summaryrefslogtreecommitdiffhomepage
path: root/src/mail/ngx_mail_ssl_module.c (follow)
AgeCommit message (Collapse)AuthorFilesLines
2015-03-23SSL: avoid SSL_CTX_set_tmp_rsa_callback() call with LibreSSL.Maxim Dounin1-0/+2
LibreSSL removed support for export ciphers and a call to SSL_CTX_set_tmp_rsa_callback() results in an error left in the error queue. This caused alerts "ignoring stale global SSL error (...called a function you should not call) while SSL handshaking" on a first connection in each worker process.
2015-02-25Mail: client SSL certificates support.Maxim Dounin1-0/+87
The "ssl_verify_client", "ssl_verify_depth", "ssl_client_certificate", "ssl_trusted_certificate", and "ssl_crl" directives introduced to control SSL client certificate verification in mail proxy module. If there is a certificate, detail of the certificate are passed to the auth_http script configured via Auth-SSL-Verify, Auth-SSL-Subject, Auth-SSL-Issuer, Auth-SSL-Serial, Auth-SSL-Fingerprint headers. If the auth_http_pass_client_cert directive is set, client certificate in PEM format will be passed in the Auth-SSL-Cert header (urlencoded). If there is no required certificate provided during an SSL handshake or certificate verification fails then a protocol-specific error is returned after the SSL handshake and the connection is closed. Based on previous work by Sven Peter, Franck Levionnois and Filipe Da Silva.
2014-06-16SSL: the "ssl_password_file" directive.Valentin Bartenev1-1/+36
2014-01-10SSL: ssl_session_tickets directive.Dirkjan Bussink1-0/+17
This adds support so it's possible to explicitly disable SSL Session Tickets. In order to have good Forward Secrecy support either the session ticket key has to be reloaded by using nginx' binary upgrade process or using an external key file and reloading the configuration. This directive adds another possibility to have good support by disabling session tickets altogether. If session tickets are enabled and the process lives for a long a time, an attacker can grab the session ticket from the process and use that to decrypt any traffic that occured during the entire lifetime of the process.
2013-10-11SSL: added ability to set keys used for Session Tickets (RFC5077).Piotr Sikora1-0/+17
In order to support key rollover, ssl_session_ticket_key can be defined multiple times. The first key will be used to issue and resume Session Tickets, while the rest will be used only to resume them. ssl_session_ticket_key session_tickets/current.key; ssl_session_ticket_key session_tickets/prev-1h.key; ssl_session_ticket_key session_tickets/prev-2h.key; Please note that nginx supports Session Tickets even without explicit configuration of the keys and this feature should be only used in setups where SSL traffic is distributed across multiple nginx servers. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-09-30Mail: fixed segfault with ssl/starttls at mail{} level and no cert.Maxim Dounin1-0/+5
A configuration like "mail { starttls on; server {}}" triggered NULL pointer dereference in ngx_mail_ssl_merge_conf() as conf->file was not set.
2013-09-22SSL: stop loading configs with invalid "ssl_ciphers" values.Piotr Sikora1-9/+8
While there, remove unnecessary check in ngx_mail_ssl_module. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-05-21Style: remove unnecessary references to HTTP from non-HTTP modules.Piotr Sikora1-2/+2
No functional changes. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
2013-05-10Mail: missing ngx_ssl_ecdh_curve() call.F. da Silva1-0/+4
2012-01-18Copyright updated.Maxim Konovalov1-0/+1
2012-01-11Added support for TLSv1.1, TLSv1.2 in ssl_protocols directive.Maxim Dounin1-1/+4
Support for TLSv1.1 and TLSv1.2 protocols was introduced in OpenSSL 1.0.1 (-beta1 was recently released). This change makes it possible to disable these protocols and/or enable them without other protocols.
2011-09-27Fix for "ssl_session_cache builtin" (broken since 1.1.1, r3993).Maxim Dounin1-2/+2
2011-08-04A new fix for the case when ssl_session_cache defined, but ssl is notIgor Sysoev1-0/+2
enabled in any server. The previous r1033 does not help when unused zone becomes used after reconfiguration, so it is backed out. The initial thought was to make SSL modules independed from SSL implementation and to keep OpenSSL code dependance as much as in separate files.
2011-07-20ECDHE supportIgor Sysoev1-1/+13
patch by Adrian Kotelba
2011-07-20MSIE export versions are rare now, so RSA 512 key is generated on demandIgor Sysoev1-3/+1
and is shared among all hosts instead of pregenerating for every HTTPS host on configuraiton phase. This decreases start time for configuration with large number of HTTPS hosts.
2011-06-27use !aNULL to disable all anonymous cipher suitesIgor Sysoev1-1/+1
patch by Rob Stradling
2010-05-14ngx_str_set() and ngx_str_null()Igor Sysoev1-2/+1
2009-10-07use only strong ciphers by defaultIgor Sysoev1-1/+1
2009-10-06disable SSLv2 and low ciphers by defaultIgor Sysoev1-3/+2
2009-07-23delete OpenSSL pre-0.9.7 compatibility: the sources were not actuallyIgor Sysoev1-32/+0
compatible with OpenSSL 0.9.6 since ssl_session_cache introduction
2009-06-02return NULL instead of NGX_CONF_ERROR on a create conf failureIgor Sysoev1-1/+1
2009-04-27fix building by MSVC8Igor Sysoev1-1/+1
2008-09-01*) listen sslIgor Sysoev1-14/+107
*) no default ssl_cetificate and ssl_cetificate_key
2008-07-29fix typoIgor Sysoev1-6/+6
2008-06-16DH parameters, ssl_dhparamIgor Sysoev1-4/+16
2008-05-26ssl_session_cache noneIgor Sysoev1-1/+6
2007-12-26ssl_session_cache offIgor Sysoev1-4/+8
2007-09-15ngx_mail_pop3_module, ngx_mail_imap_module, and ngx_mail_smtp_moduleIgor Sysoev1-0/+2
2007-03-19Many changes:Igor Sysoev1-0/+393
*) rename imap to mail, sort pop3/imap functions *) smtp auth support *) pop3 starttls only *) fix segfault if cram-md5 was used without apop
generated by cgit (git 2.34.1) at 2026-01-06 23:07:38 +0000