|
@@ -1323,9 +1323,8 @@ In case PSK cipher suites are intended, make sure to configured
|
|
|
"""
|
|
"""
|
|
|
zh: """
|
|
zh: """
|
|
|
支持所有TLS/DTLS版本</br>
|
|
支持所有TLS/DTLS版本</br>
|
|
|
-注:PSK密码被“tlsv1”抑制。3'版本配置</br>
|
|
|
|
|
-如果打算使用PSK密码套件,请确保这里已配置
|
|
|
|
|
-<code>['tlsv1.2','tlsv1.1']</code>。
|
|
|
|
|
|
|
+
|
|
|
|
|
+注:PSK 的 Ciphers 无法在 <code>tlsv1.3</code> 中使用,如果打算使用 PSK 密码套件,请确保这里配置为 <code>["tlsv1.2","tlsv1.1"]</code>。
|
|
|
"""
|
|
"""
|
|
|
}
|
|
}
|
|
|
label: {
|
|
label: {
|
|
@@ -1334,7 +1333,71 @@ In case PSK cipher suites are intended, make sure to configured
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
-ciphers_schema_0 {
|
|
|
|
|
|
|
+ciphers_schema_common {
|
|
|
|
|
+ desc {
|
|
|
|
|
+ en: """
|
|
|
|
|
+This config holds TLS cipher suite names separated by comma,
|
|
|
|
|
+or as an array of strings. e.g.
|
|
|
|
|
+<code>"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256"</code> or
|
|
|
|
|
+<code>["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"]</code>.
|
|
|
|
|
+</br>
|
|
|
|
|
+Ciphers (and their ordering) define the way in which the
|
|
|
|
|
+client and server encrypts information over the network connection.
|
|
|
|
|
+Selecting a good cipher suite is critical for the
|
|
|
|
|
+application's data security, confidentiality and performance.
|
|
|
|
|
+
|
|
|
|
|
+The names should be in OpenSSL string format (not RFC format).
|
|
|
|
|
+All default values and examples provided by EMQX config
|
|
|
|
|
+documentation are all in OpenSSL format.</br>
|
|
|
|
|
+
|
|
|
|
|
+NOTE: Certain cipher suites are only compatible with
|
|
|
|
|
+specific TLS <code>versions</code> ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
|
|
|
|
|
+incompatible cipher suites will be silently dropped.
|
|
|
|
|
+For instance, if only 'tlsv1.3' is given in the <code>versions</code>,
|
|
|
|
|
+configuring cipher suites for other versions will have no effect.
|
|
|
|
|
+</br>
|
|
|
|
|
+
|
|
|
|
|
+NOTE: PSK ciphers are suppressed by 'tlsv1.3' version config</br>
|
|
|
|
|
+If PSK cipher suites are intended, 'tlsv1.3' should be disabled from <code>versions</code>.</br>
|
|
|
|
|
+PSK cipher suites: <code>"RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
|
|
|
|
|
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
|
|
|
|
|
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
|
|
|
|
|
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"</code></br>
|
|
|
|
|
+"""
|
|
|
|
|
+ zh: """
|
|
|
|
|
+此配置保存由逗号分隔的 TLS 密码套件名称,或作为字符串数组。例如
|
|
|
|
|
+<code>"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256"</code>或
|
|
|
|
|
+<code>["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"]</code>。
|
|
|
|
|
+</br>
|
|
|
|
|
+密码(及其顺序)定义了客户端和服务器通过网络连接加密信息的方式。
|
|
|
|
|
+选择一个好的密码套件对于应用程序的数据安全性、机密性和性能至关重要。
|
|
|
|
|
+
|
|
|
|
|
+名称应为 OpenSSL 字符串格式(而不是 RFC 格式)。
|
|
|
|
|
+EMQX 配置文档提供的所有默认值和示例都是 OpenSSL 格式</br>
|
|
|
|
|
+注意:某些密码套件仅与特定的 TLS <code>版本</code>兼容('tlsv1.1'、'tlsv1.2'或'tlsv1.3')。
|
|
|
|
|
+不兼容的密码套件将被自动删除。
|
|
|
|
|
+
|
|
|
|
|
+例如,如果只有 <code>versions</code> 仅配置为 <code>tlsv1.3</code>。为其他版本配置密码套件将无效。
|
|
|
|
|
+
|
|
|
|
|
+</br>
|
|
|
|
|
+注:PSK 的 Ciphers 不支持 tlsv1.3</br>
|
|
|
|
|
+如果打算使用PSK密码套件 <code>tlsv1.3</code>。应在<code>ssl.versions</code>中禁用。
|
|
|
|
|
+
|
|
|
|
|
+</br>
|
|
|
|
|
+PSK 密码套件:
|
|
|
|
|
+<code>"RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
|
|
|
|
|
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
|
|
|
|
|
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
|
|
|
|
|
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"</code></br>
|
|
|
|
|
+"""
|
|
|
|
|
+ }
|
|
|
|
|
+ label: {
|
|
|
|
|
+ en: ""
|
|
|
|
|
+ zh: ""
|
|
|
|
|
+ }
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+ciphers_schema_quic {
|
|
|
desc {
|
|
desc {
|
|
|
en: """
|
|
en: """
|
|
|
This config holds TLS cipher suite names separated by comma,
|
|
This config holds TLS cipher suite names separated by comma,
|
|
@@ -1364,11 +1427,13 @@ PSK cipher suites: <code>"RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
|
|
|
RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
|
|
RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
|
|
|
RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
|
|
RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
|
|
|
RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"</code></br>
|
|
RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"</code></br>
|
|
|
|
|
+
|
|
|
|
|
+NOTE: QUIC listener supports only 'tlsv1.3' ciphers</br>
|
|
|
"""
|
|
"""
|
|
|
zh: """
|
|
zh: """
|
|
|
此配置保存由逗号分隔的 TLS 密码套件名称,或作为字符串数组。例如
|
|
此配置保存由逗号分隔的 TLS 密码套件名称,或作为字符串数组。例如
|
|
|
-<code>“TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256”</code>或
|
|
|
|
|
-<code>[“TLS_AES_256_GCM_SHA384”、“TLS_AES_128_GCM_SHA256”]</code>。
|
|
|
|
|
|
|
+<code>"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256"</code>或
|
|
|
|
|
+<code>["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"]</code>。
|
|
|
</br>
|
|
</br>
|
|
|
密码(及其顺序)定义了客户端和服务器通过网络连接加密信息的方式。
|
|
密码(及其顺序)定义了客户端和服务器通过网络连接加密信息的方式。
|
|
|
选择一个好的密码套件对于应用程序的数据安全性、机密性和性能至关重要。
|
|
选择一个好的密码套件对于应用程序的数据安全性、机密性和性能至关重要。
|
|
@@ -1378,18 +1443,20 @@ EMQX 配置文档提供的所有默认值和示例都是 OpenSSL 格式</br>
|
|
|
注意:某些密码套件仅与特定的 TLS <code>版本</code>兼容('tlsv1.1'、'tlsv1.2'或'tlsv1.3')。
|
|
注意:某些密码套件仅与特定的 TLS <code>版本</code>兼容('tlsv1.1'、'tlsv1.2'或'tlsv1.3')。
|
|
|
不兼容的密码套件将被自动删除。
|
|
不兼容的密码套件将被自动删除。
|
|
|
|
|
|
|
|
-例如,如果只有“tlsv1.3”。在<code>版本</code>中给出,为其他版本配置密码套件将无效。
|
|
|
|
|
|
|
+例如,如果只有 <code>versions</code> 仅配置为 <code>tlsv1.3</code>。为其他版本配置密码套件将无效。
|
|
|
|
|
|
|
|
</br>
|
|
</br>
|
|
|
-注:PSK密码被“tlsv1.3”抑制。版本配置</br>
|
|
|
|
|
-如果打算使用PSK密码套件,“tlsv1.3”。应在<code>版本</code>中禁用。
|
|
|
|
|
|
|
+注:PSK 的 Ciphers 不支持 tlsv1.3</br>
|
|
|
|
|
+如果打算使用PSK密码套件,<code>tlsv1.3</code>。应在<code>ssl.versions</code>中禁用。
|
|
|
|
|
|
|
|
</br>
|
|
</br>
|
|
|
-PSK密码套件:
|
|
|
|
|
|
|
+PSK 密码套件:
|
|
|
<code>"RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
|
|
<code>"RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
|
|
|
RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
|
|
RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
|
|
|
RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
|
|
RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
|
|
|
RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"</code></br>
|
|
RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"</code></br>
|
|
|
|
|
+
|
|
|
|
|
+注:QUIC 监听器不支持 tlsv1.3 的 ciphers
|
|
|
"""
|
|
"""
|
|
|
}
|
|
}
|
|
|
label: {
|
|
label: {
|
|
@@ -1699,30 +1766,30 @@ base_listener_mountpoint {
|
|
|
desc {
|
|
desc {
|
|
|
en: """
|
|
en: """
|
|
|
When publishing or subscribing, prefix all topics with a mountpoint string.
|
|
When publishing or subscribing, prefix all topics with a mountpoint string.
|
|
|
- The prefixed string will be removed from the topic name when the message
|
|
|
|
|
- is delivered to the subscriber. The mountpoint is a way that users can use
|
|
|
|
|
- to implement isolation of message routing between different listeners.
|
|
|
|
|
- For example if a client A subscribes to `t` with `listeners.tcp.<name>.mountpoint`
|
|
|
|
|
- set to `some_tenant`, then the client actually subscribes to the topic
|
|
|
|
|
- `some_tenant/t`. Similarly, if another client B (connected to the same listener
|
|
|
|
|
- as the client A) sends a message to topic `t`, the message is routed
|
|
|
|
|
- to all the clients subscribed `some_tenant/t`, so client A will receive the
|
|
|
|
|
- message, with topic name `t`.</br>
|
|
|
|
|
- Set to `""` to disable the feature.</br>
|
|
|
|
|
-
|
|
|
|
|
- Variables in mountpoint string:
|
|
|
|
|
- - <code>${clientid}</code>: clientid
|
|
|
|
|
- - <code>${username}</code>: username
|
|
|
|
|
|
|
+The prefixed string will be removed from the topic name when the message
|
|
|
|
|
+is delivered to the subscriber. The mountpoint is a way that users can use
|
|
|
|
|
+to implement isolation of message routing between different listeners.
|
|
|
|
|
+For example if a client A subscribes to `t` with `listeners.tcp.<name>.mountpoint`
|
|
|
|
|
+set to `some_tenant`, then the client actually subscribes to the topic
|
|
|
|
|
+`some_tenant/t`. Similarly, if another client B (connected to the same listener
|
|
|
|
|
+as the client A) sends a message to topic `t`, the message is routed
|
|
|
|
|
+to all the clients subscribed `some_tenant/t`, so client A will receive the
|
|
|
|
|
+message, with topic name `t`.</br>
|
|
|
|
|
+Set to `""` to disable the feature.</br>
|
|
|
|
|
+
|
|
|
|
|
+Variables in mountpoint string:
|
|
|
|
|
+ - <code>${clientid}</code>: clientid
|
|
|
|
|
+ - <code>${username}</code>: username
|
|
|
"""
|
|
"""
|
|
|
zh: """
|
|
zh: """
|
|
|
发布或订阅时,请在所有主题前面加上 mountpoint 字符串。
|
|
发布或订阅时,请在所有主题前面加上 mountpoint 字符串。
|
|
|
|
|
|
|
|
将消息传递给订阅者时,将从主题名称中删除带前缀的字符串。挂载点是一种用户可以用来实现不同侦听器之间消息路由隔离的方法。
|
|
将消息传递给订阅者时,将从主题名称中删除带前缀的字符串。挂载点是一种用户可以用来实现不同侦听器之间消息路由隔离的方法。
|
|
|
|
|
|
|
|
-例如,如果客户机a使用`侦听器订阅` t'。tcp<名称>。mountpoint`设置为'some_tenant',那么客户端实际上订阅了主题'some_tenant/t'。</br>
|
|
|
|
|
-类似地,如果另一个客户端B(与客户端A连接到同一个侦听器)向主题“t”发送消息,该消息将路由到所有订阅了“some_租户/t”的客户端,因此客户端A将接收主题名为“t”的消息</br>
|
|
|
|
|
|
|
+例如,如果客户机 A 使用 <code>listeners.tcp.<name>.mountpoint</code> 设置为'some_tenant',那么客户端实际上订阅了主题'some_tenant/t'。</br>
|
|
|
|
|
+类似地,如果另一个客户端B(与客户端A连接到同一个侦听器)向主题 't' 发送消息,该消息将路由到所有订阅了'some_租户/t'的客户端,因此客户端 A 将接收主题名为't'的消息</br>
|
|
|
|
|
|
|
|
-设置为“”“”以禁用该功能</br>
|
|
|
|
|
|
|
+设置为<code>""</code> 以禁用该功能</br>
|
|
|
|
|
|
|
|
mountpoint 字符串中的变量:
|
|
mountpoint 字符串中的变量:
|
|
|
- <code>${clientid}</code>: clientid
|
|
- <code>${clientid}</code>: clientid
|
|
@@ -1894,12 +1961,12 @@ verification check.
|
|
|
"""
|
|
"""
|
|
|
zh: """
|
|
zh: """
|
|
|
指定要在 TLS 服务器名称指示扩展中使用的主机名</br>
|
|
指定要在 TLS 服务器名称指示扩展中使用的主机名</br>
|
|
|
-例如,当连接到“server.example.net”时,接受连接并执行TLS握手的真正服务器可能与TLS客户端最初连接到的主机不同,
|
|
|
|
|
-例如,当连接到IP地址时,或者当主机具有多个可解析的DNS记录时</br>
|
|
|
|
|
|
|
+例如,当连接到 "server.example.net" 时,接受连接并执行 TLS 握手的真正服务器可能与 TLS 客户端最初连接到的主机不同,
|
|
|
|
|
+例如,当连接到 IP 地址时,或者当主机具有多个可解析的 DNS 记录时</br>
|
|
|
如果未指定,它将默认为使用的主机名字符串
|
|
如果未指定,它将默认为使用的主机名字符串
|
|
|
-建立连接,除非使用IP地址</br>
|
|
|
|
|
|
|
+建立连接,除非使用 IP 地址</br>
|
|
|
然后,主机名也用于对等机的主机名验证
|
|
然后,主机名也用于对等机的主机名验证
|
|
|
-证书</br>特殊值“disable”阻止发送服务器名称指示扩展,并禁用主机名验证检查。
|
|
|
|
|
|
|
+证书</br>特殊值'disable'阻止发送服务器名称指示扩展,并禁用主机名验证检查。
|
|
|
"""
|
|
"""
|
|
|
}
|
|
}
|
|
|
label: {
|
|
label: {
|