Skip to content

Commit 4280753

Browse files
y82y82
committed
Documented ssl_certificate_cache and friends.
1 parent f43e93c commit 4280753

12 files changed

+906
-36
lines changed

‎xml/en/docs/http/ngx_http_grpc_module.xml‎

Lines changed: 76 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<module name="Module ngx_http_grpc_module"
1111
link="/en/docs/http/ngx_http_grpc_module.html"
1212
lang="en"
13-
rev="11">
13+
rev="12">
1414

1515
<section id="summary">
1616

@@ -482,13 +482,86 @@ Specifies a <value>file</value> with the certificate in the PEM format
482482
used for authentication to a gRPC SSL server.
483483
</para>
484484

485-
<para>
485+
<para id="grpc_ssl_certificate_variables">
486486
Since version 1.21.0, variables can be used in the <value>file</value> name.
487487
</para>
488488

489489
</directive>
490490

491491

492+
<directive name="grpc_ssl_certificate_cache">
493+
<syntax><literal>off</literal></syntax>
494+
<syntax>
495+
<literal>max</literal>=<value>N</value>
496+
[<literal>inactive</literal>=<value>time</value>]
497+
[<literal>valid</literal>=<value>time</value>]</syntax>
498+
<default>off</default>
499+
<context>http</context>
500+
<context>server</context>
501+
<context>location</context>
502+
<appeared-in>1.27.4</appeared-in>
503+
504+
<para>
505+
Defines a cache that stores
506+
<link id="grpc_ssl_certificate">SSL certificates</link> and
507+
<link id="grpc_ssl_certificate_key">secret keys</link>
508+
specified with <link id="grpc_ssl_certificate_key_variables">variables</link>.
509+
</para>
510+
511+
<para>
512+
The directive has the following parameters:
513+
<list type="tag">
514+
515+
<tag-name id="grpc_ssl_certificate_cache_max">
516+
<literal>max</literal>
517+
</tag-name>
518+
<tag-desc>
519+
sets the maximum number of elements in the cache;
520+
on cache overflow the least recently used (LRU) elements are removed;
521+
</tag-desc>
522+
523+
<tag-name id="grpc_ssl_certificate_cache_inactive">
524+
<literal>inactive</literal>
525+
</tag-name>
526+
<tag-desc>
527+
defines a time after which an element is removed from the cache
528+
if it has not been accessed during this time;
529+
by default, it is 10 seconds;
530+
</tag-desc>
531+
532+
<tag-name id="grpc_ssl_certificate_cache_valid">
533+
<literal>valid</literal>
534+
</tag-name>
535+
<tag-desc>
536+
defines a time during which
537+
an element in the cache is considered valid
538+
and can be reused;
539+
by default, it is 60 seconds.
540+
Certificates that exceed this time will be reloaded or revalidated;
541+
</tag-desc>
542+
543+
<tag-name id="grpc_ssl_certificate_cache_off">
544+
<literal>off</literal>
545+
</tag-name>
546+
<tag-desc>
547+
disables the cache.
548+
</tag-desc>
549+
550+
</list>
551+
</para>
552+
553+
<para>
554+
Example:
555+
<example>
556+
grpc_ssl_certificate $grpc_ssl_server_name.crt;
557+
grpc_ssl_certificate_key $grpc_ssl_server_name.key;
558+
grpc_ssl_certificate_cache max=1000 inactive=20s valid=1m;
559+
</example>
560+
</para>
561+
562+
</directive>
563+
564+
492565
<directive name="grpc_ssl_certificate_key">
493566
<syntax><value>file</value></syntax>
494567
<default/>
@@ -509,7 +582,7 @@ which loads a secret key with a specified <value>id</value>
509582
from the OpenSSL engine <value>name</value>.
510583
</para>
511584

512-
<para>
585+
<para id="grpc_ssl_certificate_key_variables">
513586
Since version 1.21.0, variables can be used in the <value>file</value> name.
514587
</para>
515588

‎xml/en/docs/http/ngx_http_proxy_module.xml‎

Lines changed: 76 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<module name="Module ngx_http_proxy_module"
1111
link="/en/docs/http/ngx_http_proxy_module.html"
1212
lang="en"
13-
rev="79">
13+
rev="80">
1414

1515
<section id="summary">
1616

@@ -1972,13 +1972,86 @@ Specifies a <value>file</value> with the certificate in the PEM format
19721972
used for authentication to a proxied HTTPS server.
19731973
</para>
19741974

1975-
<para>
1975+
<para id="proxy_ssl_certificate_variables">
19761976
Since version 1.21.0, variables can be used in the <value>file</value> name.
19771977
</para>
19781978

19791979
</directive>
19801980

19811981

1982+
<directive name="proxy_ssl_certificate_cache">
1983+
<syntax><literal>off</literal></syntax>
1984+
<syntax>
1985+
<literal>max</literal>=<value>N</value>
1986+
[<literal>inactive</literal>=<value>time</value>]
1987+
[<literal>valid</literal>=<value>time</value>]</syntax>
1988+
<default>off</default>
1989+
<context>http</context>
1990+
<context>server</context>
1991+
<context>location</context>
1992+
<appeared-in>1.27.4</appeared-in>
1993+
1994+
<para>
1995+
Defines a cache that stores
1996+
<link id="proxy_ssl_certificate">SSL certificates</link> and
1997+
<link id="proxy_ssl_certificate_key">secret keys</link>
1998+
specified with <link id="proxy_ssl_certificate_key_variables">variables</link>.
1999+
</para>
2000+
2001+
<para>
2002+
The directive has the following parameters:
2003+
<list type="tag">
2004+
2005+
<tag-name id="proxy_ssl_certificate_cache_max">
2006+
<literal>max</literal>
2007+
</tag-name>
2008+
<tag-desc>
2009+
sets the maximum number of elements in the cache;
2010+
on cache overflow the least recently used (LRU) elements are removed;
2011+
</tag-desc>
2012+
2013+
<tag-name id="proxy_ssl_certificate_cache_inactive">
2014+
<literal>inactive</literal>
2015+
</tag-name>
2016+
<tag-desc>
2017+
defines a time after which an element is removed from the cache
2018+
if it has not been accessed during this time;
2019+
by default, it is 10 seconds;
2020+
</tag-desc>
2021+
2022+
<tag-name id="proxy_ssl_certificate_cache_valid">
2023+
<literal>valid</literal>
2024+
</tag-name>
2025+
<tag-desc>
2026+
defines a time during which
2027+
an element in the cache is considered valid
2028+
and can be reused;
2029+
by default, it is 60 seconds.
2030+
Certificates that exceed this time will be reloaded or revalidated;
2031+
</tag-desc>
2032+
2033+
<tag-name id="proxy_ssl_certificate_cache_off">
2034+
<literal>off</literal>
2035+
</tag-name>
2036+
<tag-desc>
2037+
disables the cache.
2038+
</tag-desc>
2039+
2040+
</list>
2041+
</para>
2042+
2043+
<para>
2044+
Example:
2045+
<example>
2046+
proxy_ssl_certificate $proxy_ssl_server_name.crt;
2047+
proxy_ssl_certificate_key $proxy_ssl_server_name.key;
2048+
proxy_ssl_certificate_cache max=1000 inactive=20s valid=1m;
2049+
</example>
2050+
</para>
2051+
2052+
</directive>
2053+
2054+
19822055
<directive name="proxy_ssl_certificate_key">
19832056
<syntax><value>file</value></syntax>
19842057
<default/>
@@ -2000,7 +2073,7 @@ which loads a secret key with a specified <value>id</value>
20002073
from the OpenSSL engine <value>name</value>.
20012074
</para>
20022075

2003-
<para>
2076+
<para id="proxy_ssl_certificate_key_variables">
20042077
Since version 1.21.0, variables can be used in the <value>file</value> name.
20052078
</para>
20062079

‎xml/en/docs/http/ngx_http_ssl_module.xml‎

Lines changed: 75 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<module name="Module ngx_http_ssl_module"
1111
link="/en/docs/http/ngx_http_ssl_module.html"
1212
lang="en"
13-
rev="64">
13+
rev="65">
1414

1515
<section id="summary">
1616

@@ -175,7 +175,7 @@ With older versions, only one certificate chain can be used.
175175
</note>
176176
</para>
177177

178-
<para>
178+
<para id="ssl_certificate_variables">
179179
Since version 1.15.9, variables can be used in the <value>file</value> name
180180
when using OpenSSL 1.0.2 or higher:
181181
<example>
@@ -208,6 +208,78 @@ IP addresses</link>.
208208
</directive>
209209

210210

211+
<directive name="ssl_certificate_cache">
212+
<syntax><literal>off</literal></syntax>
213+
<syntax>
214+
<literal>max</literal>=<value>N</value>
215+
[<literal>inactive</literal>=<value>time</value>]
216+
[<literal>valid</literal>=<value>time</value>]</syntax>
217+
<default>off</default>
218+
<context>http</context>
219+
<context>server</context>
220+
<appeared-in>1.27.4</appeared-in>
221+
222+
<para>
223+
Defines a cache that stores
224+
<link id="ssl_certificate">SSL certificates</link> and
225+
<link id="ssl_certificate_key">secret keys</link>
226+
specified with <link id="ssl_certificate_key_variables">variables</link>.
227+
</para>
228+
229+
<para>
230+
The directive has the following parameters:
231+
<list type="tag">
232+
233+
<tag-name id="ssl_certificate_cache_max">
234+
<literal>max</literal>
235+
</tag-name>
236+
<tag-desc>
237+
sets the maximum number of elements in the cache;
238+
on cache overflow the least recently used (LRU) elements are removed;
239+
</tag-desc>
240+
241+
<tag-name id="ssl_certificate_cache_inactive">
242+
<literal>inactive</literal>
243+
</tag-name>
244+
<tag-desc>
245+
defines a time after which an element is removed from the cache
246+
if it has not been accessed during this time;
247+
by default, it is 10 seconds;
248+
</tag-desc>
249+
250+
<tag-name id="ssl_certificate_cache_valid">
251+
<literal>valid</literal>
252+
</tag-name>
253+
<tag-desc>
254+
defines a time during which
255+
an element in the cache is considered valid
256+
and can be reused;
257+
by default, it is 60 seconds.
258+
Certificates that exceed this time will be reloaded or revalidated;
259+
</tag-desc>
260+
261+
<tag-name id="ssl_certificate_cache_off">
262+
<literal>off</literal>
263+
</tag-name>
264+
<tag-desc>
265+
disables the cache.
266+
</tag-desc>
267+
268+
</list>
269+
</para>
270+
271+
<para>
272+
Example:
273+
<example>
274+
ssl_certificate $ssl_server_name.crt;
275+
ssl_certificate_key $ssl_server_name.key;
276+
ssl_certificate_cache max=1000 inactive=20s valid=1m;
277+
</example>
278+
</para>
279+
280+
</directive>
281+
282+
211283
<directive name="ssl_certificate_key">
212284
<syntax><value>file</value></syntax>
213285
<default/>
@@ -237,7 +309,7 @@ such as writing secret key data to
237309
<link doc="../ngx_core_module.xml" id="error_log">error log</link>.
238310
</para>
239311

240-
<para>
312+
<para id="ssl_certificate_key_variables">
241313
Since version 1.15.9, variables can be used in the <value>file</value> name
242314
when using OpenSSL 1.0.2 or higher.
243315
</para>

0 commit comments

Comments
 (0)