ngx_mail_ssl_module

This translation may be out of date.
Check the English version
for recent changes.

Directives
     ssl
     ssl_certificate
     ssl_certificate_key
     ssl_prefer_server_ciphers
     ssl_protocols
     ssl_session_cache
     ssl_session_timeout
     starttls

The ngx_mail_ssl_module provides the necessary
support for mail proxy server for the SSL/TLS protocol.

This module is not built by default, it should be enabled with
the --with-mail_ssl_module
configuration parameter.

This module requires the OpenSSL
library.

Directives

syntax: ssl on | off;
default:
ssl off;
context: mail, server

Enables the HTTPS protocol for the given virtual server.

syntax: ssl_certificate file;
default:

context: mail, server

Specifies a file with a certificate in the PEM format for the given
virtual server.
If intermediate certificates should be specified in addition to a primary
certificate, they should be specified in the same file in the following
order: the primary certificate comes first, then the intermediate certificates.
A secret key in the PEM format may be placed in the same file.

syntax: ssl_certificate_key file;
default:

context: mail, server

Specifies a file with a secret key in the PEM format for the given virtual
server.

syntax: ssl_prefer_server_ciphers on | off;
default:
ssl_prefer_server_ciphers off;
context: mail, server

Specifies that server ciphers should be preferred over client ciphers
when using the SSLv3 and TLS protocols.

syntax: ssl_protocols
[SSLv2]
[SSLv3]
[TLSv1]
[TLSv1.1]
[TLSv1.2];
default:
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
context: mail, server

Enables the specified protocols.
The parameters TLSv1.1 and TLSv1.2 work
only when using the OpenSSL library version 1.0.1 and higher.

The parameters TLSv1.1 and TLSv1.2 are
supported starting from versions 1.1.13 and 1.0.12
so when using OpenSSL version 1.0.1
and higher on older nginx versions these protocols will work but could not
be disabled.

syntax: ssl_session_cache
off |
none |
[builtin[:size]]
[shared:name:size];
default:
ssl_session_cache none;
context: mail, server

Sets types and sizes of caches that store session parameters.
A cache can be any of the following types:

off
the use of session cache is strictly prohibited:
nginx explicitly tells a client that sessions may not be reused.
none
the use of session cache is gently disallowed:
nginx tells a client that sessions may be reused, but does not
actually do that.
builtin
a cache built in OpenSSL; used by one worker process only.
The cache size is specified in sessions.
If size is not given, it is equal to 20480 sessions.
Use of the built-in cache can cause memory fragmentation.
shared
shared between all worker processes.
The cache size is specified in bytes; one megabyte can store
about 4000 sessions.
Each shared cache should have an arbitrary name.
A cache with the same name can be used in several
virtual servers.

Both cache types can be used simultaneously, for example:

ssl_session_cache builtin:1000 shared:SSL:10m;

but using only shared cache without the built-in cache should
be more efficient.

syntax: ssl_session_timeout time;
default:
ssl_session_timeout 5m;
context: mail, server

Specifies a time during which a client may reuse the
session parameters stored in a cache.

syntax: starttls
on |
off |
only;
default:
starttls off;
context: mail, server
on
Allow usage of STLS command for the POP3
and STARTTLS command for the IMAP;
off
Deny usage of STLS
and STARTTLS commands;
only
require preliminary TLS transition.

Was this helpful?

0 / 0

发表评论 0

Your email address will not be published. Required fields are marked *