source: nginx_org/xml/en/docs/http/ngx_http_ssl_module.xml

Last change on this file was 2040:093855e77388, checked in by Yaroslav Zhuravlev <yar@…>, 6 weeks ago

Updated info about SNI.

File size: 22.6 KB
Line 
1<?xml version="1.0"?>
2
3<!--
4  Copyright (C) Igor Sysoev
5  Copyright (C) Nginx, Inc.
6  -->
7
8<!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
9
10<module name="Module ngx_http_ssl_module"
11        link="/en/docs/http/ngx_http_ssl_module.html"
12        lang="en"
13        rev="36">
14
15<section id="summary">
16
17<para>
18The <literal>ngx_http_ssl_module</literal> module provides the
19necessary support for HTTPS.
20</para>
21
22<para>
23This module is not built by default, it should be enabled with the
24<literal>--with-http_ssl_module</literal>
25configuration parameter.
26<note>
27This module requires the
28<link url="http://www.openssl.org">OpenSSL</link> library.
29</note>
30</para>
31
32</section>
33
34
35<section id="example" name="Example Configuration">
36
37<para>
38To reduce the processor load it is recommended to
39<list type="bullet">
40
41<listitem>
42set the number of worker processes equal to the number of processors,
43</listitem>
44
45<listitem>
46enable keep-alive connections,
47</listitem>
48
49<listitem>
50enable the shared session cache,
51</listitem>
52
53<listitem>
54disable the built-in session cache,
55</listitem>
56
57<listitem>
58and possibly increase the session lifetime (by default, 5 minutes):
59</listitem>
60
61</list>
62
63<example>
64<emphasis>worker_processes auto;</emphasis>
65
66http {
67
68    ...
69
70    server {
71        listen              443 ssl;
72        <emphasis>keepalive_timeout   70;</emphasis>
73
74        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
75        ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
76        ssl_certificate     /usr/local/nginx/conf/cert.pem;
77        ssl_certificate_key /usr/local/nginx/conf/cert.key;
78        <emphasis>ssl_session_cache   shared:SSL:10m;</emphasis>
79        <emphasis>ssl_session_timeout 10m;</emphasis>
80
81        ...
82    }
83</example>
84</para>
85
86</section>
87
88
89<section id="directives" name="Directives">
90
91<directive name="ssl">
92<syntax><literal>on</literal> | <literal>off</literal></syntax>
93<default>off</default>
94<context>http</context>
95<context>server</context>
96
97<para>
98Enables the HTTPS protocol for the given virtual server.
99<note>
100It is recommended to use the <literal>ssl</literal> parameter of the
101<link doc="ngx_http_core_module.xml" id="listen"/> directive instead
102of this directive.
103</note>
104</para>
105
106</directive>
107
108
109<directive name="ssl_buffer_size">
110<syntax><value>size</value></syntax>
111<default>16k</default>
112<context>http</context>
113<context>server</context>
114<appeared-in>1.5.9</appeared-in>
115
116<para>
117Sets the size of the buffer used for sending data.
118</para>
119
120<para>
121By default, the buffer size is 16k, which corresponds to minimal
122overhead when sending big responses.
123To minimize Time To First Byte it may be beneficial to use smaller values,
124for example:
125<example>
126ssl_buffer_size 4k;
127</example>
128</para>
129
130</directive>
131
132
133<directive name="ssl_certificate">
134<syntax><value>file</value></syntax>
135<default/>
136<context>http</context>
137<context>server</context>
138
139<para>
140Specifies a <value>file</value> with the certificate in the PEM format
141for the given virtual server.
142If intermediate certificates should be specified in addition to a primary
143certificate, they should be specified in the same file in the following
144order: the primary certificate comes first, then the intermediate certificates.
145A secret key in the PEM format may be placed in the same file.
146</para>
147
148<para>
149Since version 1.11.0,
150this directive can be specified multiple times
151to load certificates of different types, for example, RSA and ECDSA:
152<example>
153server {
154    listen              443 ssl;
155    server_name         example.com;
156
157    ssl_certificate     example.com.rsa.crt;
158    ssl_certificate_key example.com.rsa.key;
159
160    ssl_certificate     example.com.ecdsa.crt;
161    ssl_certificate_key example.com.ecdsa.key;
162
163    ...
164}
165</example>
166<note>
167Only OpenSSL 1.0.2 or higher supports separate
168<link doc="configuring_https_servers.xml" id="chains">certificate chains</link>
169for different certificates.
170With older versions, only one certificate chain can be used.
171</note>
172</para>
173
174<para>
175It should be kept in mind that due to the HTTPS protocol limitations
176for maximum interoperability virtual servers should listen on
177<link doc="configuring_https_servers.xml" id="name_based_https_servers">different
178IP addresses</link>.
179</para>
180
181</directive>
182
183
184<directive name="ssl_certificate_key">
185<syntax><value>file</value></syntax>
186<default/>
187<context>http</context>
188<context>server</context>
189
190<para>
191Specifies a <value>file</value> with the secret key in the PEM format
192for the given virtual server.
193</para>
194
195<para>
196The value
197<literal>engine</literal>:<value>name</value>:<value>id</value>
198can be specified instead of the <value>file</value> (1.7.9),
199which loads a secret key with a specified <value>id</value>
200from the OpenSSL engine <value>name</value>.
201</para>
202
203</directive>
204
205
206<directive name="ssl_ciphers">
207<syntax><value>ciphers</value></syntax>
208<default>HIGH:!aNULL:!MD5</default>
209<context>http</context>
210<context>server</context>
211
212<para>
213Specifies the enabled ciphers.
214The ciphers are specified in the format understood by the
215OpenSSL library, for example:
216<example>
217ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
218</example>
219</para>
220
221<para>
222The full list can be viewed using the
223<command>openssl ciphers</command>” command.
224</para>
225
226<para>
227<note>
228The previous versions of nginx used
229<link doc="configuring_https_servers.xml" id="compatibility">different</link>
230ciphers by default.
231</note>
232</para>
233
234</directive>
235
236
237<directive name="ssl_client_certificate">
238<syntax><value>file</value></syntax>
239<default/>
240<context>http</context>
241<context>server</context>
242
243<para>
244Specifies a <value>file</value> with trusted CA certificates in the PEM format
245used to <link id="ssl_verify_client">verify</link> client certificates and
246OCSP responses if <link id="ssl_stapling"/> is enabled.
247</para>
248
249<para>
250The list of certificates will be sent to clients.
251If this is not desired, the <link id="ssl_trusted_certificate"/>
252directive can be used.
253</para>
254
255</directive>
256
257
258<directive name="ssl_crl">
259<syntax><value>file</value></syntax>
260<default/>
261<context>http</context>
262<context>server</context>
263<appeared-in>0.8.7</appeared-in>
264
265<para>
266Specifies a <value>file</value> with revoked certificates (CRL)
267in the PEM format used to <link id="ssl_verify_client">verify</link>
268client certificates.
269</para>
270
271</directive>
272
273
274<directive name="ssl_dhparam">
275<syntax><value>file</value></syntax>
276<default/>
277<context>http</context>
278<context>server</context>
279<appeared-in>0.7.2</appeared-in>
280
281<para>
282Specifies a <value>file</value> with DH parameters for DHE ciphers.
283</para>
284
285</directive>
286
287
288<directive name="ssl_ecdh_curve">
289<syntax><value>curve</value></syntax>
290<default>auto</default>
291<context>http</context>
292<context>server</context>
293<appeared-in>1.1.0</appeared-in>
294<appeared-in>1.0.6</appeared-in>
295
296<para>
297Specifies a <value>curve</value> for ECDHE ciphers.
298</para>
299
300<para>
301When using OpenSSL 1.0.2 or higher,
302it is possible to specify multiple curves (1.11.0), for example:
303<example>
304ssl_ecdh_curve prime256v1:secp384r1;
305</example>
306</para>
307
308<para>
309The special value <literal>auto</literal> (1.11.0) instructs nginx to use
310a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher,
311or <literal>prime256v1</literal> with older versions.
312</para>
313
314<para>
315<note>
316Prior to version 1.11.0,
317the <literal>prime256v1</literal> curve was used by default.
318</note>
319</para>
320
321</directive>
322
323
324<directive name="ssl_password_file">
325<syntax><value>file</value></syntax>
326<default/>
327<context>http</context>
328<context>server</context>
329<appeared-in>1.7.3</appeared-in>
330
331<para>
332Specifies a <value>file</value> with passphrases for
333<link id="ssl_certificate_key">secret keys</link>
334where each passphrase is specified on a separate line.
335Passphrases are tried in turn when loading the key.
336</para>
337
338<para>
339Example:
340<example>
341http {
342    ssl_password_file /etc/keys/global.pass;
343    ...
344
345    server {
346        server_name www1.example.com;
347        ssl_certificate_key /etc/keys/first.key;
348    }
349
350    server {
351        server_name www2.example.com;
352
353        # named pipe can also be used instead of a file
354        ssl_password_file /etc/keys/fifo;
355        ssl_certificate_key /etc/keys/second.key;
356    }
357}
358</example>
359</para>
360
361</directive>
362
363
364<directive name="ssl_prefer_server_ciphers">
365<syntax><literal>on</literal> | <literal>off</literal></syntax>
366<default>off</default>
367<context>http</context>
368<context>server</context>
369
370<para>
371Specifies that server ciphers should be preferred over client
372ciphers when using the SSLv3 and TLS protocols.
373</para>
374
375</directive>
376
377
378<directive name="ssl_protocols">
379<syntax>
380    [<literal>SSLv2</literal>]
381    [<literal>SSLv3</literal>]
382    [<literal>TLSv1</literal>]
383    [<literal>TLSv1.1</literal>]
384    [<literal>TLSv1.2</literal>]
385    [<literal>TLSv1.3</literal>]</syntax>
386<default>TLSv1 TLSv1.1 TLSv1.2</default>
387<context>http</context>
388<context>server</context>
389
390<para>
391Enables the specified protocols.
392<note>
393The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters
394(1.1.13, 1.0.12) work only when OpenSSL 1.0.1 or higher is used.
395</note>
396<note>
397The <literal>TLSv1.3</literal> parameter (1.13.0) works only when
398OpenSSL 1.1.1 built with TLSv1.3 support is used.
399</note>
400</para>
401
402</directive>
403
404
405<directive name="ssl_session_cache">
406<syntax>
407    <literal>off</literal> |
408    <literal>none</literal> |
409    [<literal>builtin</literal>[:<value>size</value>]]
410    [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
411<default>none</default>
412<context>http</context>
413<context>server</context>
414
415<para>
416Sets the types and sizes of caches that store session parameters.
417A cache can be of any of the following types:
418<list type="tag">
419
420<tag-name><literal>off</literal></tag-name>
421<tag-desc>
422the use of a session cache is strictly prohibited:
423nginx explicitly tells a client that sessions may not be reused.
424</tag-desc>
425
426<tag-name><literal>none</literal></tag-name>
427<tag-desc>
428the use of a session cache is gently disallowed:
429nginx tells a client that sessions may be reused, but does not
430actually store session parameters in the cache.
431</tag-desc>
432
433<tag-name><literal>builtin</literal></tag-name>
434<tag-desc>
435a cache built in OpenSSL; used by one worker process only.
436The cache size is specified in sessions.
437If size is not given, it is equal to 20480 sessions.
438Use of the built-in cache can cause memory fragmentation.
439</tag-desc>
440
441<tag-name><literal>shared</literal></tag-name>
442<tag-desc>
443a cache shared between all worker processes.
444The cache size is specified in bytes; one megabyte can store
445about 4000 sessions.
446Each shared cache should have an arbitrary name.
447A cache with the same name can be used in several virtual servers.
448</tag-desc>
449
450</list>
451</para>
452
453<para>
454Both cache types can be used simultaneously, for example:
455<example>
456ssl_session_cache builtin:1000 shared:SSL:10m;
457</example>
458but using only shared cache without the built-in cache should
459be more efficient.
460</para>
461
462</directive>
463
464
465<directive name="ssl_session_ticket_key">
466<syntax><value>file</value></syntax>
467<default/>
468<context>http</context>
469<context>server</context>
470<appeared-in>1.5.7</appeared-in>
471
472<para>
473Sets a <value>file</value> with the secret key used to encrypt
474and decrypt TLS session tickets.
475The directive is necessary if the same key has to be shared between
476multiple servers.
477By default, a randomly generated key is used.
478</para>
479
480<para>
481If several keys are specified, only the first key is
482used to encrypt TLS session tickets.
483This allows configuring key rotation, for example:
484<example>
485ssl_session_ticket_key current.key;
486ssl_session_ticket_key previous.key;
487</example>
488</para>
489
490<para>
491The <value>file</value> must contain 80 or 48 bytes
492of random data and can be created using the following command:
493<example>
494openssl rand 80 > ticket.key
495</example>
496Depending on the file size either AES256 (for 80-byte keys, 1.11.8)
497or AES128 (for 48-byte keys) is used for encryption.
498</para>
499
500</directive>
501
502
503<directive name="ssl_session_tickets">
504<syntax><literal>on</literal> | <literal>off</literal></syntax>
505<default>on</default>
506<context>http</context>
507<context>server</context>
508<appeared-in>1.5.9</appeared-in>
509
510<para>
511Enables or disables session resumption through
512<link url="https://tools.ietf.org/html/rfc5077">TLS session tickets</link>.
513</para>
514
515</directive>
516
517
518<directive name="ssl_session_timeout">
519<syntax><value>time</value></syntax>
520<default>5m</default>
521<context>http</context>
522<context>server</context>
523
524<para>
525Specifies a time during which a client may reuse the
526session parameters.
527</para>
528
529</directive>
530
531
532<directive name="ssl_stapling">
533<syntax><literal>on</literal> | <literal>off</literal></syntax>
534<default>off</default>
535<context>http</context>
536<context>server</context>
537<appeared-in>1.3.7</appeared-in>
538
539<para>
540Enables or disables
541<link url="https://tools.ietf.org/html/rfc4366#section-3.6">stapling
542of OCSP responses</link> by the server.
543Example:
544<example>
545ssl_stapling on;
546resolver 192.0.2.1;
547</example>
548</para>
549
550<para>
551For the OCSP stapling to work, the certificate of the server certificate
552issuer should be known.
553If the <link id="ssl_certificate"/> file does
554not contain intermediate certificates,
555the certificate of the server certificate issuer should be
556present in the
557<link id="ssl_trusted_certificate"/> file.
558</para>
559
560<para>
561For a resolution of the OCSP responder hostname,
562the <link doc="ngx_http_core_module.xml" id="resolver"/> directive
563should also be specified.
564</para>
565
566</directive>
567
568
569<directive name="ssl_stapling_file">
570<syntax><value>file</value></syntax>
571<default/>
572<context>http</context>
573<context>server</context>
574<appeared-in>1.3.7</appeared-in>
575
576<para>
577When set, the stapled OCSP response will be taken from the
578specified <value>file</value> instead of querying
579the OCSP responder specified in the server certificate.
580</para>
581
582<para>
583The file should be in the DER format as produced by the
584<literal>openssl ocsp</literal>” command.
585</para>
586
587</directive>
588
589
590<directive name="ssl_stapling_responder">
591<syntax><value>url</value></syntax>
592<default/>
593<context>http</context>
594<context>server</context>
595<appeared-in>1.3.7</appeared-in>
596
597<para>
598Overrides the URL of the OCSP responder specified in the
599<link url="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority
600Information Access</link>” certificate extension.
601</para>
602
603<para>
604Only “<literal>http://</literal>” OCSP responders are supported:
605<example>
606ssl_stapling_responder http://ocsp.example.com/;
607</example>
608</para>
609
610</directive>
611
612
613<directive name="ssl_stapling_verify">
614<syntax><literal>on</literal> | <literal>off</literal></syntax>
615<default>off</default>
616<context>http</context>
617<context>server</context>
618<appeared-in>1.3.7</appeared-in>
619
620<para>
621Enables or disables verification of OCSP responses by the server.
622</para>
623
624<para>
625For verification to work, the certificate of the server certificate
626issuer, the root certificate, and all intermediate certificates
627should be configured as trusted using the
628<link id="ssl_trusted_certificate"/> directive.
629</para>
630
631</directive>
632
633
634<directive name="ssl_trusted_certificate">
635<syntax><value>file</value></syntax>
636<default/>
637<context>http</context>
638<context>server</context>
639<appeared-in>1.3.7</appeared-in>
640
641<para>
642Specifies a <value>file</value> with trusted CA certificates in the PEM format
643used to <link id="ssl_verify_client">verify</link> client certificates and
644OCSP responses if <link id="ssl_stapling"/> is enabled.
645</para>
646
647<para>
648In contrast to the certificate set by <link id="ssl_client_certificate"/>,
649the list of these certificates will not be sent to clients.
650</para>
651
652</directive>
653
654
655<directive name="ssl_verify_client">
656<syntax>
657    <literal>on</literal> | <literal>off</literal> |
658    <literal>optional</literal> | <literal>optional_no_ca</literal></syntax>
659<default>off</default>
660<context>http</context>
661<context>server</context>
662
663<para>
664Enables verification of client certificates.
665The verification result is stored in the
666<link id="var_ssl_client_verify">$ssl_client_verify</link> variable.
667</para>
668
669<para>
670The <literal>optional</literal> parameter (0.8.7+) requests the client
671certificate and verifies it if the certificate is present.
672</para>
673
674<para>
675The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5)
676requests the client
677certificate but does not require it to be signed by a trusted CA certificate.
678This is intended for the use in cases when a service that is external to nginx
679performs the actual certificate verification.
680The contents of the certificate is accessible through the
681<link id="var_ssl_client_cert">$ssl_client_cert</link> variable.
682</para>
683
684</directive>
685
686
687<directive name="ssl_verify_depth">
688<syntax><value>number</value></syntax>
689<default>1</default>
690<context>http</context>
691<context>server</context>
692
693<para>
694Sets the verification depth in the client certificates chain.
695</para>
696
697</directive>
698
699</section>
700
701
702<section id="errors" name="Error Processing">
703
704<para>
705The <literal>ngx_http_ssl_module</literal> module supports several
706non-standard error codes that can be used for redirects using the
707<link doc="ngx_http_core_module.xml" id="error_page"/> directive:
708<list type="tag">
709
710<tag-name>495</tag-name>
711<tag-desc>
712an error has occurred during the client certificate verification;
713</tag-desc>
714
715<tag-name>496</tag-name>
716<tag-desc>
717a client has not presented the required certificate;
718</tag-desc>
719
720<tag-name>497</tag-name>
721<tag-desc>
722a regular request has been sent to the HTTPS port.
723</tag-desc>
724
725</list>
726</para>
727
728<para>
729The redirection happens after the request is fully parsed and
730the variables, such as <var>$request_uri</var>,
731<var>$uri</var>, <var>$args</var> and others, are available.
732</para>
733
734</section>
735
736
737<section id="variables" name="Embedded Variables">
738
739<para>
740The <literal>ngx_http_ssl_module</literal> module supports
741several embedded variables:
742<list type="tag">
743
744<tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name>
745<tag-desc>
746returns the string of ciphers used
747for an established SSL connection;
748</tag-desc>
749
750<tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name>
751<tag-desc>
752returns the list of ciphers supported by the client (1.11.7).
753Known ciphers are listed by names, unknown are shown in hexadecimal,
754for example:
755<example>
756AES128-SHA:AES256-SHA:0x00ff
757</example>
758<note>
759The variable is fully supported only when using OpenSSL version 1.0.2 or higher.
760With older versions, the variable is available
761only for new sessions and lists only known ciphers.
762</note>
763</tag-desc>
764
765<tag-name id="var_ssl_client_escaped_cert"><var>$ssl_client_escaped_cert</var></tag-name>
766<tag-desc>
767returns the client certificate in the PEM format (urlencoded)
768for an established SSL connection (1.13.5);
769</tag-desc>
770
771<tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name>
772<tag-desc>
773returns the client certificate in the PEM format
774for an established SSL connection, with each line except the first
775prepended with the tab character;
776this is intended for the use in the
777<link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive;
778<note>
779The variable is deprecated,
780the <var>$ssl_client_escaped_cert</var> variable should be used instead.
781</note>
782</tag-desc>
783
784<tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name>
785<tag-desc>
786returns the SHA1 fingerprint of the client certificate
787for an established SSL connection (1.7.1);
788</tag-desc>
789
790<tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name>
791<tag-desc>
792returns the “issuer DN” string of the client certificate
793for an established SSL connection according to
794<link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
795</tag-desc>
796
797<tag-name id="var_ssl_client_i_dn_legacy"><var>$ssl_client_i_dn_legacy</var></tag-name>
798<tag-desc>
799returns the “issuer DN” string of the client certificate
800for an established SSL connection;
801<note>
802Prior to version 1.11.6, the variable name was <var>$ssl_client_i_dn</var>.
803</note>
804</tag-desc>
805
806<tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var>
807</tag-name>
808<tag-desc>
809returns the client certificate in the PEM format
810for an established SSL connection;
811</tag-desc>
812
813<tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name>
814<tag-desc>
815returns the “subject DN” string of the client certificate
816for an established SSL connection according to
817<link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
818</tag-desc>
819
820<tag-name id="var_ssl_client_s_dn_legacy"><var>$ssl_client_s_dn_legacy</var></tag-name>
821<tag-desc>
822returns the “subject DN” string of the client certificate
823for an established SSL connection;
824<note>
825Prior to version 1.11.6, the variable name was <var>$ssl_client_s_dn</var>.
826</note>
827</tag-desc>
828
829<tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name>
830<tag-desc>
831returns the serial number of the client certificate
832for an established SSL connection;
833</tag-desc>
834
835<tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name>
836<tag-desc>
837returns the end date of the client certificate (1.11.7);
838</tag-desc>
839
840<tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name>
841<tag-desc>
842returns the number of days
843until the client certificate expires (1.11.7);
844</tag-desc>
845
846<tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name>
847<tag-desc>
848returns the start date of the client certificate (1.11.7);
849</tag-desc>
850
851<tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name>
852<tag-desc>
853returns the result of client certificate verification:
854<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”,
855and “<literal>NONE</literal>” if a certificate was not present;
856<note>
857Prior to version 1.11.7, the “<literal>FAILED</literal>” result
858did not contain the <value>reason</value> string.
859</note>
860</tag-desc>
861
862<tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name>
863<tag-desc>
864returns the list of curves supported by the client (1.11.7).
865Known curves are listed by names, unknown are shown in hexadecimal,
866for example:
867<example>
8680x001d:prime256v1:secp521r1:secp384r1
869</example>
870<note>
871The variable is supported only when using OpenSSL version 1.0.2 or higher.
872With older versions, the variable value will be an empty string.
873</note>
874<note>
875The variable is available only for new sessions.
876</note>
877</tag-desc>
878
879<tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name>
880<tag-desc>
881returns the protocol of an established SSL connection;
882</tag-desc>
883
884<tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name>
885<tag-desc>
886returns the server name requested through
887<link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>
888(1.7.0);
889</tag-desc>
890
891<tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name>
892<tag-desc>
893returns the session identifier of an established SSL connection;
894</tag-desc>
895
896<tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name>
897<tag-desc>
898returns “<literal>r</literal>” if an SSL session was reused,
899or “<literal>.</literal>” otherwise (1.5.11).
900</tag-desc>
901
902</list>
903</para>
904
905</section>
906
907</module>
Note: See TracBrowser for help on using the repository browser.