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
422 ... |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
423 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
424 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
425 Однако, если nginx, собранный с поддержкой SNI, в процессе работы подгружает |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
426 библиотеку OpenSSL, в которой нет поддержки SNI, nginx выдаёт предупреждение: |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
427 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
428 <programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
429 nginx was built with SNI support, however, now it is linked |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
430 dynamically to an OpenSSL library which has no tlsext support, |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
431 therefore SNI is not available |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
432 </programlisting> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
433 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
434 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
435 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
436 |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
437 </section> |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
438 |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
439 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
440 <section id="compatibility" name="Совместимость"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
441 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
442 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
443 <list type="bullet"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
444 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
445 <listitem> |
660
ba45bd0fc71e
configuring_https_servers: markup changes (mostly).
Ruslan Ermilov <ru@nginx.com>
parents:
659
diff
changeset
|
446 Статус поддержки SNI отображается по ключу “-V” |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
447 начиная с версий 0.8.21 и 0.7.62. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
448 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
449 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
450 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
451 Параметр <literal>ssl</literal> директивы |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
452 <link doc="ngx_http_core_module.xml" id="listen"/> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
453 поддерживается начиная с версии 0.7.14. |
801
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
454 До версии 0.8.21 его можно было указывать только совместно с |
b95a6d779c89
Documented that "listen ... ssl" is preferred over "ssl on".
Ruslan Ermilov <ru@nginx.com>
parents:
782
diff
changeset
|
455 параметром <literal>default</literal>. |
547
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
456 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
457 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
458 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
459 SNI поддерживается начиная с версии 0.5.32. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
460 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
461 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
462 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
463 Разделяемый кэш SSL-сессий поддерживается начиная с версии 0.5.6. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
464 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
465 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
466 </list> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
467 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
468 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
469 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
470 <list type="bullet"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
471 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
472 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
473 Версия 0.7.65, 0.8.19 и более поздние: протоколами SSL по умолчанию являются |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
474 SSLv3, TLSv1, TLSv1.1 и TLSv1.2 (если поддерживается библиотекой OpenSSL). |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
475 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
476 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
477 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
478 Версия 0.7.64, 0.8.18 и более ранние: протоколами SSL по умолчанию являются |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
479 SSLv2, SSLv3 и TLSv1. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
480 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
481 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
482 </list> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
483 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
484 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
485 <para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
486 <list type="bullet"> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
487 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
488 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
489 Версия 1.0.5 и более поздние: шифрами SSL по умолчанию являются |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
490 “<literal>HIGH:!aNULL:!MD5</literal>”. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
491 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
492 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
493 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
494 Версия 0.7.65, 0.8.20 и более поздние: шифрами SSL по умолчанию являются |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
495 “<literal>HIGH:!ADH:!MD5</literal>”. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
496 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
497 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
498 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
499 Версия 0.8.19: шифрами SSL по умолчанию являются |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
500 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM</literal>”. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
501 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
502 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
503 <listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
504 Версия 0.7.64, 0.8.18 и более ранние: шифрами SSL по умолчанию являются<br/> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
505 “<literal>ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</literal>”. |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
506 </listitem> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
507 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
508 </list> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
509 </para> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
510 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
511 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
512 </section> |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
513 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
514 |
32dd85720515
Translated "configuring_https_servers" intro Russian.
Ruslan Ermilov <ru@nginx.com>
parents:
diff
changeset
|
515 </article> |