1.1 网络安全知识

1.1.1 网结安全出现背景

1.1.2 网络安全涉及问题

1.2 网络安全问题的解决

1.2.1 网络安全解决问题如何保证数据的机密性

1.2.2 网络安全解决问题-如何保证数据的完整

1.2.3 网络安全解决问题-如何进行传输双方身份验证

1.3 证书的由来

1.3.1 如何获取公钥信息

1.3.2 证书信息所包含什么内容

1.4 加密算法的简介

1.4.1 对称加密算法

1.4.2 单向加密算法

1.4.3 非对称加密算法

1.5 OpenSSL软件介绍

1.5.1 OpenSSL软件概念说明

1.5.2 OpenSSL软件组成部分

1.5.3 OpenSSL的使用

系统环境说明

检查OpenSLL**软件版本:**

   方法一:

   方法二:

主配置文件位置:

openssl使用帮助

<p>
  <span style="font-family: '微软雅黑',sans-serif;">加密一个文件的方法:</span>
</p>

<div class="cnblogs_code">
  <pre>openssl enc -des3 -salt -a -<span style="color: #0000ff;">in</span> inittab -out initab.des3 <span style="color: #008000;">#</span><span style="color: #008000;"> 输入密码后BP加密成功</span>

openssl enc -des3 -d -salt -a -in initab.des3 -out inittab # 输入钥后即解密成功

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">说明:其中命令中的</span>salt<span style="font-family: '微软雅黑',sans-serif;">参数,主要用于避免密码加密后,对密钥串的反推</span>
</p>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">输出一个文件的特征码方式</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">md5sum inittab 

shalsum inittab openssl dgst -shal inittab # 利用openssl 生成文件特征码 # dgst—表示指定使用摘要命令 # -shal—表示指定摘要命令选用shal算法

<p>
  <span style="font-family: '微软雅黑',sans-serif;">生成和用户一样的密码串</span>
</p>

<div class="cnblogs_code">
  <pre>openssl  passwd -1  <span style="color: #008000;">#</span><span style="color: #008000;"> 采用md5加密用户密码串</span></pre>
</div>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">生成伪随机数方法</span>
</p>

<div class="cnblogs_code">
  <pre>openssl rand -base 64 45 <span style="color: #008000;">#</span><span style="color: #008000;"> 给出一个任意数字,就会生产任意的随机数</span></pre>
</div>

<h3>
  <span id="154_OpenSSLCA">1.5.4 OpenSSL<span style="font-family: '微软雅黑',sans-serif;">软件建立是有</span>CA</span>
</h3>

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";background: yellow;">创建私钥与公钥信息</span></strong>
</p>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">需要先给</span>ca<span style="font-family: '微软雅黑',sans-serif;">证书颁发机构生成证书,即生成一对密钥;</span>genrsa - generate an RSA private key<span style="font-family: '微软雅黑',sans-serif;">利用</span>gerusa<span style="font-family: '微软雅黑',sans-serif;">生成密钥信息。虽然只是生成私钥,但需要清除公钥是通过私钥进行提取得到的,所以只要有私钥,就可以有公钥,私钥信息是非常重要的,因此生成的私钥文件应该是</span>600<span style="font-family: '微软雅黑',sans-serif;">的权限。</span>
</p>

<div class="cnblogs_code">
  <pre>openssl genrsa 1024 >server.key    <span style="color: #008000;">#</span><span style="color: #008000;"> 创建私钥信息,并指定私钥的长度为2048,并将生成的私钥信息保存在一个文件中</span>

openssl genrsa -out server.key 1024 # 将私钥信息直接进行保存,加密长度一定要放在输出文件后面 (umask 077;openssl genrsa -out server1024.key 1024) # 利用小括号,实现子shell功能,临时修改umask,使之创建的私钥文件权限为600 说明:密钥文件也可以进行加密的,并且支持后期手工加密,但不建议加密,每次使用私钥文件还要进行解密,比较麻烦 openssl rsa -in server1024.key -pubout #读取私钥文件命令

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";background: yellow;">生成自签署的证书</span></strong>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 ~]<span style="color: #008000;">#</span><span style="color: #008000;"> openssl req -new -x509 -key server1024.key -out server.crt -days 365</span>

参数说明 req # 用于创建新的证书 new # 表示创建的是新的证书 x509 # 表示定义证书的格式为标准格式 key # 表示调用的私钥文件信息 out # 表示输出证书文件信息 days # 表示证书的有效期

<p>
  <span style="font-family: '微软雅黑',sans-serif;">生产自签发证书的过程。</span>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 key]<span style="color: #008000;">#</span><span style="color: #008000;"> openssl req -new -x509 -key server1024.key -out server.crt -days 3650</span>

You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ., the field will be left blank. —– Country Name (2 letter code) [XX]:CN # 定义生成证书的国家 State or Province Name (full name) []:BJ # 定义生成证书的省份 Locality Name (eg, city) [Default City]:BJ # 定义生成证书的城市 Organization Name (eg, company) [Default Company Ltd]:nmtui.com # 生成证书的组织 Organizational Unit Name (eg, section) []:ops # 生成证书的职能部门 Common Name (eg, your name or your servers hostname) []:blog.nmtui.com # 主机名称 Email Address []:[email protected] # 邮件地址 # 说明:此输出信息非常重要,客户端在获取证书前,会利用主机名与相应服务器之间建立连接,然后获得证书。

<p>
  <span style="font-family: '微软雅黑',sans-serif;">查看生成证书的信息的方法</span>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 key]<span style="color: #008000;">#</span><span style="color: #008000;"> openssl x509 -text -in server.crt </span>

Certificate: Data: Version: 3 (0x2) Serial Number: 9747921528343358470 (0x874792fbbb49ec06) Signature Algorithm: sha1WithRSAEncryption Issuer: C=CN, ST=BJ, L=BJ, O=nmtui.com, OU=ops, CN=blog.nmtui.com/[email protected]

<p>
  CA<span style="font-family: '微软雅黑',sans-serif;">目签发证书实际创建过程</span>
</p>

<div class="cnblogs_code">
  <pre>cd /etc/pki/CA/private/         <span style="color: #008000;">#</span><span style="color: #008000;"> 进入到私钥保存目录中</span>

(umask 077;openssl genrsa -out ./cakey.pem 2048) # 创建一个 ca 私钥文件 cd /etc/pki/CA # 进入到CA目签发保存目录中 openssl req -new -x509 -key private/cakey.pem -out cacert.pem # 生成自签发证书 # 说明:由于下面配置文件中定义了一些证书信息,所以默认即可。

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";background: yellow;">相关配置文件参数设定</span></strong>
</p>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">证书颁发机构的配置文件信息设定</span>
</p>

<p style="text-indent: 21.0pt;">
  ca<span style="font-family: '微软雅黑',sans-serif;">颁发机构的私钥和证书是不能随便放置的,并且需要配置私有颁发机构的配置文件</span>
</p>

<div class="cnblogs_code">
  <pre>/etc/pki/tls/openssl.cnf<span style="text-indent: 21pt;">&nbsp;</span></pre>
</div>

<p>
  <strong>&nbsp;&nbsp; [ CA_default ] </strong><strong><span style="font-family: '微软雅黑',sans-serif;">模块参数说明:</span></strong>
</p>

<table style="width: 100%; border-collapse: collapse; border-width: initial; border-style: none; border-color: initial;" border="1" cellspacing="0" cellpadding="0">
  <tr>
    <td style="width: 16.22%; border-top: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: 1pt solid #9bbb59; border-right: none; background: #9bbb59; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数</span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: solid #9BBB59 1.0pt; border-left: none; border-bottom: solid #9BBB59 1.0pt; border-right: none; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">配置</span></strong>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: solid #9BBB59 1.0pt; border-left: none; border-bottom: solid #9BBB59 1.0pt; border-right: none; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">官方配置说明</span></strong>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="21%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">解释配置说明</span></strong>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">dir&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= /etc/pki/CA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">Where everything is kept</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">创建并定义</span>CA<span style="font-family: '微软雅黑',sans-serif;">目录信息</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">certs&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/certs&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">Where the issued certs are kept</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">证书文件保存目录</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">crl_dir&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/crl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">Where the issued crl are kept</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">证书吊销文件保存目录</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">database&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/index.txt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">database index file.</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">表示发过哪些证书,都要文件进行记录</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">new_certs_dir </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/newcerts&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">default place for new certs.</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">默认新证书的存放路径</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">certificate&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/cacert.pem&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">The CA certificate</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">定义</span>ca<span style="font-family: '微软雅黑',sans-serif;">机构自己的证书</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">serial&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/serial&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">The current serial number</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">表示证书对应的序列号,一般从</span>01<span style="font-family: '微软雅黑',sans-serif;">开始</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">crlnumber&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/crlnumber&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">the current crl number</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">表示吊销证书对应的序列号</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">crl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/crl.pem&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">The current CRL</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">表示当前证书吊销列表文件</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">private_key&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/private/cakey.pem</span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">The private key</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">表示</span>ca<span style="font-family: '微软雅黑',sans-serif;">机构自身的私钥文件</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 16.22%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="16%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">RANDFILE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 28.48%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="28%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= $dir/private/.rand&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">private random number file</span>
      </p>
    </td>
    
    <td style="width: 21.68%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="21%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">私钥随机数文件,此文件默认会自己建立</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 100%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #92d050; padding: 0cm 5.4pt;" colspan="4" width="100%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: '微软雅黑',sans-serif;">在</span>/ctc/pki/CA</strong><strong><span style="font-family: '微软雅黑',sans-serif;">的证书路径下,还需要要有</span>certs crl newcerts</strong><strong><span style="font-family: '微软雅黑',sans-serif;">三个子目录信息</span></strong>
      </p>
    </td>
  </tr>
</table>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">指定证书相关的有效期配置</span>
</p>

<table style="width: 100%; border-collapse: collapse; border-width: initial; border-style: none; border-color: initial;" border="1" cellspacing="0" cellpadding="0">
  <tr>
    <td style="width: 20.3%; border-top: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: 1pt solid #9bbb59; border-right: none; background: #9bbb59; padding: 0cm 5.4pt;" width="20%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数</span></strong>
      </p>
    </td>
    
    <td style="width: 14.92%; border-top: solid #9BBB59 1.0pt; border-left: none; border-bottom: solid #9BBB59 1.0pt; border-right: none; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt;" width="14%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">配置</span></strong>
      </p>
    </td>
    
    <td style="width: 31.18%; border-top: solid #9BBB59 1.0pt; border-left: none; border-bottom: solid #9BBB59 1.0pt; border-right: none; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt;" width="31%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">官方配置说明</span></strong>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="33%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">解释配置说明</span></strong>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 20.3%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="20%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">default_days&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 14.92%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="14%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= 365 &nbsp;&nbsp;&nbsp;</span>
      </p>
    </td>
    
    <td style="width: 31.18%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="31%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">how long to certify for</span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">定义证书的有效期</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 20.3%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="20%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">default_crl_days</span></strong>
      </p>
    </td>
    
    <td style="width: 14.92%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="14%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= 30&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 31.18%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="31%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">how long before next CRL</span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">默认证书放置到吊销列表中的保存时间</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 20.3%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="20%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">default_md&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 14.92%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="14%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= default</span>
      </p>
    </td>
    
    <td style="width: 31.18%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="31%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">use public key default MD</span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">指定单向加密算法采用的是默认的</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 20.3%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="20%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">preserve&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></strong>
      </p>
    </td>
    
    <td style="width: 14.92%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="14%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= no&nbsp;&nbsp;&nbsp;&nbsp; </span>
      </p>
    </td>
    
    <td style="width: 31.18%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="31%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">keep passed DN ordering</span>
      </p>
    </td>
    
    <td style="width: 33.62%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="33%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        -
      </p>
    </td>
  </tr>
</table>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">定义</span>[ req_distinguished_name ]<span style="font-family: '微软雅黑',sans-serif;">模块参数信息,即指定证书中的一些基本属性信息</span>
</p>

<table style="border-collapse: collapse; border-width: initial; border-style: none; border-color: initial; width: 100%;" border="1" cellspacing="0" cellpadding="0">
  <tr>
    <td style="width: 35.92%; border-top: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: 1pt solid #9bbb59; border-right: none; background: #9bbb59; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: solid #9BBB59 1.0pt; border-left: none; border-bottom: solid #9BBB59 1.0pt; border-right: none; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">配置</span></strong>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: solid #9BBB59 1.0pt; border-left: none; border-bottom: solid #9BBB59 1.0pt; border-right: none; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">举例配置</span></strong>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">解释配置说明</span></strong>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">countryName_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= XX</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= CN</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">国家或地区</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">stateOrProvinceName_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 宋体;">=</span><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;"> Default Province</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= BJ</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">省份</span>/<span style="font-family: '微软雅黑',sans-serif;">州</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">localityName_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 宋体;">=</span><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;"> Default City</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= BJ</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">城市名称</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">0.organizationName_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 宋体;">=</span><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;"> Default Company Ltd</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= nmtui.com</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">公司组织名称</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">organizationalUnitName_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">=</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= ops</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">部门名称</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">commonName_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">-</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= blog.nmtui.com</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">主机名</span>/<span style="font-family: '微软雅黑',sans-serif;">域名</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.92%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong><span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">emailAddress_default</span></strong>
      </p>
    </td>
    
    <td style="width: 26.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="26%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">-</span>
      </p>
    </td>
    
    <td style="width: 24.4%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="24%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: 'Yu Gothic UI Semibold',sans-serif;">= [email protected]</span>
      </p>
    </td>
    
    <td style="width: 13.28%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="13%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">邮件地址</span>
      </p>
    </td>
  </tr>
</table>

<h3>
  <span id="155">1.5.5 <span style="font-family: '微软雅黑',sans-serif;">公司中申请证书文件的流程</span></span>
</h3>

<div class="cnblogs_code">
  <pre><span style="color: #008000;">#</span><span style="color: #008000;"> 第一步创建私钥文件:</span>

(umask 077;openssl genrsa -out httpd.key 1024) # 模拟客户端,创建web服务的私钥 # 第二步创建证书请求文件 openssl req -new -key httpd.key -out httpd.csr # 创建向CA申请证书的请求证书 # 第三步将请求文件发送给证书颁发机构

<h2>
  <span id="16_WEBHTTPS">1.6 WEB<span style="font-family: '微软雅黑',sans-serif;">服务实现</span>HTTPS<span style="font-family: '微软雅黑',sans-serif;">访问</span></span>
</h2>

<h3>
  <span id="161">1.6.1 <span style="font-family: '微软雅黑',sans-serif;">证书的创建</span></span>
</h3>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">说明:再测试环境中,可以使用只生产的证书进行测试(使用只生产的证书在访问时会报证书不安全!),自生产证书的方法如上所示。</span>
</p>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">这是使用的时腾讯云申请的免费</span>SSL<span style="font-family: '微软雅黑',sans-serif;">证书进行测试。</span>
</p>

<p style="text-indent: 21.0pt;">
  <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";background: yellow;">证书获取方法:</span></strong>
</p>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">登陆腾讯云,访问</span><a href="https://console.cloud.tencent.com/ssl">https://console.cloud.tencent.com/ssl</a><span style="font-family: '微软雅黑',sans-serif;">证书管理。</span>
</p>

<p style="text-align: center;" align="center">
  &nbsp;<img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119110835209-1554995470.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">图</span> - <span style="font-family: '微软雅黑',sans-serif;">申请证书</span>
</p>

<p style="text-align: center;" align="center">
  &nbsp;<img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119110844349-536824876.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">图</span> - <span style="font-family: '微软雅黑',sans-serif;">选择《亚洲诚信》免费证书</span>
</p>

<p style="text-align: center;" align="center">
  &nbsp;<img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119110851443-358141036.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">图</span> - <span style="font-family: '微软雅黑',sans-serif;">输入域名信息</span>
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">注意:域名需要为你所持有的域名</span>
</p>

<p style="text-align: center;" align="center">
  &nbsp;<img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119110858396-267584542.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">图</span> - <span style="font-family: '微软雅黑',sans-serif;">验证域名的所有权</span>
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">域名验证通过后,即可下载生成的密钥</span>
</p>

<p style="text-align: center;" align="center">
  &nbsp;<img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119110904928-336310638.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">图</span> - <span style="font-family: '微软雅黑',sans-serif;">下载证书文件</span>
</p>

<p style="text-align: center;" align="center">
  &nbsp;<img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119110910678-1786088765.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />
</p>

<p style="text-align: center;" align="center">
  <span style="font-family: '微软雅黑',sans-serif;">图</span> - <span style="font-family: '微软雅黑',sans-serif;">得到的证书文件</span>
</p>

<h3>
  <span id="162_nginxhttps">1.6.2 nginx<span style="font-family: '微软雅黑',sans-serif;">配置</span>https<span style="font-family: '微软雅黑',sans-serif;">访问</span></span>
</h3>

<p style="text-indent: 15.75pt;">
  nginx<span style="font-family: '微软雅黑',sans-serif;">的搭建参考:</span><a href="/wp-content/themes/clsn-003/inc/go.php?url=http://www.cnblogs.com/clsn/p/8025324.html" >http://www.cnblogs.com/clsn/p/8025324.html</a>
</p>

<p style="margin-left: 7.1pt; text-indent: 8.65pt;">
  <span style="font-family: '微软雅黑',sans-serif;">创建证书存放目录,讲获取的证书放到这个目录</span>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 key]<span style="color: #008000;">#</span><span style="color: #008000;"> mkdir -p cd /application/nginx/conf/key/</span>

[root@web01 ~]# cd /application/nginx/conf/key/ [root@web01 key]# ll total 8 -rw-r–r– 1 www www 3307 Jan 18 10:48 1_blog.nmtui.com_bundle.crt -rw-r–r– 1 www www 1700 Jan 18 10:48 2_blog.nmtui.com.key

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">主配置文件</span>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 ~]<span style="color: #008000;">#</span><span style="color: #008000;"> cat /application/nginx/conf/nginx.conf</span>

worker_processes 1; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; client_max_body_size 1000M; client_body_buffer_size 10M; log_format main $remote_addr - $remote_user [$time_local] “$request” $status $body_bytes_sent “$http_referer” "$http_user_agent" “$http_x_forwarded_for”;

include extra</span>/<span style="color: #000000;">blog.conf;

}

<p style="text-indent: 15.75pt;">
  blog<span style="font-family: '微软雅黑',sans-serif;">站点配置文件</span>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 ~]<span style="color: #008000;">#</span><span style="color: #008000;"> cat /application/nginx/conf/extra/blog.conf </span>

server{ listen 80; server_name blog.nmtui.com; rewrite ^(.) https://$host$1 permanent; } server { listen 443; server_name blog.nmtui.com; ssl on; ssl_certificate /application/nginx/conf/key/1_blog.nmtui.com_bundle.crt; ssl_certificate_key /application/nginx/conf/key/2_blog.nmtui.com.key; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; ssl_prefer_server_ciphers on; location / { root html/blog; try_files $uri $uri/ /index.php?$args; index index.php index.html index.htm; } rewrite /wp-admin$ $scheme://$host$uri/ permanent;
location ~
.*.(php|php5)?$ { root html/blog; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fastcgi.conf; } access_log logs/access_blog.log main; } 

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">创建测试面页</span>
</p>

<div class="cnblogs_code">
  <pre>[root@web01 ~]<span style="color: #008000;">#</span><span style="color: #008000;"> cat >> /application/nginx/html/blog/clsn.html &lt;&lt;EOF</span>

web01 https://blog.nmtui.com EOF

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">配置完成后重启,在浏览器进访问测试</span>
</p>

<p style="text-align: center; text-indent: 15.75pt;" align="center">
  <img data-original="https://clsn.io/wp-content/uploads/2018/03/1190037-20180119111202803-936086090.png" src="/wp-content/themes/clsn-003/img/blank.gif" alt="HTTPS 原理与证书实践" alt="" />&nbsp;
</p>

<h3>
  <span id="163_httphttps">1.6.3 <span style="font-family: '微软雅黑',sans-serif;">实现</span>http<span style="font-family: '微软雅黑',sans-serif;">访问自动跳转到</span>https<span style="font-family: '微软雅黑',sans-serif;">的方法</span></span>
</h3>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">方法一:利用地址重写功能</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">server {
listen  </span>80<span style="color: #000000;">;
server_name blog.nmtui.com;
rewrite </span>^(.*)$  https://$host$1<span style="color: #000000;"> permanent;

} # 说明:在https配置server基础上再添加http跳转server

<p>
  <span style="font-family: '微软雅黑',sans-serif;">方法二:利用</span>error_page<span style="font-family: '微软雅黑',sans-serif;">识别错误码信息进行跳转</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">server {
    listen       </span>443<span style="color: #000000;">;
    listen       </span>80<span style="color: #000000;">;
    server_name  blog.nmtui.com;
    ssl on;
    ssl_certificate </span>/application/nginx/conf/key/<span style="color: #000000;">1_blog.nmtui.com_bundle.crt;
    ssl_certificate_key </span>/application/nginx/conf/key/<span style="color: #000000;">2_blog.nmtui.com.key;
    location </span>/<span style="color: #000000;"> {
        root   html</span>/<span style="color: #000000;">www;
        index  index.html index.htm;
    }
   error_page </span>497  https://<span style="color: #000000;">$host$uri;

}

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">说明:</span>497<span style="font-family: '微软雅黑',sans-serif;">为内置错误码,当访问</span>http<span style="font-family: '微软雅黑',sans-serif;">无法处理,需要利用</span>https<span style="font-family: '微软雅黑',sans-serif;">处理时</span>
</p>

<h3>
  <span id="164_nginxhttphttps">1.6.4 <span style="font-family: '微软雅黑',sans-serif;">利用</span>nginx<span style="font-family: '微软雅黑',sans-serif;">反向代理服务器进行</span>http<span style="font-family: '微软雅黑',sans-serif;">到</span>https<span style="font-family: '微软雅黑',sans-serif;">跳转</span></span>
</h3>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">第一个里程碑:修改地址池信息</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">    upstream www_server_pools {
            server </span>10.0.0.8:443<span style="color: #000000;">;
}</span></pre>
</div>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">第二个里程碑:修改地址池调用信息</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">    server {
    listen </span>443<span style="color: #000000;">;
    server_name blog.nmtui.com;
    ssl on;
    ssl_certificate </span>/application/nginx/conf/key/<span style="color: #000000;">1_blog.nmtui.com_bundle.crt;
    ssl_certificate_key </span>/application/nginx/conf/key/<span style="color: #000000;">2_blog.nmtui.com.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.</span>1 TLSv1.2<span style="color: #000000;">;
    ssl_ciphers ECDHE</span>-RSA-AES128-GCM-<span style="color: #000000;">SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    location </span>/<span style="color: #000000;"> {
        proxy_pass https:</span>//<span style="color: #000000;">server_pools;
    }
}</span></pre>
</div>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">第三个里程碑:定义</span>http<span style="font-family: '微软雅黑',sans-serif;">到</span>https<span style="font-family: '微软雅黑',sans-serif;">跳转配置信息</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">    server {
    listen       </span>80<span style="color: #000000;">;
    server_name  blog.nmtui.com;
    rewrite </span>^(.*)$  https://$host$1<span style="color: #000000;"> permanent;
}</span></pre>
</div>

<h2>
  <span id="17_-_ngx_http_ssl_module">1.7 <span style="font-family: '微软雅黑',sans-serif;">附录</span> - ngx_http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">模块说明</span></span>
</h2>

<p style="text-indent: 21.0pt;">
  ngx_http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">模块为实现</span> HTTPS<span style="font-family: '微软雅黑',sans-serif;">提供了必要的支持。</span>
</p>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">此模块不是在默认情况下生成的</span>, <span style="font-family: '微软雅黑',sans-serif;">在安装</span>nginx<span style="font-family: '微软雅黑',sans-serif;">时使用</span>--with-http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">配置参数启用它。此模块需要</span><span style="text-decoration: underline;">OpenSSL</span><span style="font-family: '微软雅黑',sans-serif;">库。详情参照:</span><a href="/wp-content/themes/clsn-003/inc/go.php?url=http://www.cnblogs.com/clsn/p/8025324.html#_label3" >http://www.cnblogs.com/clsn/p/8025324.html#_label3</a>
</p>

<h3>
  <span id="171">1.7.1 <span style="font-family: '微软雅黑',sans-serif;">示例配置</span></span>
</h3>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">为了减轻处理器负载,建议</span>
</p>

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><span style="font-family: '微软雅黑',sans-serif;">设置工作进程的数量等于处理器的数量;</span>
</p>

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><span style="font-family: '微软雅黑',sans-serif;">启用保持连接;</span>
</p>

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><span style="font-family: '微软雅黑',sans-serif;">启用共享会话缓存;</span>
</p>

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><span style="font-family: '微软雅黑',sans-serif;">禁用内置的会话缓存;</span>
</p>

<p style="margin-left: 42.0pt; text-indent: -21.0pt;">
  <span style="font-family: Wingdings;">&uuml;&nbsp;</span><span style="font-family: '微软雅黑',sans-serif;">建议增加会话超时时间</span> <span style="font-family: '微软雅黑',sans-serif;">(默认为</span>5<span style="font-family: '微软雅黑',sans-serif;">分钟)。</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">worker_processes auto;

http {

...

server {
    listen              </span>443<span style="color: #000000;"> ssl;
    keepalive_timeout   </span>70<span style="color: #000000;">;

    ssl_protocols       TLSv1 TLSv1.</span>1 TLSv1.2<span style="color: #000000;">;
    ssl_ciphers         AES128</span>-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-<span style="color: #000000;">MD5;
    ssl_certificate     </span>/usr/local/nginx/conf/<span style="color: #000000;">cert.pem;
    ssl_certificate_key </span>/usr/local/nginx/conf/<span style="color: #000000;">cert.key;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    ...
}</span><span style="text-indent: -21pt;">&nbsp;</span></pre>
</div>

<h3>
  <span id="172_SSL">1.7.2 SSL<span style="font-family: '微软雅黑',sans-serif;">模块指令说明</span></span>
</h3>

<h4>
  <span id="1721nbspssl"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.1&nbsp;</span></strong><strong><span style="background: yellow;">ssl</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl on |<span style="color: #000000;"> off;

Default: ssl off; Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">为指定的虚拟服务器启用</span>HTTPS<span style="font-family: '微软雅黑',sans-serif;">协议,默认关闭。</span>
</p>

<h4>
  <span id="1722nbspssl_buffer_size"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.2&nbsp;</span></strong><strong><span style="background: yellow;">ssl_buffer_size</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_buffer_size size;

Default: ssl_buffer_size 16k; Context: http, server # This directive appeared in version 1.5.9.

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">该指令用于设置用于发送数据的缓冲区的大小。</span>
</p>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">默认情况下,缓冲区大小为</span>16k<span style="font-family: '微软雅黑',sans-serif;">,这对应于发送大响应时的最小开销。为了将发送第一个字节的时间减少,可以使用较小的值,例如:</span>
</p>

<div class="cnblogs_code">
  <pre>ssl_buffer_size 4k;<span style="text-indent: 21pt;">&nbsp;</span></pre>
</div>

<h4>
  <span id="1723nbspssl_certificate"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.3&nbsp;</span></strong><strong><span style="background: yellow;">ssl_certificate</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_certificate file;

Default: — Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定虚拟主机的</span> PEM <span style="font-family: '微软雅黑',sans-serif;">格式的<strong><span style="text-decoration: underline;"><span style="color: red;">证书文件</span></span></strong>路径</span> <span style="font-family: '微软雅黑',sans-serif;">。如果除了主证书外</span>,<span style="font-family: '微软雅黑',sans-serif;">还要指定中间证书</span>, <span style="font-family: '微软雅黑',sans-serif;">则应按以下顺序在同一文件中指定它们</span>: <span style="font-family: '微软雅黑',sans-serif;">主证书首先出现</span>, <span style="font-family: '微软雅黑',sans-serif;">然后是中间证书。</span>PEM <span style="font-family: '微软雅黑',sans-serif;">格式的密钥可以放在同一个文件中。</span>
</p>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">从</span>1.11.0<span style="font-family: '微软雅黑',sans-serif;">版本开始,可以多次使用该指令来加载不同类型的证书,例如</span>RSA<span style="font-family: '微软雅黑',sans-serif;">和</span>ECDSA<span style="font-family: '微软雅黑',sans-serif;">:</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">server {
listen              </span>443<span style="color: #000000;"> ssl;
server_name         example.com;

ssl_certificate     example.com.rsa.crt;
ssl_certificate_key example.com.rsa.key;

ssl_certificate     example.com.ecdsa.crt;
ssl_certificate_key example.com.ecdsa.key;

...

}

<p>
  &nbsp;&nbsp; <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">注意:</span></strong><span style="font-family: '微软雅黑',sans-serif;">只有</span><span style="text-decoration: underline;">OpenSSL 1.0.2</span><span style="font-family: '微软雅黑',sans-serif;">及以上版本,支持加载不同类型的证书。对于较旧的版本,只能使用同一类型的单个证书。</span>
</p>

<p>
  &nbsp;&nbsp; <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">注意:使用</span><span style="color: red;">nginx</span></strong><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">配置</span><span style="color: red;">HTTPS</span></strong><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">多虚拟主机时,不同的主机要监听不同的地址,否则在初次访问时,</span><span style="color: red;">SSL</span></strong><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">连接在浏览器发送</span><span style="color: red;">HTTPs</span></strong><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">请求之前建立,而</span><span style="color: red;">nginx</span></strong><strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">不知道请求的服务器的名称。因此,它只能提供默认的服务器证书。将会导致业务的异常。详情参照:</span></strong><a href="/wp-content/themes/clsn-003/inc/go.php?url=http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers" >http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers</a>
</p>

<h4>
  <span id="1724nbspssl_certificate_key"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.4&nbsp;</span></strong><strong><span style="background: yellow;">ssl_certificate_key</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_certificate_key file;

Default: — Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定虚拟主机的</span> PEM <span style="font-family: '微软雅黑',sans-serif;">格式的<strong><span style="text-decoration: underline;"><span style="color: red;">密钥文件</span></span></strong>存放路径</span>&nbsp;<span style="font-family: '微软雅黑',sans-serif;">。</span>
</p>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">在</span>1.7.9<span style="font-family: '微软雅黑',sans-serif;">版本</span><em>engine:name:id </em><span style="font-family: '微软雅黑',sans-serif;">可以指定替代密钥文件,该指令能够从</span>OpenSSL<span style="font-family: '微软雅黑',sans-serif;">中加载指定</span>ID<span style="font-family: '微软雅黑',sans-serif;">的密钥</span> <em>name</em><span style="font-family: '微软雅黑',sans-serif;">。</span>
</p>

<h4>
  <span id="1725nbspssl_ciphers"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.5&nbsp;</span></strong><strong><span style="background: yellow;">ssl_ciphers</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_ciphers ciphers;

Default: ssl_ciphers HIGH:!aNULL:!MD5; Context: http, server

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">指定证书的加密方式。加密方式要是</span>openssl<span style="font-family: '微软雅黑',sans-serif;">可以识别的方式,例如:</span>
</p>

<div class="cnblogs_code">
  <pre>ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;</pre>
</div>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">所有的加密方式可以在系统中通过</span>openssl ciphers<span style="font-family: '微软雅黑',sans-serif;">命令查看。</span>
</p>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">选用加密方式时要注意不同版本之间的兼容性问题,详情参考</span><a href="/wp-content/themes/clsn-003/inc/go.php?url=http://nginx.org/en/docs/http/configuring_https_servers.html#compatibility" >http://nginx.org/en/docs/http/configuring_https_servers.html#compatibility</a>
</p>

<h4>
  <span id="1726nbspssl_client_certificate"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.6&nbsp;</span></strong><strong><span style="background: yellow;">ssl_client_certificate</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_client_certificate file;

Default: — Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">如果启用了</span>ssl_stapling<span style="font-family: '微软雅黑',sans-serif;">,则需要指定</span>PEM<span style="font-family: '微软雅黑',sans-serif;">格式的可信</span>CA<span style="font-family: '微软雅黑',sans-serif;">证书文件路径,用于验证客户端证书和</span>OCSP(Online Certificate Status Protocol<span style="font-family: '微软雅黑',sans-serif;">,在线证书状态协议</span>)<span style="font-family: '微软雅黑',sans-serif;">响应。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">注意</span>:<span style="font-family: '微软雅黑',sans-serif;">使用该参数时证书列表将被发送给客户。如果不需要,可以使用</span>ssl_trusted_certificate <span style="font-family: '微软雅黑',sans-serif;">指令。</span>
</p>

<h4>
  <span id="1727nbspssl_crl"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.7&nbsp;</span></strong><strong><span style="background: yellow;">ssl_crl</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_crl file;

Default: — Context: http, server # This directive appeared in version 0.8.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定用于验证客户端证书的</span> PEM <span style="font-family: '微软雅黑',sans-serif;">格式指定具有吊销证书</span> (CRL) <span style="font-family: '微软雅黑',sans-serif;">的文件</span> <span style="font-family: '微软雅黑',sans-serif;">。</span>
</p>

<h4>
  <span id="1728nbspssl_dhparam"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.8&nbsp;</span></strong><strong><span style="background: yellow;">ssl_dhparam</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_dhparam file;

Default: — Context: http, server # This directive appeared in version 0.7.2.

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">指定</span>DHE<span style="font-family: '微软雅黑',sans-serif;">加密方式的</span>DH<span style="font-family: '微软雅黑',sans-serif;">证书文件位置。</span>
</p>

<h4>
  <span id="1729nbspssl_ecdh_curve"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.9&nbsp;</span></strong><strong><span style="background: yellow;">ssl_ecdh_curve</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_ecdh_curve curve;

Default:
ssl_ecdh_curve auto; Context: http, server # This directive appeared in versions 1.1.0 and 1.0.6.

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定一个</span>curve<span style="font-family: '微软雅黑',sans-serif;">用于</span>ECDHE<span style="font-family: '微软雅黑',sans-serif;">密码。</span>
</p>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">当使用的</span>OpenSSL 1.0.2<span style="font-family: '微软雅黑',sans-serif;">或更高版本时,可以指定多</span>curve<span style="font-family: '微软雅黑',sans-serif;">(</span>1.11.0<span style="font-family: '微软雅黑',sans-serif;">),例如:</span>
</p>

<div class="cnblogs_code">
  <pre>ssl_ecdh_curve prime256v1:secp384r1;</pre>
</div>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">特殊值</span>auto<span style="font-family: '微软雅黑',sans-serif;">(</span>1.11.0<span style="font-family: '微软雅黑',sans-serif;">)指示</span>nginx<span style="font-family: '微软雅黑',sans-serif;">在使用</span>OpenSSL 1.0.2<span style="font-family: '微软雅黑',sans-serif;">或更高版本时使用</span>OpenSSL<span style="font-family: '微软雅黑',sans-serif;">库中内置的列表为</span>prime256v1<span style="font-family: '微软雅黑',sans-serif;">,或使用旧版本。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">在版本</span>1.11.0 <span style="font-family: '微软雅黑',sans-serif;">之前</span>, <span style="font-family: '微软雅黑',sans-serif;">默认</span>curve<span style="font-family: '微软雅黑',sans-serif;">为</span>prime256v1<span style="font-family: '微软雅黑',sans-serif;">。</span>
</p>

<h4>
  <span id="17210nbspnbspnbspnbsp_ssl_password_file"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.10<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_password_file</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_password_file file;

Default: — Context: http, server # This directive appeared in version 1.7.3.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">为密钥指定一个<span style="text-decoration: underline;">密码文件</span></span> , <span style="font-family: '微软雅黑',sans-serif;">其中每个口令都在单独的行上指定密码。密码在加载密钥时依次尝试。</span>
</p>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">示例:</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">http {
ssl_password_file </span>/etc/keys/<span style="color: #0000ff;">global</span>.<span style="color: #0000ff;">pass</span><span style="color: #000000;">;
...

server {
    server_name www1.example.com;
    ssl_certificate_key </span>/etc/keys/<span style="color: #000000;">first.key;
}

server {
    server_name www2.example.com;

    </span><span style="color: #008000;">#</span><span style="color: #008000;"> named pipe can also be used instead of a file</span>
    ssl_password_file /etc/keys/<span style="color: #000000;">fifo;
    ssl_certificate_key </span>/etc/keys/<span style="color: #000000;">second.key;
}

}

<h4>
  <span id="17211nbspnbspnbspnbsp_ssl_prefer_server_ciphers"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.11<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_prefer_server_ciphers</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_prefer_server_ciphers on |<span style="color: #000000;"> off;

Default: ssl_prefer_server_ciphers off; Context: http, server

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定在使用</span> SSLv3 <span style="font-family: '微软雅黑',sans-serif;">和</span> TLS <span style="font-family: '微软雅黑',sans-serif;">协议时</span>, <span style="font-family: '微软雅黑',sans-serif;">服务器密码应优先于客户端密码。</span>
</p>

<h4>
  <span id="17212nbspnbspnbspnbsp_ssl_protocols"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.12<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_protocols</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_protocols [SSLv2] [SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2] [TLSv1.3<span style="color: #000000;">];

Default: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">启用指定的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">协议。</span>
</p>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">说明:</span>
</p>

<div class="cnblogs_code">
  <pre>TLSv1.1和 TLSv1.2参数 (1.1.13、1.0.12) 仅在使用 OpenSSL 1.0.1<span style="color: #000000;"> 或更高时才起作用。

TLSv1.3参数 (1.13.0) 仅在使用用 TLSv1.3 仅在使用 OpenSSL 1.1.1 时有效。

<h4>
  <span id="17213nbspnbspnbspnbsp_ssl_session_cache"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.13<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_session_cache</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_session_cache off | none |<span style="color: #000000;"> [builtin[:size]] [shared:name:size];

Default: ssl_session_cache none; Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">设置存储会话参数的高速缓存的类型和大小。缓存可以是以下任何一种类型:</span>
</p>

<table style="width: 100%; border-collapse: collapse; border-width: initial; border-style: none; border-color: initial;" border="1" cellspacing="0" cellpadding="0">
  <tr>
    <td style="width: 24.36%; border-top: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: 1pt solid #9bbb59; border-right: none; background: #9bbb59; padding: 0cm 5.4pt;" width="24%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">类型</span></strong>
      </p>
    </td>
    
    <td style="width: 75.64%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="75%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">类型说明</span></strong>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 24.36%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="24%">
      <p style="text-align: center;" align="center">
        <strong>off</strong>
      </p>
    </td>
    
    <td style="width: 75.64%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="75%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">严格禁止使用会话缓存</span>: nginx <span style="font-family: '微软雅黑',sans-serif;">会明确告诉客户端会话可能无法重用。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 24.36%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="24%">
      <p style="text-align: center;" align="center">
        <strong>none</strong>
      </p>
    </td>
    
    <td style="width: 75.64%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="75%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">不允许使用会话缓存</span>: nginx <span style="font-family: '微软雅黑',sans-serif;">告诉客户端会话可以重用</span>, <span style="font-family: '微软雅黑',sans-serif;">但实际上不会将会话参数存储在缓存中。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 24.36%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="24%">
      <p style="text-align: center;" align="center">
        <strong>builtin</strong>
      </p>
    </td>
    
    <td style="width: 75.64%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="75%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">建立</span> OpenSSL <span style="font-family: '微软雅黑',sans-serif;">的缓存:仅由一个工作进程使用。缓存大小在会话中指定。如果未给定大小</span>, <span style="font-family: '微软雅黑',sans-serif;">则默认为</span>20480<span style="font-family: '微软雅黑',sans-serif;">个会话。</span>
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">注意:使用内置缓存会导致产生内存碎片。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 24.36%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="24%">
      <p style="text-align: center;" align="center">
        <strong>shared</strong>
      </p>
    </td>
    
    <td style="width: 75.64%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="75%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">所有工作进程之间共享的缓存:缓存大小以字节为单位指定,一兆字节可以存储大约</span>4000<span style="font-family: '微软雅黑',sans-serif;">个会话。每个共享缓存都应具有名称。可以在多个虚拟服务器中使用同名的缓存。</span>
      </p>
    </td>
  </tr>
</table>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">两种不同的缓存类型都可以同时使用</span>, <span style="font-family: '微软雅黑',sans-serif;">例如</span>:
</p>

<div class="cnblogs_code">
  <pre>ssl_session_cache builtin:1000 shared:SSL:10m;</pre>
</div>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">但是</span>, <span style="font-family: '微软雅黑',sans-serif;">在没有内置缓存的情况下使用共享缓存才会更有效。</span>
</p>

<h4>
  <span id="17214nbspnbspnbspnbsp_ssl_session_ticket_key"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.14<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_session_ticket_key</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_session_ticket_key file;

Default: — Context: http, server # This directive appeared in version 1.5.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定用于加密和解密</span>TLS<span style="font-family: '微软雅黑',sans-serif;">会话令牌的密钥文件存放位置。如果需要在多个服务器之间共享相同的密钥</span>,<span style="font-family: '微软雅黑',sans-serif;">则需要使用该指令。默认情况下</span>, <span style="font-family: '微软雅黑',sans-serif;">使用随机生成的密钥。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">如果指定了多个密钥</span>, <span style="font-family: '微软雅黑',sans-serif;">则仅使用第一个密钥对</span> TLS <span style="font-family: '微软雅黑',sans-serif;">会话进行加密。密钥对时可以进行轮换的,例如:</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">ssl_session_ticket_key current.key;

ssl_session_ticket_key previous.key;

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">该文件必须包含</span>80<span style="font-family: '微软雅黑',sans-serif;">或</span>48<span style="font-family: '微软雅黑',sans-serif;">字节的随机数</span>, <span style="font-family: '微软雅黑',sans-serif;">可以使用以下命令进行创建:</span>
</p>

<div class="cnblogs_code">
  <pre>openssl rand 80 > ticket.key</pre>
</div>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">根据文件大小的不同</span>, AES256 (<span style="font-family: '微软雅黑',sans-serif;">对于</span>80<span style="font-size: 13.5pt; font-family: 微软雅黑, sans-serif; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">字节密钥</span><span style="font-family: '微软雅黑',sans-serif;">、</span>1.11.8) <span style="font-family: '微软雅黑',sans-serif;">或</span> AES128 (<span style="font-family: '微软雅黑',sans-serif;">对于</span>48<span style="font-size: 13.5pt; font-family: 微软雅黑, sans-serif; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">字节密钥</span>) <span style="font-family: '微软雅黑',sans-serif;">用于加密。</span>
</p>

<h4>
  <span id="17215nbspnbspnbspnbsp_ssl_session_tickets"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.15<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_session_tickets</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_session_tickets on |<span style="color: #000000;"> off;

Default: ssl_session_tickets on; Context: http, server # This directive appeared in version 1.5.9.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">通过</span>TLS session tickets<span style="font-family: '微软雅黑',sans-serif;">启用或禁用会话恢复</span> <span style="font-family: '微软雅黑',sans-serif;">。详情参考:</span><a href="https://tools.ietf.org/html/rfc5077">https://tools.ietf.org/html/rfc5077</a>
</p>

<h4>
  <span id="17216nbspnbspnbspnbsp_ssl_session_timeout"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.16<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_session_timeout</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_session_timeout time;

Default: ssl_session_timeout 5m; Context: http, server

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">指定客户端可以重用会话参数的时间。</span>
</p>

<h4>
  <span id="17217nbspnbspnbspnbsp_ssl_stapling"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.17<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_stapling</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_stapling on |<span style="color: #000000;"> off;

Default: ssl_stapling off; Context: http, server # This directive appeared in version 1.3.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">启用或禁用服务器对</span>OSCP<span style="font-family: '微软雅黑',sans-serif;">的响应,详情参考:</span><a href="https://tools.ietf.org/html/rfc4366#section-3.6">https://tools.ietf.org/html/rfc4366#section-3.6</a>
</p>

<p>
  <span style="font-family: '微软雅黑',sans-serif;">配置示例:</span>
</p>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">ssl_stapling on;

resolver 192.0.2.1;

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">要使</span> OCSP <span style="font-family: '微软雅黑',sans-serif;">正常工作</span>, <span style="font-family: '微软雅黑',sans-serif;">需要知道服务器证书颁发者的证书</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">如果</span>ssl_certificate<span style="font-family: '微软雅黑',sans-serif;">文件不包含中间证书</span>, <span style="font-family: '微软雅黑',sans-serif;">则应在</span>ssl_trusted_certificate<span style="font-family: '微软雅黑',sans-serif;">文件中显示服务器证书颁发者的证书。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">对于</span> OCSP <span style="font-family: '微软雅黑',sans-serif;">响应方主机名的解析</span>, <span style="font-family: '微软雅黑',sans-serif;">还应指定解析程序指令。</span>
</p>

<h4>
  <span id="17218nbspnbspnbspnbsp_ssl_stapling_file"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.18<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_stapling_file</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_stapling_file file;

Default: — Context: http, server # This directive appeared in version 1.3.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">设置后,将从指定的</span>file<span style="font-family: '微软雅黑',sans-serif;">中采取订阅的</span> ocsp <span style="font-family: '微软雅黑',sans-serif;">响应</span>, <span style="font-family: '微软雅黑',sans-serif;">而不是查询在服务器证书中指定的</span> ocsp <span style="font-family: '微软雅黑',sans-serif;">应答器。</span>
</p>

<div class="cnblogs_code">
  <pre>该文件应该是由&ldquo; openssl ocsp&rdquo;命令产生的DER格式。</pre>
</div>

<h4>
  <span id="17219nbspnbspnbspnbsp_ssl_stapling_responder"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.19<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_stapling_responder</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_stapling_responder url;

Default: — Context: http, server # This directive appeared in version 1.3.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">重写在</span> "<span style="font-family: '微软雅黑',sans-serif;">颁发机构信息访问</span>" <span style="font-family: '微软雅黑',sans-serif;">证书扩展中指定的</span> OCSP <span style="font-family: '微软雅黑',sans-serif;">响应程序的</span> URL<span style="font-family: '微软雅黑',sans-serif;">。</span>
</p>

<p>
  &nbsp;&nbsp; <span style="font-family: '微软雅黑',sans-serif;">参考文献:</span><a href="https://tools.ietf.org/html/rfc5280#section-4.2.2.1">https://tools.ietf.org/html/rfc5280#section-4.2.2.1</a>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">仅支持</span> "http://" OCSP <span style="font-family: '微软雅黑',sans-serif;">响应程序,例如</span>:
</p>

<div class="cnblogs_code">
  <pre>ssl_stapling_responder http://ocsp.example.com/;</pre>
</div>

<h4>
  <span id="17220nbspnbspnbspnbsp_ssl_stapling_verify"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.20<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_stapling_verify</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_stapling_verify on |<span style="color: #000000;"> off;

Default: ssl_stapling_verify off; Context: http, server # This directive appeared in version 1.3.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">启用或禁用服务器对</span> OCSP <span style="font-family: '微软雅黑',sans-serif;">响应的验证。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">要进行验证</span>, <span style="font-family: '微软雅黑',sans-serif;">应使用</span>ssl_trusted_certificate<span style="font-family: '微软雅黑',sans-serif;">指令将服务器证书颁发者、根证书和所有中间证书的证书配置为受信任。</span>
</p>

<h4>
  <span id="17221nbspnbspnbspnbsp_ssl_trusted_certificate"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.21<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_trusted_certificate</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_trusted_certificate file;

Default: — Context: http, server # This directive appeared in version 1.3.7.

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">指定一个</span> PEM <span style="font-family: '微软雅黑',sans-serif;">格式的文件</span> , <span style="font-family: '微软雅黑',sans-serif;">其中带有用于验证</span> <span style="text-decoration: underline;">ssl_stapling</span><span style="font-family: '微软雅黑',sans-serif;">启用时使用的校验证书和</span> OCSP <span style="font-family: '微软雅黑',sans-serif;">进行验证。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">与</span><span style="text-decoration: underline;">ssl_client_certificate</span><span style="font-family: '微软雅黑',sans-serif;">设置的证书正好相反</span>, <span style="font-family: '微软雅黑',sans-serif;">这些证书的列表将不会发送到客户端。</span>
</p>

<h4>
  <span id="17222nbspnbspnbspnbsp_ssl_verify_client"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.22<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_verify_client</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre>Syntax:    ssl_verify_client on | off | optional |<span style="color: #000000;"> optional_no_ca;

Default: ssl_verify_client off; Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">启用对客户端证书的验证。验证结果存储在</span> <em>$ssl_client_verify</em><span style="font-family: '微软雅黑',sans-serif;">变量中。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">可选参数</span><span style="text-decoration: underline;">optional</span><span style="text-decoration: underline;"><span style="font-family: '微软雅黑',sans-serif;">(</span>0.8.7+</span><span style="text-decoration: underline;"><span style="font-family: '微软雅黑',sans-serif;">)</span></span><span style="font-family: '微软雅黑',sans-serif;">请求客户端证书、验证证书是否存在。</span>
</p>

<p style="text-indent: 15.75pt;">
  <span style="font-family: '微软雅黑',sans-serif;">可选参数</span><span style="text-decoration: underline;">optional_no_ca (1.3.8, 1.2.5)</span><span style="font-family: '微软雅黑',sans-serif;">请求客户端证书而不需要将签署由受信任的</span>CA<span style="font-family: '微软雅黑',sans-serif;">证书。这适用于</span>nginx<span style="font-family: '微软雅黑',sans-serif;">外部的服务运行实际证书验证的情况。证书的内容可以通过变量</span><em>$ssl_client_cert</em><em><span style="font-family: '微软雅黑',sans-serif;">进行</span></em><span style="font-family: '微软雅黑',sans-serif;">访问</span> <span style="font-family: '微软雅黑',sans-serif;">。</span>
</p>

<h4>
  <span id="17223nbspnbspnbspnbsp_ssl_verify_depth"><strong><span style="courier new"4courier new"; background: yellow;">1.7.2.23<span style="font-variant-numeric: normal; font-variant-east-asian: normal; font-weight: normal; font-stretch: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">&nbsp;&nbsp;&nbsp;&nbsp; </span></span></strong><strong><span style="background: yellow;">ssl_verify_depth</span></strong></span>
</h4>

<div class="cnblogs_code">
  <pre><span style="color: #000000;">Syntax:    ssl_verify_depth number;

Default: ssl_verify_depth 1; Context: http, server

<p style="text-indent: 15.75pt;">
  <span style="font-size: 13.5pt; font-family: 微软雅黑, sans-serif; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">设置客户端证书的验证深度。</span>
</p>

<h3>
  <span id="173_ngx_http_ssl_module">1.7.3 ngx_http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">模块中常见错误处理</span></span>
</h3>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">在</span>ngx_http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">模块支持几种非标准错误代码</span>, <span style="font-family: '微软雅黑',sans-serif;">可用于使用</span>error_page<span style="font-family: '微软雅黑',sans-serif;">指令进行重定向。</span>
</p>

<table style="width: 100%; border-collapse: collapse; border-width: initial; border-style: none; border-color: initial;" border="1" cellspacing="0" cellpadding="0">
  <tr>
    <td style="width: 14.88%; border-top: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: 1pt solid #9bbb59; border-right: none; background: #9bbb59; padding: 0cm 5.4pt;" width="14%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">错误代码</span></strong>
      </p>
    </td>
    
    <td style="width: 85.12%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="85%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">产生原因</span></strong>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 14.88%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="14%">
      <p style="text-align: center;" align="center">
        <strong>495</strong>
      </p>
    </td>
    
    <td style="width: 85.12%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="85%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        an error has occurred during the client certificate verification;
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">在客户端证书验证过程中发生错误</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 14.88%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="14%">
      <p style="text-align: center;" align="center">
        <strong>496</strong>
      </p>
    </td>
    
    <td style="width: 85.12%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="85%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        a client has not presented the required certificate;
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">客户未出示所需证书</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 14.88%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="14%">
      <p style="text-align: center;" align="center">
        <strong>497</strong>
      </p>
    </td>
    
    <td style="width: 85.12%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="85%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        a regular request has been sent to the HTTPS port.
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">常规请求已发送到</span>HTTPS<span style="font-family: '微软雅黑',sans-serif;">端口。</span>
      </p>
    </td>
  </tr>
</table>

<p style="text-indent: 21.0pt;">
  <span style="font-family: '微软雅黑',sans-serif;">在对请求进行了完全分析并且变量</span> (<span style="font-family: '微软雅黑',sans-serif;">如</span>$request_uri<span style="font-family: '微软雅黑',sans-serif;">、</span> $uri<span style="font-family: '微软雅黑',sans-serif;">、</span> $args<span style="font-family: '微软雅黑',sans-serif;">和其他项</span>) <span style="font-family: '微软雅黑',sans-serif;">可用之后</span>, <span style="font-family: '微软雅黑',sans-serif;">重定向发生。</span>
</p>

<h3>
  <span id="174_ngx_http_ssl_module">1.7.4 ngx_http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">模块中嵌入变量</span></span>
</h3>

<p style="text-indent: 7.1pt;">
  ngx_http_ssl_module<span style="font-family: '微软雅黑',sans-serif;">模块支持多个嵌入变量:</span>
</p>

<table style="width: 100%; border-collapse: collapse; border-width: initial; border-style: none; border-color: initial;" border="1" cellspacing="0" cellpadding="0">
  <tr>
    <td style="width: 35.12%; border-top: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: 1pt solid #9bbb59; border-right: none; background: #9bbb59; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">变量</span></strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="64%">
      <p style="text-align: center;" align="center">
        <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">变量说明</span></strong>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_cipher</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回用于已建立的</span> SSL <span style="font-family: '微软雅黑',sans-serif;">连接的密码字符串</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_ciphers</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回客户端支持的密码列表(</span>1.11.7<span style="font-family: '微软雅黑',sans-serif;">)。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_escaped_cert</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">以</span> PEM <span style="font-family: '微软雅黑',sans-serif;">格式</span> (urlencoded) <span style="font-family: '微软雅黑',sans-serif;">返回已建立的</span> SSL <span style="font-family: '微软雅黑',sans-serif;">连接</span> (1.13.5) <span style="font-family: '微软雅黑',sans-serif;">的客户端证书。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_cert</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">以建立的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">连接的</span>PEM<span style="font-family: '微软雅黑',sans-serif;">格式返回客户端证书,除第一行之外的每一行都加上制表符</span>; <span style="font-family: '微软雅黑',sans-serif;">这是为了在</span> proxy_set_header<span style="font-family: '微软雅黑',sans-serif;">指令中使用</span>;
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">该变量已被弃用,</span><span style="color: red;">$ssl_client_escaped_cert</span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">应该使用该变量。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_fingerprint</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">为建立的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">连接(</span>1.7.1<span style="font-family: '微软雅黑',sans-serif;">)返回客户端证书的</span>SHA1<span style="font-family: '微软雅黑',sans-serif;">指纹</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_i_dn</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">根据</span>RFC 2253 (1.11.6) <span style="font-family: '微软雅黑',sans-serif;">返回已建立的</span> SSL <span style="font-family: '微软雅黑',sans-serif;">连接的客户端证书的</span> "<span style="font-family: '微软雅黑',sans-serif;">颁发者</span> DN" <span style="font-family: '微软雅黑',sans-serif;">字符串</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_i_dn_legacy</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回已建立的</span> SSL <span style="font-family: '微软雅黑',sans-serif;">连接的客户端证书的</span> "<span style="font-family: '微软雅黑',sans-serif;">颁发者</span> DN" <span style="font-family: '微软雅黑',sans-serif;">字符串</span>;
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">在版本</span><span style="color: red;">1.11.6 </span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">之前</span><span style="color: red;">, </span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">变量名为</span><span style="color: red;">$ssl_client_i_dn.</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_raw_cert</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">以</span> PEM <span style="font-family: '微软雅黑',sans-serif;">格式返回已建立的</span> SSL <span style="font-family: '微软雅黑',sans-serif;">连接的客户端证书</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_s_dn</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">根据</span>RFC 2253<span style="font-family: '微软雅黑',sans-serif;">(</span>1.11.6<span style="font-family: '微软雅黑',sans-serif;">),为建立的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">连接返回客户端证书的&ldquo;主题</span>DN<span style="font-family: '微软雅黑',sans-serif;">&rdquo;字符串</span> ;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_s_dn_legacy</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">为建立的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">连接返回客户端证书的&ldquo;主题</span>DN<span style="font-family: '微软雅黑',sans-serif;">&rdquo;字符串</span>;
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">在版本</span><span style="color: red;">1.11.6</span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">之前,变量名是</span><span style="color: red;">$ssl_client_s_dn</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_serial</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">为建立的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">连接返回客户端证书的序列号</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_v_end</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回客户端证书的结束日期(</span>1.11.7<span style="font-family: '微软雅黑',sans-serif;">)</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_v_remain</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回客户端证书过期的天数(</span>1.11.7<span style="font-family: '微软雅黑',sans-serif;">)</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_v_start</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回客户端证书的开始日期(</span>1.11.7<span style="font-family: '微软雅黑',sans-serif;">)</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_client_verify</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">如果证书不存在,则</span> <span style="font-family: '微软雅黑',sans-serif;">返回客户端证书验证的结果:&ldquo;</span> SUCCESS<span style="font-family: '微软雅黑',sans-serif;">&rdquo;,&ldquo;</span> FAILED:reason<span style="font-family: '微软雅黑',sans-serif;">&rdquo;和&ldquo;</span> NONE<span style="font-family: '微软雅黑',sans-serif;">&rdquo;</span>;
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">在版本</span><span style="color: red;">1.11.7</span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">之前,&ldquo;</span><span style="color: red;"> FAILED</span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: red;">&rdquo;结果不包含</span><span style="color: red;">reason</span><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new"; color: red;">字符串。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_curves</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回由客户端</span> (1.11.7) <span style="font-family: '微软雅黑',sans-serif;">支持的</span><span style="font-size: 13.5pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">curves</span>
      </p>
      
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">仅当使用</span> OpenSSL <span style="font-family: '微软雅黑',sans-serif;">版本</span>1.0.2 <span style="font-family: '微软雅黑',sans-serif;">或更高时</span>, <span style="font-family: '微软雅黑',sans-serif;">才支持该变量。</span>
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_protocol</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回已建立的</span> SSL <span style="font-family: '微软雅黑',sans-serif;">连接的协议</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_server_name</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">通过</span>SNI <span style="font-family: '微软雅黑',sans-serif;">(</span>1.7.0<span style="font-family: '微软雅黑',sans-serif;">)返回请求的服务器名称</span> ;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; background: #eaf1dd; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_session_id</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">返回建立的</span>SSL<span style="font-family: '微软雅黑',sans-serif;">连接的会话标识符</span>;
      </p>
    </td>
  </tr>
  
  <tr>
    <td style="width: 35.12%; border-right: 1pt solid #c2d69b; border-bottom: 1pt solid #c2d69b; border-left: 1pt solid #c2d69b; border-top: none; padding: 0cm 5.4pt;" width="35%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <strong>$ssl_session_reused</strong>
      </p>
    </td>
    
    <td style="width: 64.88%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="64%">
      <p style="text-align: justify; text-justify: inter-ideograph;">
        <span style="font-family: '微软雅黑',sans-serif;">如果重新使用了</span> SSL <span style="font-family: '微软雅黑',sans-serif;">会话</span>, <span style="font-family: '微软雅黑',sans-serif;">则返回</span> "r", <span style="font-family: '微软雅黑',sans-serif;">否则为</span> "." (1.5.11)<span style="font-family: '微软雅黑',sans-serif;">。</span>
      </p>
    </td>
  </tr>
</table>

<h2>
  <span id="18">1.8 <span style="font-family: '微软雅黑',sans-serif;">参考文献</span></span>
</h2>

<blockquote>
  <p>
    <span style="background-color: initial;">[1]&nbsp;</span><a style="background-color: initial;" href="https://cloud.tencent.com/document/product/400/4143">https://cloud.tencent.com/document/product/400/4143</a>
  </p>
  
  <p>
    [2]&nbsp;<a href="https://www.openssl.org/">https://www.openssl.org</a>
  </p>
  
  <p>
    [3]&nbsp;<a href="/wp-content/themes/clsn-003/inc/go.php?url=http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers" >http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers</a>
  </p>
  
  <p>
    [4]&nbsp;<a href="https://baike.baidu.com/item/openssl/5454803?fr=aladdin">https://baike.baidu.com/item/openssl/5454803?fr=aladdin</a>
  </p>
  
  <p>
    [5]&nbsp;<a href="/wp-content/themes/clsn-003/inc/go.php?url=http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers" >http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers</a>
  </p>
</blockquote>

<p>
  &nbsp;
</p>

<div id="toc_container" class="toc_white have_bullets">
  <ul class="toc_list">
    <li>
      <a href="#11">1.1 网络安全知识</a><ul>
        <li>
          <a href="#111">1.1.1 网结安全出现背景</a>
        </li>
        <li>
          <a href="#112">1.1.2 网络安全涉及问题</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#12">1.2 网络安全问题的解决</a><ul>
        <li>
          <a href="#121">1.2.1 网络安全解决问题--如何保证数据的机密性</a>
        </li>
        <li>
          <a href="#122">1.2.2 网络安全解决问题-如何保证数据的完整</a>
        </li>
        <li>
          <a href="#123">1.2.3 网络安全解决问题-如何进行传输双方身份验证</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#13">1.3 证书的由来</a><ul>
        <li>
          <a href="#131">1.3.1 如何获取公钥信息</a>
        </li>
        <li>
          <a href="#132">1.3.2 证书信息所包含什么内容</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#14">1.4 加密算法的简介</a><ul>
        <li>
          <a href="#141">1.4.1 对称加密算法</a>
        </li>
        <li>
          <a href="#142">1.4.2 单向加密算法</a>
        </li>
        <li>
          <a href="#143">1.4.3 非对称加密算法</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#15_OpenSSL">1.5 OpenSSL软件介绍</a><ul>
        <li>
          <a href="#151_OpenSSL">1.5.1 OpenSSL软件概念说明</a>
        </li>
        <li>
          <a href="#152_OpenSSL">1.5.2 OpenSSL软件组成部分</a>
        </li>
        <li>
          <a href="#153_OpenSSL">1.5.3 OpenSSL的使用</a>
        </li>
        <li>
          <a href="#154_OpenSSLCA">1.5.4 OpenSSL软件建立是有CA</a>
        </li>
        <li>
          <a href="#155">1.5.5 公司中申请证书文件的流程</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#16_WEBHTTPS">1.6 WEB服务实现HTTPS访问</a><ul>
        <li>
          <a href="#161">1.6.1 证书的创建</a>
        </li>
        <li>
          <a href="#162_nginxhttps">1.6.2 nginx配置https访问</a>
        </li>
        <li>
          <a href="#163_httphttps">1.6.3 实现http访问自动跳转到https的方法</a>
        </li>
        <li>
          <a href="#164_nginxhttphttps">1.6.4 利用nginx反向代理服务器进行http到https跳转</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#17_-_ngx_http_ssl_module">1.7 附录 - ngx_http_ssl_module模块说明</a><ul>
        <li>
          <a href="#171">1.7.1 示例配置</a>
        </li>
        <li>
          <a href="#172_SSL">1.7.2 SSL模块指令说明</a><ul>
            <li>
              <a href="#1721nbspssl">1.7.2.1&nbsp;ssl</a>
            </li>
            <li>
              <a href="#1722nbspssl_buffer_size">1.7.2.2&nbsp;ssl_buffer_size</a>
            </li>
            <li>
              <a href="#1723nbspssl_certificate">1.7.2.3&nbsp;ssl_certificate</a>
            </li>
            <li>
              <a href="#1724nbspssl_certificate_key">1.7.2.4&nbsp;ssl_certificate_key</a>
            </li>
            <li>
              <a href="#1725nbspssl_ciphers">1.7.2.5&nbsp;ssl_ciphers</a>
            </li>
            <li>
              <a href="#1726nbspssl_client_certificate">1.7.2.6&nbsp;ssl_client_certificate</a>
            </li>
            <li>
              <a href="#1727nbspssl_crl">1.7.2.7&nbsp;ssl_crl</a>
            </li>
            <li>
              <a href="#1728nbspssl_dhparam">1.7.2.8&nbsp;ssl_dhparam</a>
            </li>
            <li>
              <a href="#1729nbspssl_ecdh_curve">1.7.2.9&nbsp;ssl_ecdh_curve</a>
            </li>
            <li>
              <a href="#17210nbspnbspnbspnbsp_ssl_password_file">1.7.2.10&nbsp;&nbsp;&nbsp;&nbsp; ssl_password_file</a>
            </li>
            <li>
              <a href="#17211nbspnbspnbspnbsp_ssl_prefer_server_ciphers">1.7.2.11&nbsp;&nbsp;&nbsp;&nbsp; ssl_prefer_server_ciphers</a>
            </li>
            <li>
              <a href="#17212nbspnbspnbspnbsp_ssl_protocols">1.7.2.12&nbsp;&nbsp;&nbsp;&nbsp; ssl_protocols</a>
            </li>
            <li>
              <a href="#17213nbspnbspnbspnbsp_ssl_session_cache">1.7.2.13&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_cache</a>
            </li>
            <li>
              <a href="#17214nbspnbspnbspnbsp_ssl_session_ticket_key">1.7.2.14&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_ticket_key</a>
            </li>
            <li>
              <a href="#17215nbspnbspnbspnbsp_ssl_session_tickets">1.7.2.15&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_tickets</a>
            </li>
            <li>
              <a href="#17216nbspnbspnbspnbsp_ssl_session_timeout">1.7.2.16&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_timeout</a>
            </li>
            <li>
              <a href="#17217nbspnbspnbspnbsp_ssl_stapling">1.7.2.17&nbsp;&nbsp;&nbsp;&nbsp; ssl_stapling</a>
            </li>
            <li>
              <a href="#17218nbspnbspnbspnbsp_ssl_stapling_file">1.7.2.18&nbsp;&nbsp;&nbsp;&nbsp; ssl_stapling_file</a>
            </li>
            <li>
              <a href="#17219nbspnbspnbspnbsp_ssl_stapling_responder">1.7.2.19&nbsp;&nbsp;&nbsp;&nbsp; ssl_stapling_responder</a>
            </li>
            <li>
              <a href="#17220nbspnbspnbspnbsp_ssl_stapling_verify">1.7.2.20&nbsp;&nbsp;&nbsp;&nbsp; ssl_stapling_verify</a>
            </li>
            <li>
              <a href="#17221nbspnbspnbspnbsp_ssl_trusted_certificate">1.7.2.21&nbsp;&nbsp;&nbsp;&nbsp; ssl_trusted_certificate</a>
            </li>
            <li>
              <a href="#17222nbspnbspnbspnbsp_ssl_verify_client">1.7.2.22&nbsp;&nbsp;&nbsp;&nbsp; ssl_verify_client</a>
            </li>
            <li>
              <a href="#17223nbspnbspnbspnbsp_ssl_verify_depth">1.7.2.23&nbsp;&nbsp;&nbsp;&nbsp; ssl_verify_depth</a>
            </li>
          </ul>
        </li>
        
        <li>
          <a href="#173_ngx_http_ssl_module">1.7.3 ngx_http_ssl_module模块中常见错误处理</a>
        </li>
        <li>
          <a href="#174_ngx_http_ssl_module">1.7.4 ngx_http_ssl_module模块中嵌入变量</a>
        </li>
      </ul>
    </li>
    
    <li>
      <a href="#18">1.8 参考文献</a>
    </li>
  </ul>
</div>