number size
Sets the maximum number and size of\nbuffers used for reading large client request header.\nA request line cannot exceed the size of one buffer, or the\n414 (Request-URI Too Large)\nerror is returned to the client.\nA request header field cannot exceed the size of one buffer as well, or the\n400 (Bad Request)\nerror is returned to the client.\nBuffers are allocated only on demand.\nBy default, the buffer size is equal to 8K bytes.\nIf after the end of request processing a connection is transitioned\ninto the keep-alive state, these buffers are released.
If the directive is specified on the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
Sets the maximum number and size of\nbuffers used for reading large client request header.\nA request line cannot exceed the size of one buffer, or the\n414 (Request-URI Too Large)\nerror is returned to the client.\nA request header field cannot exceed the size of one buffer as well, or the\n400 (Bad Request)\nerror is returned to the client.\nBuffers are allocated only on demand.\nBy default, the buffer size is equal to 8K bytes.\nIf after the end of request processing a connection is transitioned\ninto the keep-alive state, these buffers are released.
The limits are similarly applied in HTTP/2 and HTTP/3 connections.\nThe size of one buffer\nlimits the maximum size of a request header field compressed with\nHPACK\nand\nQPACK,\nrespectively.\nNote that if Huffman encoding is applied,\nthe actual size of decompressed name and value strings may be larger.\nThe maximum size of the entire request header is limited after decompression.
\n\nIf the directive is specified on the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
on | off
Enables or disables TLS 1.3\nearly data.
\n\n\n\n\nThe directive is supported when using OpenSSL 1.1.1 or higher (1.15.4) and\nBoringSSL.
\n\nRequests sent within early data are subject to\nreplay attacks.\nTo protect against such attacks at the application layer,\nthe $ssl_early_data variable\nshould be used.
\n
proxy_set_header Early-Data $ssl_early_data;\n\n\n\nOpenSSL built-in replay protection is disabled,\nbecause it interferes with session resumption.\nIt can be turned back if deemed necessary.
\n
ssl_conf_command Options AntiReplay;\nEnables or disables TLS 1.3\nearly data.
\n\n\n\n\nThe directive is supported when using OpenSSL 1.1.1 or higher (1.15.4) and\nBoringSSL.
\n
If the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
\n\n\nRequests sent within early data are subject to\nreplay attacks.\nTo protect against such attacks at the application layer,\nthe $ssl_early_data variable\nshould be used.
\n
proxy_set_header Early-Data $ssl_early_data;\n\n\n\nOpenSSL built-in replay protection is disabled,\nbecause it interferes with session resumption.\nIt can be turned back if deemed necessary.
\n
ssl_conf_command Options AntiReplay;\noff | none | [builtin[:size]] [shared:name:size]
Sets the types and sizes of caches that store session parameters.\nA cache can be of any of the following types:
\n\noff
the use of a session cache is strictly prohibited:\nnginx explicitly tells a client that sessions may not be reused.
none
the use of a session cache is gently disallowed:\nnginx tells a client that sessions may be reused, but does not\nactually store session parameters in the cache.
builtin
a cache built in OpenSSL; used by one worker process only.\nThe cache size is specified in sessions.\nIf size is not given, it is equal to 20480 sessions.\nUse of the built-in cache can cause memory fragmentation.
shared
a cache shared between all worker processes.\nThe cache size is specified in bytes; one megabyte can store\nabout 4000 sessions.\nEach shared cache should have an arbitrary name.\nA cache with the same name can be used in several\nvirtual servers.\nIt is also used to automatically generate, store, and\nperiodically rotate TLS session ticket keys (1.23.2)\nunless configured explicitly\nusing the ssl_session_ticket_key directive.
Both cache types can be used simultaneously, for example:
\n\nssl_session_cache builtin:1000 shared:SSL:10m;\nbut using only shared cache without the built-in cache should\nbe more efficient.
\n" + "description_md": "Sets the types and sizes of caches that store session parameters.\nA cache can be of any of the following types:\n- `off`\n\n the use of a session cache is strictly prohibited:\n nginx explicitly tells a client that sessions may not be reused.\n- `none`\n\n the use of a session cache is gently disallowed:\n nginx tells a client that sessions may be reused, but does not\n actually store session parameters in the cache.\n- `builtin`\n\n a cache built in OpenSSL; used by one worker process only.\n The cache size is specified in sessions.\n If size is not given, it is equal to 20480 sessions.\n Use of the built-in cache can cause memory fragmentation.\n- `shared`\n\n a cache shared between all worker processes.\n The cache size is specified in bytes; one megabyte can store\n about 4000 sessions.\n Each shared cache should have an arbitrary name.\n A cache with the same name can be used in several\n virtual servers.\n It is also used to automatically generate, store, and\n periodically rotate TLS session ticket keys (1.23.2)\n unless configured explicitly\n using the [`ssl_session_ticket_key`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key) directive.\n\nBoth cache types can be used simultaneously, for example:\n```\nssl_session_cache builtin:1000 shared:SSL:10m;\n```\nbut using only shared cache without the built-in cache should\nbe more efficient.\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Sets the types and sizes of caches that store session parameters.\nA cache can be of any of the following types:
\n\noff
the use of a session cache is strictly prohibited:\nnginx explicitly tells a client that sessions may not be reused.
none
the use of a session cache is gently disallowed:\nnginx tells a client that sessions may be reused, but does not\nactually store session parameters in the cache.
builtin
a cache built in OpenSSL; used by one worker process only.\nThe cache size is specified in sessions.\nIf size is not given, it is equal to 20480 sessions.\nUse of the built-in cache can cause memory fragmentation.
shared
a cache shared between all worker processes.\nThe cache size is specified in bytes; one megabyte can store\nabout 4000 sessions.\nEach shared cache should have an arbitrary name.\nA cache with the same name can be used in several\nvirtual servers.\nIt is also used to automatically generate, store, and\nperiodically rotate TLS session ticket keys (1.23.2)\nunless configured explicitly\nusing the ssl_session_ticket_key directive.
Both cache types can be used simultaneously, for example:
\n\nssl_session_cache builtin:1000 shared:SSL:10m;\nbut using only shared cache without the built-in cache should\nbe more efficient.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
file
Sets a file with the secret key used to encrypt\nand decrypt TLS session tickets.\nThe directive is necessary if the same key has to be shared between\nmultiple servers.\nBy default, a randomly generated key is used.
If several keys are specified, only the first key is\nused to encrypt TLS session tickets.\nThis allows configuring key rotation, for example:
\n\nssl_session_ticket_key current.key;\nssl_session_ticket_key previous.key;\nThe file must contain 80 or 48 bytes\nof random data and can be created using the following command:
openssl rand 80 > ticket.key\nDepending on the file size either AES256 (for 80-byte keys, 1.11.8)\nor AES128 (for 48-byte keys) is used for encryption.
\n" + "description_md": "Sets a *`file`* with the secret key used to encrypt\nand decrypt TLS session tickets.\nThe directive is necessary if the same key has to be shared between\nmultiple servers.\nBy default, a randomly generated key is used.\n\nIf several keys are specified, only the first key is\nused to encrypt TLS session tickets.\nThis allows configuring key rotation, for example:\n```\nssl_session_ticket_key current.key;\nssl_session_ticket_key previous.key;\n```\n\nThe *`file`* must contain 80 or 48 bytes\nof random data and can be created using the following command:\n```\nopenssl rand 80 > ticket.key\n```\nDepending on the file size either AES256 (for 80-byte keys, 1.11.8)\nor AES128 (for 48-byte keys) is used for encryption.\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Sets a file with the secret key used to encrypt\nand decrypt TLS session tickets.\nThe directive is necessary if the same key has to be shared between\nmultiple servers.\nBy default, a randomly generated key is used.
If several keys are specified, only the first key is\nused to encrypt TLS session tickets.\nThis allows configuring key rotation, for example:
\n\nssl_session_ticket_key current.key;\nssl_session_ticket_key previous.key;\nThe file must contain 80 or 48 bytes\nof random data and can be created using the following command:
openssl rand 80 > ticket.key\nDepending on the file size either AES256 (for 80-byte keys, 1.11.8)\nor AES128 (for 48-byte keys) is used for encryption.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
on | off
Enables or disables session resumption through\nTLS session tickets.
\n" + "description_md": "Enables or disables session resumption through\n[TLS session tickets](https://datatracker.ietf.org/doc/html/rfc5077).\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Enables or disables session resumption through\nTLS session tickets.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
time
Specifies a time during which a client may reuse the\nsession parameters.
\n" + "description_md": "Specifies a time during which a client may reuse the\nsession parameters.\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Specifies a time during which a client may reuse the\nsession parameters.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
off | none | [builtin[:size]] [shared:name:size]
Sets the types and sizes of caches that store session parameters.\nA cache can be of any of the following types:
\n\noff
the use of a session cache is strictly prohibited:\nnginx explicitly tells a client that sessions may not be reused.
none
the use of a session cache is gently disallowed:\nnginx tells a client that sessions may be reused, but does not\nactually store session parameters in the cache.
builtin
a cache built in OpenSSL; used by one worker process only.\nThe cache size is specified in sessions.\nIf size is not given, it is equal to 20480 sessions.\nUse of the built-in cache can cause memory fragmentation.
shared
a cache shared between all worker processes.\nThe cache size is specified in bytes; one megabyte can store\nabout 4000 sessions.\nEach shared cache should have an arbitrary name.\nA cache with the same name can be used in several\nvirtual servers.\nIt is also used to automatically generate, store, and\nperiodically rotate TLS session ticket keys (1.23.2)\nunless configured explicitly\nusing the ssl_session_ticket_key directive.
Both cache types can be used simultaneously, for example:
\n\nssl_session_cache builtin:1000 shared:SSL:10m;\nbut using only shared cache without the built-in cache should\nbe more efficient.
\n" + "description_md": "Sets the types and sizes of caches that store session parameters.\nA cache can be of any of the following types:\n- `off`\n\n the use of a session cache is strictly prohibited:\n nginx explicitly tells a client that sessions may not be reused.\n- `none`\n\n the use of a session cache is gently disallowed:\n nginx tells a client that sessions may be reused, but does not\n actually store session parameters in the cache.\n- `builtin`\n\n a cache built in OpenSSL; used by one worker process only.\n The cache size is specified in sessions.\n If size is not given, it is equal to 20480 sessions.\n Use of the built-in cache can cause memory fragmentation.\n- `shared`\n\n a cache shared between all worker processes.\n The cache size is specified in bytes; one megabyte can store\n about 4000 sessions.\n Each shared cache should have an arbitrary name.\n A cache with the same name can be used in several\n virtual servers.\n It is also used to automatically generate, store, and\n periodically rotate TLS session ticket keys (1.23.2)\n unless configured explicitly\n using the [`ssl_session_ticket_key`](https://nginx.org/en/docs/stream/ngx_stream_ssl_module.html#ssl_session_ticket_key) directive.\n\nBoth cache types can be used simultaneously, for example:\n```\nssl_session_cache builtin:1000 shared:SSL:10m;\n```\nbut using only shared cache without the built-in cache should\nbe more efficient.\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/stream/ngx_stream_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Sets the types and sizes of caches that store session parameters.\nA cache can be of any of the following types:
\n\noff
the use of a session cache is strictly prohibited:\nnginx explicitly tells a client that sessions may not be reused.
none
the use of a session cache is gently disallowed:\nnginx tells a client that sessions may be reused, but does not\nactually store session parameters in the cache.
builtin
a cache built in OpenSSL; used by one worker process only.\nThe cache size is specified in sessions.\nIf size is not given, it is equal to 20480 sessions.\nUse of the built-in cache can cause memory fragmentation.
shared
a cache shared between all worker processes.\nThe cache size is specified in bytes; one megabyte can store\nabout 4000 sessions.\nEach shared cache should have an arbitrary name.\nA cache with the same name can be used in several\nvirtual servers.\nIt is also used to automatically generate, store, and\nperiodically rotate TLS session ticket keys (1.23.2)\nunless configured explicitly\nusing the ssl_session_ticket_key directive.
Both cache types can be used simultaneously, for example:
\n\nssl_session_cache builtin:1000 shared:SSL:10m;\nbut using only shared cache without the built-in cache should\nbe more efficient.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
file
Sets a file with the secret key used to encrypt\nand decrypt TLS session tickets.\nThe directive is necessary if the same key has to be shared between\nmultiple servers.\nBy default, a randomly generated key is used.
If several keys are specified, only the first key is\nused to encrypt TLS session tickets.\nThis allows configuring key rotation, for example:
\n\nssl_session_ticket_key current.key;\nssl_session_ticket_key previous.key;\nThe file must contain 80 or 48 bytes\nof random data and can be created using the following command:
openssl rand 80 > ticket.key\nDepending on the file size either AES256 (for 80-byte keys, 1.11.8)\nor AES128 (for 48-byte keys) is used for encryption.
\n" + "description_md": "Sets a *`file`* with the secret key used to encrypt\nand decrypt TLS session tickets.\nThe directive is necessary if the same key has to be shared between\nmultiple servers.\nBy default, a randomly generated key is used.\n\nIf several keys are specified, only the first key is\nused to encrypt TLS session tickets.\nThis allows configuring key rotation, for example:\n```\nssl_session_ticket_key current.key;\nssl_session_ticket_key previous.key;\n```\n\nThe *`file`* must contain 80 or 48 bytes\nof random data and can be created using the following command:\n```\nopenssl rand 80 > ticket.key\n```\nDepending on the file size either AES256 (for 80-byte keys, 1.11.8)\nor AES128 (for 48-byte keys) is used for encryption.\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/stream/ngx_stream_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Sets a file with the secret key used to encrypt\nand decrypt TLS session tickets.\nThe directive is necessary if the same key has to be shared between\nmultiple servers.\nBy default, a randomly generated key is used.
If several keys are specified, only the first key is\nused to encrypt TLS session tickets.\nThis allows configuring key rotation, for example:
\n\nssl_session_ticket_key current.key;\nssl_session_ticket_key previous.key;\nThe file must contain 80 or 48 bytes\nof random data and can be created using the following command:
openssl rand 80 > ticket.key\nDepending on the file size either AES256 (for 80-byte keys, 1.11.8)\nor AES128 (for 48-byte keys) is used for encryption.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
on | off
Enables or disables session resumption through\nTLS session tickets.
\n" + "description_md": "Enables or disables session resumption through\n[TLS session tickets](https://datatracker.ietf.org/doc/html/rfc5077).\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/stream/ngx_stream_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Enables or disables session resumption through\nTLS session tickets.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.
time
Specifies a time during which a client may reuse the\nsession parameters.
\n" + "description_md": "Specifies a time during which a client may reuse the\nsession parameters.\n\nIf the directive is specified\non the [`server`](https://nginx.org/en/docs/stream/ngx_stream_core_module.html#server) level,\nthe value from the default server can be used.\nDetails are provided in the\n“[Virtual server selection](https://nginx.org/en/docs/http/server_names.html#virtual_server_selection)” section.", + "description_html": "Specifies a time during which a client may reuse the\nsession parameters.
\n\nIf the directive is specified\non the server level,\nthe value from the default server can be used.\nDetails are provided in the\n“Virtual server selection” section.