Skip to content

Documented restricting $ssl_server_name in certificate file names #304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
VadimZhestikov wants to merge 1 commit into
base: main
Choose a base branch
from
+92 −12
Open

Documented restricting $ssl_server_name in certificate file names #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions xml/en/docs/http/ngx_http_ssl_module.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,28 @@ a certificate will be loaded for each SSL handshake,
and this may have a negative impact on performance.
</para>

<para>
Since <link id="var_ssl_server_name">$ssl_server_name</link>
is chosen by the client,
loading certificates with such a file name should be filtered:
<example>
map $ssl_server_name $name {
hostnames;

default www.example.org;

.example.org www.example.org;
.example.com www.example.com;
}

server {
listen 443 ssl;
ssl_certificate certs/$name.crt;
ssl_certificate_key certs/$name.key;
}
</example>
</para>

<para id="ssl_certificate_data">
The value
<literal>data</literal>:<value>$variable</value>
Expand Down Expand Up @@ -225,7 +247,7 @@ IP addresses</link>.
Defines a cache that stores
<link id="ssl_certificate">SSL certificates</link> and
<link id="ssl_certificate_key">secret keys</link>
specified with <link id="ssl_certificate_key_variables">variables</link>.
specified with <link id="ssl_certificate_variables">variables</link>.
</para>

<para>
Expand Down Expand Up @@ -273,8 +295,6 @@ disables the cache.
<para>
Example:
<example>
ssl_certificate $ssl_server_name.crt;
ssl_certificate_key $ssl_server_name.key;
ssl_certificate_cache max=1000 inactive=20s valid=1m;
</example>
</para>
Expand Down
26 changes: 23 additions & 3 deletions xml/en/docs/stream/ngx_stream_ssl_module.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,28 @@ a certificate will be loaded for each SSL handshake,
and this may have a negative impact on performance.
</para>

<para>
Since <link id="var_ssl_server_name">$ssl_server_name</link>
is chosen by the client,
loading certificates with such a file name should be filtered:
<example>
map $ssl_server_name $name {
hostnames;

default www.example.org;

.example.org www.example.org;
.example.com www.example.com;
}

server {
listen 443 ssl;
ssl_certificate certs/$name.crt;
ssl_certificate_key certs/$name.key;
}
</example>
</para>

<para id="ssl_certificate_data">
The value
<literal>data</literal>:<value>$variable</value>
Expand Down Expand Up @@ -207,7 +229,7 @@ IP addresses</link>.
Defines a cache that stores
<link id="ssl_certificate">SSL certificates</link> and
<link id="ssl_certificate_key">secret keys</link>
specified with <link id="ssl_certificate_key_variables">variables</link>.
specified with <link id="ssl_certificate_variables">variables</link>.
</para>

<para>
Expand Down Expand Up @@ -255,8 +277,6 @@ disables the cache.
<para>
Example:
<example>
ssl_certificate $ssl_server_name.crt;
ssl_certificate_key $ssl_server_name.key;
ssl_certificate_cache max=1000 inactive=20s valid=1m;
</example>
</para>
Expand Down
26 changes: 23 additions & 3 deletions xml/ru/docs/http/ngx_http_ssl_module.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,28 @@ ssl_certificate_key $ssl_server_name.key;
что может отрицательно влиять на производительность.
</para>

<para>
Поскольку значение <link id="var_ssl_server_name">$ssl_server_name</link>
выбирается клиентом,
загрузку сертификатов с таким именем файла следует фильтровать:
<example>
map $ssl_server_name $name {
hostnames;

default www.example.org;

.example.org www.example.org;
.example.com www.example.com;
}

server {
listen 443 ssl;
ssl_certificate certs/$name.crt;
ssl_certificate_key certs/$name.key;
}
</example>
</para>

<para id="ssl_certificate_data">
Вместо <value>файла</value> можно указать значение
<literal>data</literal>:<value>$переменная</value> (1.15.10),
Expand Down Expand Up @@ -227,7 +249,7 @@ IP-адресах</link>.
Задаёт кэш, в котором могут храниться
<link id="ssl_certificate">SSL-сертификаты</link> и
<link id="ssl_certificate_key">секретные ключи</link>,
полученные из <link id="ssl_certificate_key_variables">переменных</link>.
полученные из <link id="ssl_certificate_variables">переменных</link>.
</para>

<para>
Expand Down Expand Up @@ -275,8 +297,6 @@ IP-адресах</link>.
<para>
Пример:
<example>
ssl_certificate $ssl_server_name.crt;
ssl_certificate_key $ssl_server_name.key;
ssl_certificate_cache max=1000 inactive=20s valid=1m;
</example>
</para>
Expand Down
26 changes: 23 additions & 3 deletions xml/ru/docs/stream/ngx_stream_ssl_module.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,28 @@ ssl_certificate_key $ssl_server_name.key;
что может отрицательно влиять на производительность.
</para>

<para>
Поскольку значение <link id="var_ssl_server_name">$ssl_server_name</link>
выбирается клиентом,
загрузку сертификатов с таким именем файла следует фильтровать:
<example>
map $ssl_server_name $name {
hostnames;

default www.example.org;

.example.org www.example.org;
.example.com www.example.com;
}

server {
listen 443 ssl;
ssl_certificate certs/$name.crt;
ssl_certificate_key certs/$name.key;
}
</example>
</para>

<para id="ssl_certificate_data">
Вместо <value>файла</value> можно указать значение
<literal>data</literal>:<value>$переменная</value> (1.15.10),
Expand Down Expand Up @@ -209,7 +231,7 @@ IP-адресах</link>.
Задаёт кэш, в котором могут храниться
<link id="ssl_certificate">SSL-сертификаты</link> и
<link id="ssl_certificate_key">секретные ключи</link>,
полученные из <link id="ssl_certificate_key_variables">переменных</link>.
полученные из <link id="ssl_certificate_variables">переменных</link>.
</para>

<para>
Expand Down Expand Up @@ -257,8 +279,6 @@ IP-адресах</link>.
<para>
Пример:
<example>
ssl_certificate $ssl_server_name.crt;
ssl_certificate_key $ssl_server_name.key;
ssl_certificate_cache max=1000 inactive=20s valid=1m;
</example>
</para>
Expand Down