Commit Graph

11 Commits

Author SHA1 Message Date
Roman Arutyunyan
05a455ff21 Stream: phases. 2016-09-15 14:55:54 +03:00
Vladimir Homutov
9721eae1f1 Stream: SSL-related variables. 2016-06-29 12:52:52 +03:00
Vladimir Homutov
db5a15d2f9 Stream: added preconfiguration step. 2016-06-15 15:10:24 +03:00
Tim Taubert
4f578bfcab SSL: ngx_ssl_ciphers() to set list of ciphers.
This patch moves various OpenSSL-specific function calls into the
OpenSSL module and introduces ngx_ssl_ciphers() to make nginx more
crypto-library-agnostic.
2016-06-15 21:05:30 +01:00
Maxim Dounin
3b7dca4bb5 SSL: support for multiple curves (ticket #885).
OpenSSL 1.0.2+ allows configuring a curve list instead of a single curve
previously supported.  This allows use of different curves depending on
what client supports (as available via the elliptic_curves extension),
and also allows use of different curves in an ECDHE key exchange and
in the ECDSA certificate.

The special value "auto" was introduced (now the default for ssl_ecdh_curve),
which means "use an internal list of curves as available in the OpenSSL
library used".  For versions prior to OpenSSL 1.0.2 it maps to "prime256v1"
as previously used.  The default in 1.0.2b+ prefers prime256v1 as well
(and X25519 in OpenSSL 1.1.0+).

As client vs. server preference of curves is controlled by the
same option as used for ciphers (SSL_OP_CIPHER_SERVER_PREFERENCE),
the ssl_prefer_server_ciphers directive now controls both.
2016-05-19 14:46:32 +03:00
Maxim Dounin
cf126b98b3 SSL: support for multiple certificates (ticket #814). 2016-05-19 14:46:32 +03:00
Maxim Dounin
8fc90404fb SSL: RSA_generate_key() is deprecated in OpenSSL 1.1.0.
OpenSSL removed support for all 40 and 56 bit ciphers.
2016-03-31 23:38:34 +03:00
Piotr Sikora
130396928a Stream: avoid SSL_CTX_set_tmp_rsa_callback() call with LibreSSL.
Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2015-06-18 03:36:41 -07:00
Vladimir Homutov
d56b84b783 Stream: added postconfiguration method to stream modules. 2015-06-09 13:00:45 +03:00
Maxim Dounin
724f0f028e Disabled SSLv3 by default (ticket #653). 2015-05-25 17:58:20 +03:00
Ruslan Ermilov
c799c82faa Stream: port from NGINX+. 2015-04-20 13:05:11 +03:00