nginx Certificate Transparency module
This module adds support for the TLS
signed_certificate_timestamp extension to
nginx, which is one of the mechanisms supported by Google's
Certificate Transparency project to deliver Signed Certificate Timestamps
to TLS clients.
--add-module=/path/to/nginx-ct to the nginx
If you are using nginx 1.9.11 or above, you can use
--add-dynamic-module=/path/to/nginx-ct to build as a dynamic module.
The following versions of OpenSSL are supported:
- OpenSSL 1.0.2 or above.
- BoringSSL 4fac72e or above.
LibreSSL is not supported as it doesn't provide either of the functions used
to add the
signed_certificate_timestamp extension to the response
OpenSSL versions between 1.1.0 and 1.1.0e inclusive contain a bug
that prevents this module from working with non-
blocks. The bug is fixed in OpenSSL 1.1.0f.
If built as a dynamic module, add the following directives to the top level of your configuration file:
load_module modules/ngx_ssl_ct_module.so; load_module modules/ngx_http_ssl_ct_module.so;
You can also load
if you need
Add the following directives, which are valid in
server blocks, to your configuration file:
ssl_ct on; ssl_ct_static_scts /path/to/sct/dir;
The module will read all
*.sct files in the given directory, which are
expected to be encoded in binary (see the definition of
SignedCertificateTimestamp struct in section 3.2 of RFC 6962). This is
the same format used by Apache's mod_ssl_ct module.
The module is compatible with nginx's multiple certificate support if you are
using nginx 1.11.0 or above and are not using BoringSSL. Exactly one
ssl_ct_static_scts directive must be specified for each
ssl_ct on; ssl_certificate /path/to/rsa.pem; ssl_certificate_key /path/to/rsa.key; ssl_ct_static_scts /path/to/rsa/scts; ssl_certificate /path/to/ecdsa.pem; ssl_certificate_key /path/to/ecdsa.key; ssl_ct_static_scts /path/to/ecdsa/scts;
ct-submit can be used to submit certificates to log servers and
SignedCertificateTimestamp struct in the appropriate format for use
with this module.
This project is available under the terms of the ISC license, which is similar
to the 2-clause BSD license. See the
LICENSE file for the copyright
information and licensing terms.