source: nginx_org/xml/en/docs/http/ngx_http_ssl_module.xml

Last change on this file was 2068:3d9e7993c201, checked in by Yaroslav Zhuravlev <yar@…>, 7 weeks ago

Added links to directives in the example of ssl modules.

File size: 22.9 KB
Line 
1<?xml version="1.0"?>
2
3<!--
4  Copyright (C) Igor Sysoev
5  Copyright (C) Nginx, Inc.
6  -->
7
8<!DOCTYPE module SYSTEM "../../../../dtd/module.dtd">
9
10<module name="Module ngx_http_ssl_module"
11        link="/en/docs/http/ngx_http_ssl_module.html"
12        lang="en"
13        rev="37">
14
15<section id="summary">
16
17<para>
18The <literal>ngx_http_ssl_module</literal> module provides the
19necessary support for HTTPS.
20</para>
21
22<para>
23This module is not built by default, it should be enabled with the
24<literal>--with-http_ssl_module</literal>
25configuration parameter.
26<note>
27This module requires the
28<link url="http://www.openssl.org">OpenSSL</link> library.
29</note>
30</para>
31
32</section>
33
34
35<section id="example" name="Example Configuration">
36
37<para>
38To reduce the processor load it is recommended to
39<list type="bullet">
40
41<listitem>
42set the number of
43<link doc="../ngx_core_module.xml" id="worker_processes">worker processes</link>
44equal to the number of processors,
45</listitem>
46
47<listitem>
48enable
49<link doc="ngx_http_core_module.xml" id="keepalive_timeout">keep-alive</link>
50connections,
51</listitem>
52
53<listitem>
54enable the <link id="ssl_session_cache_shared">shared</link> session cache,
55</listitem>
56
57<listitem>
58disable the <link id="ssl_session_cache_builtin">built-in</link> session cache,
59</listitem>
60
61<listitem>
62and possibly increase the session <link id="ssl_session_timeout">lifetime</link>
63(by default, 5 minutes):
64</listitem>
65
66</list>
67
68<example>
69<emphasis>worker_processes auto;</emphasis>
70
71http {
72
73    ...
74
75    server {
76        listen              443 ssl;
77        <emphasis>keepalive_timeout   70;</emphasis>
78
79        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
80        ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
81        ssl_certificate     /usr/local/nginx/conf/cert.pem;
82        ssl_certificate_key /usr/local/nginx/conf/cert.key;
83        <emphasis>ssl_session_cache   shared:SSL:10m;</emphasis>
84        <emphasis>ssl_session_timeout 10m;</emphasis>
85
86        ...
87    }
88</example>
89</para>
90
91</section>
92
93
94<section id="directives" name="Directives">
95
96<directive name="ssl">
97<syntax><literal>on</literal> | <literal>off</literal></syntax>
98<default>off</default>
99<context>http</context>
100<context>server</context>
101
102<para>
103Enables the HTTPS protocol for the given virtual server.
104<note>
105It is recommended to use the <literal>ssl</literal> parameter of the
106<link doc="ngx_http_core_module.xml" id="listen"/> directive instead
107of this directive.
108</note>
109</para>
110
111</directive>
112
113
114<directive name="ssl_buffer_size">
115<syntax><value>size</value></syntax>
116<default>16k</default>
117<context>http</context>
118<context>server</context>
119<appeared-in>1.5.9</appeared-in>
120
121<para>
122Sets the size of the buffer used for sending data.
123</para>
124
125<para>
126By default, the buffer size is 16k, which corresponds to minimal
127overhead when sending big responses.
128To minimize Time To First Byte it may be beneficial to use smaller values,
129for example:
130<example>
131ssl_buffer_size 4k;
132</example>
133</para>
134
135</directive>
136
137
138<directive name="ssl_certificate">
139<syntax><value>file</value></syntax>
140<default/>
141<context>http</context>
142<context>server</context>
143
144<para>
145Specifies a <value>file</value> with the certificate in the PEM format
146for the given virtual server.
147If intermediate certificates should be specified in addition to a primary
148certificate, they should be specified in the same file in the following
149order: the primary certificate comes first, then the intermediate certificates.
150A secret key in the PEM format may be placed in the same file.
151</para>
152
153<para>
154Since version 1.11.0,
155this directive can be specified multiple times
156to load certificates of different types, for example, RSA and ECDSA:
157<example>
158server {
159    listen              443 ssl;
160    server_name         example.com;
161
162    ssl_certificate     example.com.rsa.crt;
163    ssl_certificate_key example.com.rsa.key;
164
165    ssl_certificate     example.com.ecdsa.crt;
166    ssl_certificate_key example.com.ecdsa.key;
167
168    ...
169}
170</example>
171<note>
172Only OpenSSL 1.0.2 or higher supports separate
173<link doc="configuring_https_servers.xml" id="chains">certificate chains</link>
174for different certificates.
175With older versions, only one certificate chain can be used.
176</note>
177</para>
178
179<para>
180It should be kept in mind that due to the HTTPS protocol limitations
181for maximum interoperability virtual servers should listen on
182<link doc="configuring_https_servers.xml" id="name_based_https_servers">different
183IP addresses</link>.
184</para>
185
186</directive>
187
188
189<directive name="ssl_certificate_key">
190<syntax><value>file</value></syntax>
191<default/>
192<context>http</context>
193<context>server</context>
194
195<para>
196Specifies a <value>file</value> with the secret key in the PEM format
197for the given virtual server.
198</para>
199
200<para>
201The value
202<literal>engine</literal>:<value>name</value>:<value>id</value>
203can be specified instead of the <value>file</value> (1.7.9),
204which loads a secret key with a specified <value>id</value>
205from the OpenSSL engine <value>name</value>.
206</para>
207
208</directive>
209
210
211<directive name="ssl_ciphers">
212<syntax><value>ciphers</value></syntax>
213<default>HIGH:!aNULL:!MD5</default>
214<context>http</context>
215<context>server</context>
216
217<para>
218Specifies the enabled ciphers.
219The ciphers are specified in the format understood by the
220OpenSSL library, for example:
221<example>
222ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
223</example>
224</para>
225
226<para>
227The full list can be viewed using the
228<command>openssl ciphers</command>” command.
229</para>
230
231<para>
232<note>
233The previous versions of nginx used
234<link doc="configuring_https_servers.xml" id="compatibility">different</link>
235ciphers by default.
236</note>
237</para>
238
239</directive>
240
241
242<directive name="ssl_client_certificate">
243<syntax><value>file</value></syntax>
244<default/>
245<context>http</context>
246<context>server</context>
247
248<para>
249Specifies a <value>file</value> with trusted CA certificates in the PEM format
250used to <link id="ssl_verify_client">verify</link> client certificates and
251OCSP responses if <link id="ssl_stapling"/> is enabled.
252</para>
253
254<para>
255The list of certificates will be sent to clients.
256If this is not desired, the <link id="ssl_trusted_certificate"/>
257directive can be used.
258</para>
259
260</directive>
261
262
263<directive name="ssl_crl">
264<syntax><value>file</value></syntax>
265<default/>
266<context>http</context>
267<context>server</context>
268<appeared-in>0.8.7</appeared-in>
269
270<para>
271Specifies a <value>file</value> with revoked certificates (CRL)
272in the PEM format used to <link id="ssl_verify_client">verify</link>
273client certificates.
274</para>
275
276</directive>
277
278
279<directive name="ssl_dhparam">
280<syntax><value>file</value></syntax>
281<default/>
282<context>http</context>
283<context>server</context>
284<appeared-in>0.7.2</appeared-in>
285
286<para>
287Specifies a <value>file</value> with DH parameters for DHE ciphers.
288</para>
289
290</directive>
291
292
293<directive name="ssl_ecdh_curve">
294<syntax><value>curve</value></syntax>
295<default>auto</default>
296<context>http</context>
297<context>server</context>
298<appeared-in>1.1.0</appeared-in>
299<appeared-in>1.0.6</appeared-in>
300
301<para>
302Specifies a <value>curve</value> for ECDHE ciphers.
303</para>
304
305<para>
306When using OpenSSL 1.0.2 or higher,
307it is possible to specify multiple curves (1.11.0), for example:
308<example>
309ssl_ecdh_curve prime256v1:secp384r1;
310</example>
311</para>
312
313<para>
314The special value <literal>auto</literal> (1.11.0) instructs nginx to use
315a list built into the OpenSSL library when using OpenSSL 1.0.2 or higher,
316or <literal>prime256v1</literal> with older versions.
317</para>
318
319<para>
320<note>
321Prior to version 1.11.0,
322the <literal>prime256v1</literal> curve was used by default.
323</note>
324</para>
325
326</directive>
327
328
329<directive name="ssl_password_file">
330<syntax><value>file</value></syntax>
331<default/>
332<context>http</context>
333<context>server</context>
334<appeared-in>1.7.3</appeared-in>
335
336<para>
337Specifies a <value>file</value> with passphrases for
338<link id="ssl_certificate_key">secret keys</link>
339where each passphrase is specified on a separate line.
340Passphrases are tried in turn when loading the key.
341</para>
342
343<para>
344Example:
345<example>
346http {
347    ssl_password_file /etc/keys/global.pass;
348    ...
349
350    server {
351        server_name www1.example.com;
352        ssl_certificate_key /etc/keys/first.key;
353    }
354
355    server {
356        server_name www2.example.com;
357
358        # named pipe can also be used instead of a file
359        ssl_password_file /etc/keys/fifo;
360        ssl_certificate_key /etc/keys/second.key;
361    }
362}
363</example>
364</para>
365
366</directive>
367
368
369<directive name="ssl_prefer_server_ciphers">
370<syntax><literal>on</literal> | <literal>off</literal></syntax>
371<default>off</default>
372<context>http</context>
373<context>server</context>
374
375<para>
376Specifies that server ciphers should be preferred over client
377ciphers when using the SSLv3 and TLS protocols.
378</para>
379
380</directive>
381
382
383<directive name="ssl_protocols">
384<syntax>
385    [<literal>SSLv2</literal>]
386    [<literal>SSLv3</literal>]
387    [<literal>TLSv1</literal>]
388    [<literal>TLSv1.1</literal>]
389    [<literal>TLSv1.2</literal>]
390    [<literal>TLSv1.3</literal>]</syntax>
391<default>TLSv1 TLSv1.1 TLSv1.2</default>
392<context>http</context>
393<context>server</context>
394
395<para>
396Enables the specified protocols.
397<note>
398The <literal>TLSv1.1</literal> and <literal>TLSv1.2</literal> parameters
399(1.1.13, 1.0.12) work only when OpenSSL 1.0.1 or higher is used.
400</note>
401<note>
402The <literal>TLSv1.3</literal> parameter (1.13.0) works only when
403OpenSSL 1.1.1 built with TLSv1.3 support is used.
404</note>
405</para>
406
407</directive>
408
409
410<directive name="ssl_session_cache">
411<syntax>
412    <literal>off</literal> |
413    <literal>none</literal> |
414    [<literal>builtin</literal>[:<value>size</value>]]
415    [<literal>shared</literal>:<value>name</value>:<value>size</value>]</syntax>
416<default>none</default>
417<context>http</context>
418<context>server</context>
419
420<para>
421Sets the types and sizes of caches that store session parameters.
422A cache can be of any of the following types:
423<list type="tag">
424
425<tag-name><literal>off</literal></tag-name>
426<tag-desc>
427the use of a session cache is strictly prohibited:
428nginx explicitly tells a client that sessions may not be reused.
429</tag-desc>
430
431<tag-name><literal>none</literal></tag-name>
432<tag-desc>
433the use of a session cache is gently disallowed:
434nginx tells a client that sessions may be reused, but does not
435actually store session parameters in the cache.
436</tag-desc>
437
438<tag-name id="ssl_session_cache_builtin"><literal>builtin</literal></tag-name>
439<tag-desc>
440a cache built in OpenSSL; used by one worker process only.
441The cache size is specified in sessions.
442If size is not given, it is equal to 20480 sessions.
443Use of the built-in cache can cause memory fragmentation.
444</tag-desc>
445
446<tag-name id="ssl_session_cache_shared"><literal>shared</literal></tag-name>
447<tag-desc>
448a cache shared between all worker processes.
449The cache size is specified in bytes; one megabyte can store
450about 4000 sessions.
451Each shared cache should have an arbitrary name.
452A cache with the same name can be used in several virtual servers.
453</tag-desc>
454
455</list>
456</para>
457
458<para>
459Both cache types can be used simultaneously, for example:
460<example>
461ssl_session_cache builtin:1000 shared:SSL:10m;
462</example>
463but using only shared cache without the built-in cache should
464be more efficient.
465</para>
466
467</directive>
468
469
470<directive name="ssl_session_ticket_key">
471<syntax><value>file</value></syntax>
472<default/>
473<context>http</context>
474<context>server</context>
475<appeared-in>1.5.7</appeared-in>
476
477<para>
478Sets a <value>file</value> with the secret key used to encrypt
479and decrypt TLS session tickets.
480The directive is necessary if the same key has to be shared between
481multiple servers.
482By default, a randomly generated key is used.
483</para>
484
485<para>
486If several keys are specified, only the first key is
487used to encrypt TLS session tickets.
488This allows configuring key rotation, for example:
489<example>
490ssl_session_ticket_key current.key;
491ssl_session_ticket_key previous.key;
492</example>
493</para>
494
495<para>
496The <value>file</value> must contain 80 or 48 bytes
497of random data and can be created using the following command:
498<example>
499openssl rand 80 > ticket.key
500</example>
501Depending on the file size either AES256 (for 80-byte keys, 1.11.8)
502or AES128 (for 48-byte keys) is used for encryption.
503</para>
504
505</directive>
506
507
508<directive name="ssl_session_tickets">
509<syntax><literal>on</literal> | <literal>off</literal></syntax>
510<default>on</default>
511<context>http</context>
512<context>server</context>
513<appeared-in>1.5.9</appeared-in>
514
515<para>
516Enables or disables session resumption through
517<link url="https://tools.ietf.org/html/rfc5077">TLS session tickets</link>.
518</para>
519
520</directive>
521
522
523<directive name="ssl_session_timeout">
524<syntax><value>time</value></syntax>
525<default>5m</default>
526<context>http</context>
527<context>server</context>
528
529<para>
530Specifies a time during which a client may reuse the
531session parameters.
532</para>
533
534</directive>
535
536
537<directive name="ssl_stapling">
538<syntax><literal>on</literal> | <literal>off</literal></syntax>
539<default>off</default>
540<context>http</context>
541<context>server</context>
542<appeared-in>1.3.7</appeared-in>
543
544<para>
545Enables or disables
546<link url="https://tools.ietf.org/html/rfc4366#section-3.6">stapling
547of OCSP responses</link> by the server.
548Example:
549<example>
550ssl_stapling on;
551resolver 192.0.2.1;
552</example>
553</para>
554
555<para>
556For the OCSP stapling to work, the certificate of the server certificate
557issuer should be known.
558If the <link id="ssl_certificate"/> file does
559not contain intermediate certificates,
560the certificate of the server certificate issuer should be
561present in the
562<link id="ssl_trusted_certificate"/> file.
563</para>
564
565<para>
566For a resolution of the OCSP responder hostname,
567the <link doc="ngx_http_core_module.xml" id="resolver"/> directive
568should also be specified.
569</para>
570
571</directive>
572
573
574<directive name="ssl_stapling_file">
575<syntax><value>file</value></syntax>
576<default/>
577<context>http</context>
578<context>server</context>
579<appeared-in>1.3.7</appeared-in>
580
581<para>
582When set, the stapled OCSP response will be taken from the
583specified <value>file</value> instead of querying
584the OCSP responder specified in the server certificate.
585</para>
586
587<para>
588The file should be in the DER format as produced by the
589<literal>openssl ocsp</literal>” command.
590</para>
591
592</directive>
593
594
595<directive name="ssl_stapling_responder">
596<syntax><value>url</value></syntax>
597<default/>
598<context>http</context>
599<context>server</context>
600<appeared-in>1.3.7</appeared-in>
601
602<para>
603Overrides the URL of the OCSP responder specified in the
604<link url="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">Authority
605Information Access</link>” certificate extension.
606</para>
607
608<para>
609Only “<literal>http://</literal>” OCSP responders are supported:
610<example>
611ssl_stapling_responder http://ocsp.example.com/;
612</example>
613</para>
614
615</directive>
616
617
618<directive name="ssl_stapling_verify">
619<syntax><literal>on</literal> | <literal>off</literal></syntax>
620<default>off</default>
621<context>http</context>
622<context>server</context>
623<appeared-in>1.3.7</appeared-in>
624
625<para>
626Enables or disables verification of OCSP responses by the server.
627</para>
628
629<para>
630For verification to work, the certificate of the server certificate
631issuer, the root certificate, and all intermediate certificates
632should be configured as trusted using the
633<link id="ssl_trusted_certificate"/> directive.
634</para>
635
636</directive>
637
638
639<directive name="ssl_trusted_certificate">
640<syntax><value>file</value></syntax>
641<default/>
642<context>http</context>
643<context>server</context>
644<appeared-in>1.3.7</appeared-in>
645
646<para>
647Specifies a <value>file</value> with trusted CA certificates in the PEM format
648used to <link id="ssl_verify_client">verify</link> client certificates and
649OCSP responses if <link id="ssl_stapling"/> is enabled.
650</para>
651
652<para>
653In contrast to the certificate set by <link id="ssl_client_certificate"/>,
654the list of these certificates will not be sent to clients.
655</para>
656
657</directive>
658
659
660<directive name="ssl_verify_client">
661<syntax>
662    <literal>on</literal> | <literal>off</literal> |
663    <literal>optional</literal> | <literal>optional_no_ca</literal></syntax>
664<default>off</default>
665<context>http</context>
666<context>server</context>
667
668<para>
669Enables verification of client certificates.
670The verification result is stored in the
671<link id="var_ssl_client_verify">$ssl_client_verify</link> variable.
672</para>
673
674<para>
675The <literal>optional</literal> parameter (0.8.7+) requests the client
676certificate and verifies it if the certificate is present.
677</para>
678
679<para>
680The <literal>optional_no_ca</literal> parameter (1.3.8, 1.2.5)
681requests the client
682certificate but does not require it to be signed by a trusted CA certificate.
683This is intended for the use in cases when a service that is external to nginx
684performs the actual certificate verification.
685The contents of the certificate is accessible through the
686<link id="var_ssl_client_cert">$ssl_client_cert</link> variable.
687</para>
688
689</directive>
690
691
692<directive name="ssl_verify_depth">
693<syntax><value>number</value></syntax>
694<default>1</default>
695<context>http</context>
696<context>server</context>
697
698<para>
699Sets the verification depth in the client certificates chain.
700</para>
701
702</directive>
703
704</section>
705
706
707<section id="errors" name="Error Processing">
708
709<para>
710The <literal>ngx_http_ssl_module</literal> module supports several
711non-standard error codes that can be used for redirects using the
712<link doc="ngx_http_core_module.xml" id="error_page"/> directive:
713<list type="tag">
714
715<tag-name>495</tag-name>
716<tag-desc>
717an error has occurred during the client certificate verification;
718</tag-desc>
719
720<tag-name>496</tag-name>
721<tag-desc>
722a client has not presented the required certificate;
723</tag-desc>
724
725<tag-name>497</tag-name>
726<tag-desc>
727a regular request has been sent to the HTTPS port.
728</tag-desc>
729
730</list>
731</para>
732
733<para>
734The redirection happens after the request is fully parsed and
735the variables, such as <var>$request_uri</var>,
736<var>$uri</var>, <var>$args</var> and others, are available.
737</para>
738
739</section>
740
741
742<section id="variables" name="Embedded Variables">
743
744<para>
745The <literal>ngx_http_ssl_module</literal> module supports
746several embedded variables:
747<list type="tag">
748
749<tag-name id="var_ssl_cipher"><var>$ssl_cipher</var></tag-name>
750<tag-desc>
751returns the string of ciphers used
752for an established SSL connection;
753</tag-desc>
754
755<tag-name id="var_ssl_ciphers"><var>$ssl_ciphers</var></tag-name>
756<tag-desc>
757returns the list of ciphers supported by the client (1.11.7).
758Known ciphers are listed by names, unknown are shown in hexadecimal,
759for example:
760<example>
761AES128-SHA:AES256-SHA:0x00ff
762</example>
763<note>
764The variable is fully supported only when using OpenSSL version 1.0.2 or higher.
765With older versions, the variable is available
766only for new sessions and lists only known ciphers.
767</note>
768</tag-desc>
769
770<tag-name id="var_ssl_client_escaped_cert"><var>$ssl_client_escaped_cert</var></tag-name>
771<tag-desc>
772returns the client certificate in the PEM format (urlencoded)
773for an established SSL connection (1.13.5);
774</tag-desc>
775
776<tag-name id="var_ssl_client_cert"><var>$ssl_client_cert</var></tag-name>
777<tag-desc>
778returns the client certificate in the PEM format
779for an established SSL connection, with each line except the first
780prepended with the tab character;
781this is intended for the use in the
782<link doc="ngx_http_proxy_module.xml" id="proxy_set_header"/> directive;
783<note>
784The variable is deprecated,
785the <var>$ssl_client_escaped_cert</var> variable should be used instead.
786</note>
787</tag-desc>
788
789<tag-name id="var_ssl_client_fingerprint"><var>$ssl_client_fingerprint</var></tag-name>
790<tag-desc>
791returns the SHA1 fingerprint of the client certificate
792for an established SSL connection (1.7.1);
793</tag-desc>
794
795<tag-name id="var_ssl_client_i_dn"><var>$ssl_client_i_dn</var></tag-name>
796<tag-desc>
797returns the “issuer DN” string of the client certificate
798for an established SSL connection according to
799<link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
800</tag-desc>
801
802<tag-name id="var_ssl_client_i_dn_legacy"><var>$ssl_client_i_dn_legacy</var></tag-name>
803<tag-desc>
804returns the “issuer DN” string of the client certificate
805for an established SSL connection;
806<note>
807Prior to version 1.11.6, the variable name was <var>$ssl_client_i_dn</var>.
808</note>
809</tag-desc>
810
811<tag-name id="var_ssl_client_raw_cert"><var>$ssl_client_raw_cert</var>
812</tag-name>
813<tag-desc>
814returns the client certificate in the PEM format
815for an established SSL connection;
816</tag-desc>
817
818<tag-name id="var_ssl_client_s_dn"><var>$ssl_client_s_dn</var></tag-name>
819<tag-desc>
820returns the “subject DN” string of the client certificate
821for an established SSL connection according to
822<link url="https://tools.ietf.org/html/rfc2253">RFC 2253</link> (1.11.6);
823</tag-desc>
824
825<tag-name id="var_ssl_client_s_dn_legacy"><var>$ssl_client_s_dn_legacy</var></tag-name>
826<tag-desc>
827returns the “subject DN” string of the client certificate
828for an established SSL connection;
829<note>
830Prior to version 1.11.6, the variable name was <var>$ssl_client_s_dn</var>.
831</note>
832</tag-desc>
833
834<tag-name id="var_ssl_client_serial"><var>$ssl_client_serial</var></tag-name>
835<tag-desc>
836returns the serial number of the client certificate
837for an established SSL connection;
838</tag-desc>
839
840<tag-name id="var_ssl_client_v_end"><var>$ssl_client_v_end</var></tag-name>
841<tag-desc>
842returns the end date of the client certificate (1.11.7);
843</tag-desc>
844
845<tag-name id="var_ssl_client_v_remain"><var>$ssl_client_v_remain</var></tag-name>
846<tag-desc>
847returns the number of days
848until the client certificate expires (1.11.7);
849</tag-desc>
850
851<tag-name id="var_ssl_client_v_start"><var>$ssl_client_v_start</var></tag-name>
852<tag-desc>
853returns the start date of the client certificate (1.11.7);
854</tag-desc>
855
856<tag-name id="var_ssl_client_verify"><var>$ssl_client_verify</var></tag-name>
857<tag-desc>
858returns the result of client certificate verification:
859<literal>SUCCESS</literal>”, “<literal>FAILED:</literal><value>reason</value>”,
860and “<literal>NONE</literal>” if a certificate was not present;
861<note>
862Prior to version 1.11.7, the “<literal>FAILED</literal>” result
863did not contain the <value>reason</value> string.
864</note>
865</tag-desc>
866
867<tag-name id="var_ssl_curves"><var>$ssl_curves</var></tag-name>
868<tag-desc>
869returns the list of curves supported by the client (1.11.7).
870Known curves are listed by names, unknown are shown in hexadecimal,
871for example:
872<example>
8730x001d:prime256v1:secp521r1:secp384r1
874</example>
875<note>
876The variable is supported only when using OpenSSL version 1.0.2 or higher.
877With older versions, the variable value will be an empty string.
878</note>
879<note>
880The variable is available only for new sessions.
881</note>
882</tag-desc>
883
884<tag-name id="var_ssl_protocol"><var>$ssl_protocol</var></tag-name>
885<tag-desc>
886returns the protocol of an established SSL connection;
887</tag-desc>
888
889<tag-name id="var_ssl_server_name"><var>$ssl_server_name</var></tag-name>
890<tag-desc>
891returns the server name requested through
892<link url="http://en.wikipedia.org/wiki/Server_Name_Indication">SNI</link>
893(1.7.0);
894</tag-desc>
895
896<tag-name id="var_ssl_session_id"><var>$ssl_session_id</var></tag-name>
897<tag-desc>
898returns the session identifier of an established SSL connection;
899</tag-desc>
900
901<tag-name id="var_ssl_session_reused"><var>$ssl_session_reused</var></tag-name>
902<tag-desc>
903returns “<literal>r</literal>” if an SSL session was reused,
904or “<literal>.</literal>” otherwise (1.5.11).
905</tag-desc>
906
907</list>
908</para>
909
910</section>
911
912</module>
Note: See TracBrowser for help on using the repository browser.