Skip to content

Latest commit

 

History

History
87 lines (63 loc) · 3.12 KB

README.markdown

File metadata and controls

87 lines (63 loc) · 3.12 KB
Raw

nginx Certificate Transparency module

Introduction

This module adds support for the TLS signed_certificate_timestamp extension to nginx, which is one of the mechanisms supported by Google's Certificate Transparency project to deliver Signed Certificate Timestamps to TLS clients.

Building

Add --add-module=/path/to/nginx-ct to the nginx ./configure invocation.

If you are using nginx 1.9.11 or above, you can use --add-dynamic-module=/path/to/nginx-ct to build as a dynamic module.

The following versions of OpenSSL are supported:

  • OpenSSL 1.0.2 or above.
  • BoringSSL 4fac72e or above.

LibreSSL is not supported as it doesn't provide either of the functions used to add the signed_certificate_timestamp extension to the response (SSL_CTX_add_server_custom_ext and SSL_CTX_set_signed_cert_timestamp_list).

OpenSSL versions between 1.1.0 and 1.1.0e inclusive contain a bug that prevents this module from working with non-default_server server blocks. The bug is fixed in OpenSSL 1.1.0f.

Configuration

If built as a dynamic module, add the following directives to the top level of your configuration file:

load_module modules/ngx_ssl_ct_module.so;
load_module modules/ngx_http_ssl_ct_module.so;

You can also load ngx_mail_ssl_ct_module.so and ngx_stream_ssl_ct_module.so if you need mail or stream support.

Add the following directives, which are valid in http, mail, stream and server blocks, to your configuration file:

ssl_ct on;
ssl_ct_static_scts /path/to/sct/dir;

The module will read all *.sct files in the given directory, which are expected to be encoded in binary (see the definition of SignedCertificateTimestamp struct in section 3.2 of RFC 6962). This is the same format used by Apache's mod_ssl_ct module.

The module is compatible with nginx's multiple certificate support if you are using nginx 1.11.0 or above and are not using BoringSSL. Exactly one ssl_ct_static_scts directive must be specified for each ssl_certificate directive:

ssl_ct on;

ssl_certificate /path/to/rsa.pem;
ssl_certificate_key /path/to/rsa.key;
ssl_ct_static_scts /path/to/rsa/scts;

ssl_certificate /path/to/ecdsa.pem;
ssl_certificate_key /path/to/ecdsa.key;
ssl_ct_static_scts /path/to/ecdsa/scts;

ct-submit can be used to submit certificates to log servers and encode the SignedCertificateTimestamp struct in the appropriate format for use with this module.

License

This project is available under the terms of the ISC license, which is similar to the 2-clause BSD license. See the LICENSE file for the copyright information and licensing terms.