ngxhttpsslmodule

ngxhttpsslmodule, typically known in practice as the ngx_http_ssl_module, is a component of Nginx that provides SSL/TLS termination for HTTP traffic. It integrates with the OpenSSL (or compatible) library to decrypt incoming TLS connections and to encrypt responses sent to clients, allowing Nginx to handle HTTPS requests efficiently and securely.

The module enables a range of TLS features essential for secure web delivery. It supports loading server certificates and private keys, enabling SNI (Server Name Indication) to serve multiple domains on a single IP address, and selecting allowed TLS protocol versions and cipher suites. It also offers TLS session resumption through session tickets or session caches, enabling faster handshakes for returning clients. Additional capabilities include OCSP stapling for certificate status, optional client certificate verification, and configuration of DH/ECDH parameters and curves to influence key exchange. When available, it works with HTTP/2 over TLS and can be paired with modern TLS features such as TLS 1.2 and TLS 1.3 as provided by the underlying OpenSSL.

Configuration in Nginx is performed within server blocks. Typical usage involves listening on port 443 with the ssl parameter (for example, listen 443 ssl; or listen 443 ssl http2;). Core directives include ssl_certificate and ssl_certificate_key to specify the certificate file and its private key. Additional directives control security and performance, such as ssl_protocols to restrict protocol versions, ssl_ciphers to select cipher suites, ssl_prefer_server_ciphers, ssl_session_timeout and ssl_session_cache or ssl_session_tickets for session management, and ssl_stapling (with ssl_stapling_verify) to enable OCSP stapling. For client authentication, ssl_verify_client and ssl_trusted_certificate are used.

The module is typically built into Nginx or provided as a dynamic module. It depends on the OpenSSL library for cryptographic operations and is a foundational component for deploying HTTPS with Nginx.