或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Amazing data Kudos!
my web-site :: https://db-tv.com/
Some truly wonderful content on thjis site, thanks for contribution.
my web site: https://ematixglo.com/grade-school-online-schools-can-be/
https://ematixglo.com/grade-school-online-schools-can-be/的最新文章:https://ematixglo.com/grade-school-online-schools-can-be/
Как быстро и легально купить аттестат 11 класса в Москве
Yay google iss my king helped mee to find this great internet site!
Here iis my website … https://wik.co.kr/master4/3159796
https://wik.co.kr/master4/3159796的最新文章:https://wik.co.kr/master4/3159796
Write more, thats all I have to say. Literally, it seems as though you relied
on the video too make your point. You clearly know
what youre talking about, why throw away your intelligence on just posting videos to your weblog when you could be giving us something informative to read?
Heree is my site: https://clasificados.tecnologiaslibres.com.ec/index.php?page=user&action=pub_profile&id=52512
https://clasificados.tecnologiaslibres.com.ec/index.php?page=user&action=pub_profile&id=52512的最新文章:https://clasificados.tecnologiaslibres.com.ec/index.php?page=user&action=pub_profile&id=52512
Merely to follow up onn the up-date off this matter on your web site and wouod really want tto let you know simply how much I loved the
time you took to publish this benficial post. Within the post,
you spoke of how to really handle this thing with all convenience.
It would be my own pleasure to gather some more strategies from your web-site and come up to offer some others what I learned from you.
I appreciate your usual excellenmt effort.
My omepage – https://instituto.disitec.pe/blog/index.php?entryid=423398
https://instituto.disitec.pe/blog/index.php?entryid=423398的最新文章:https://instituto.disitec.pe/blog/index.php?entryid=423398
Hiring a dedicated roofing professional is your best bet when replacing your roof.
demo.dokit.io的最新文章:demo.dokit.io
Write more, thats all I have to say. Literally, it seems as though
you relied on the video too mak your point.
You obviously know what youre talking about, why waste your intelligence on just posting videos to your weblog when youu could be giving us something enlightening to read?
my ste … https://dethi365.vn/blog/index.php?entryid=161801
https://dethi365.vn/blog/index.php?entryid=161801的最新文章:https://dethi365.vn/blog/index.php?entryid=161801
Скачивание дополнений на смартфоны становится всё более популярным среди игроков, которые хотят добавить свои геймплей, добавляя эксклюзивные возможности, получая специальные ресурсы или делая легче путь в игре. Для многих пользователей моды с читами являются отличным вариантом получить больше радости от мобильных игр, будь то через вмешательств, облегчающих игровые задачи, или предлагающих возможности, которые в большинстве случаев были бы неразблокированы без денежных вложений.
Переходите по ссылке для информации: https://talesofafrica.org/boxer-freezy-macbones-switches-nationality-from-ghana-to-uk/
Эта практика привлекает множество геймеров, ищущих моды для мобильных игр, потому что она позволяет значительно углубить игровой опыт по сравнению со исходной версией игры.
Особенно популярны моды с читами для смартфонов, таких как симуляторы, где зрителям нужно решать вызовы или цели, которые без подобных вмешательств могут быть затруднительными или занимающими много времени.
Такие взломы зачастую внедряют читы на бесконечное здоровье, всё золото или специальные предметы, которые способствуют пользователям быстрее продвигаться по игре, не используя много средств или денежных средств.
Write more, thats all I have to say. Literally, it seems as though you relied
on the video to make your point. You clearly know what youre talking
about, why waste your intelligence on just posting videos to your weblog when you could bee giving us something informative to read?
my web blog: http://web004.dmonster.kr/bbs/board.php?bo_table=b0402&wr_id=1015943
http://web004.dmonster.kr/bbs/board.php?bo_table=b0402&wr_id=1015943的最新文章:http://web004.dmonster.kr/bbs/board.php?bo_table=b0402&wr_id=1015943
Wow, wonderful blog structure! How lengthy
have you ever been running a blig for? you mmake blogging glance easy.
The full glance of your ite is fantastic, as weell as the
content material![X-N-E-W-L-I-N-S-P-I-N-X]I just could not go away your web site before suggesting
that I extremely enjoyed the standard info a person supply
on your visitors? Is gonna be again ceaselessly in order to investigate cross-check
new posts.
Also visit my web site: https://dytran.co.kr/html/bbs/board.php?bo_table=02_board&wr_id=93053
https://dytran.co.kr/html/bbs/board.php?bo_table=02_board&wr_id=93053的最新文章:https://dytran.co.kr/html/bbs/board.php?bo_table=02_board&wr_id=93053
There is clearly a bundle too identify about this. I assume you made various good
points inn features also.
Feel frfee to visit my page … https://elainmaa.fi/get-in-touch-with-us-for-more-information/
https://elainmaa.fi/get-in-touch-with-us-for-more-information/的最新文章:https://elainmaa.fi/get-in-touch-with-us-for-more-information/
Joining A Travel Club 수원가라오케, championsleage.review,
championsleage.review的最新文章:championsleage.review
среднее образование диплом купить
Immerse yourself in the world of cutting-edge technology with the global version of the POCO M6 Pro, which combines advanced features, stylish design, and an affordable price. This smartphone is designed for those who value speed, quality, and reliability.
Why is the POCO M6 Pro your ideal choice?
– Powerful Processor: The octa-core Helio G99-Ultra delivers lightning-fast performance. Gaming, streaming, multitasking—everything runs smoothly and without lag.
– Stunning Display: The 6.67-inch AMOLED screen with FHD+ resolution (2400×1080) and a 120Hz refresh rate offers incredibly sharp and vibrant visuals. With a touch sampling rate of 2160 Hz, every touch is ultra-responsive.
– More Memory, More Possibilities: Choose between the 8/256 GB or 12/512 GB configurations to store all your files, photos, videos, and apps without compromise.
– Professional Camera: The 64 MP main camera with optical image stabilization (OIS), along with additional 8 MP and 2 MP modules, allows you to capture stunning photos in any conditions. The 16 MP front camera is perfect for selfies and video calls.
– Long Battery Life, Fast Charging: The 5000 mAh battery ensures all-day usage, while the powerful 67W turbo charging brings your device back to life in just a few minutes.
– Global Version: Support for multiple languages, Google Play, and all necessary network standards (4G/3G/2G) makes this smartphone universal for use anywhere in the world.
– Convenience and Security: The built-in fingerprint sensor and AI-powered face unlock provide quick and reliable access to your device.
– Additional Features: NFC, IR blaster, dual speakers, and IP54 splash resistance—everything you need for a comfortable experience.
The POCO M6 Pro is not just a smartphone; it’s your reliable companion in the world of technology.
Hurry and grab it at a special price of just 15,000 rubles! Treat yourself to a device that impresses with its power, style, and functionality.
Take a step into the future today—purchase it on [url=https://ify.ac/1Y26]AliExpress[/url]!
hi!,I like your writing very a lot! share we keep up a correspondence more approximately your post on AOL?
I require an expert on this house to resolve my problem. Maybe that is
you! Taking a look ahead to look you.
my web blog – Casino79
Casino79的最新文章:Casino79
Some truly interesting info, well written and broadfly
user pleasant.
Feel free tto visit my web page: https://world51tech.com/index.php/2025/02/20/for-learn-with-this/
https://world51tech.com/index.php/2025/02/20/for-learn-with-this/的最新文章:https://world51tech.com/index.php/2025/02/20/for-learn-with-this/
Greetings, I believe your site may be having browser compatibility
problems. Whenever I look at your website in Safari, it looks fine
however, if opening in IE, it has some overlapping issues.
I just wanted to give you a quick heads up! Other than that, excellent blog!
my webpage: ยูฟ่า คาสิโน
ยูฟ่า คาสิโน的最新文章:ยูฟ่า คาสิโน
Aw, this was a very good post. Finding the time and actual effrt
to produce a superb article? but what can I say? I procrastinate
a whole lot and never seem to get nearly anyyhing done.
My web-site: https://www.storyspritz.com/2025/02/23/all-need-about-know-internet-based-homeschool-courses-your-confidentiality-homeschool-programs/
https://www.storyspritz.com/2025/02/23/all-need-about-know-internet-based-homeschool-courses-your-confidentiality-homeschool-programs/的最新文章:https://www.storyspritz.com/2025/02/23/all-need-about-know-internet-based-homeschool-courses-your-confidentiality-homeschool-programs/
подарок массаж
подарок массаж的最新文章:подарок массаж
Merely to follow up on the up-date of this theme
on your website and would wish too let you know how much I
liked the time you took to generate this beneficial post. Within the post, you actually spoke
regarding how to really handle thi tthing with all convenience.
It would be my personal plpeasure to gget some more suggestions
from your website and come as much as offer other folks
what I have learned ffom you. Thank you for your usual fantastic effort.
Here is my blog: https://dytran.co.kr/html/bbs/board.php?bo_table=02_board&wr_id=93010
https://dytran.co.kr/html/bbs/board.php?bo_table=02_board&wr_id=93010的最新文章:https://dytran.co.kr/html/bbs/board.php?bo_table=02_board&wr_id=93010
Thajks very interesting blog!
Visit myy blog … http://thankyou.eoapps.co.kr/bbs/board.php?bo_table=free&wr_id=2253723
http://thankyou.eoapps.co.kr/bbs/board.php?bo_table=free&wr_id=2253723的最新文章:http://thankyou.eoapps.co.kr/bbs/board.php?bo_table=free&wr_id=2253723
There is cledarly a bunch to know about this. I feel you made certan nice points in features also.
My homepage: https://homeambient.mx/hardware/primary-online-schools-can-be-about/
https://homeambient.mx/hardware/primary-online-schools-can-be-about/的最新文章:https://homeambient.mx/hardware/primary-online-schools-can-be-about/
I reckon something genuinely special in this site.
Review my webpage … https://sewazoom.com/home-education-programs-ways-you-can-enroll-your-student-through-our-very-own-accredited-study-plan-data-protection-policy-is-strictly-maintained-obtain-quality-in-with-our-own/
https://sewazoom.com/home-education-programs-ways-you-can-enroll-your-student-through-our-very-own-accredited-study-plan-data-protection-policy-is-strictly-maintained-obtain-quality-in-with-our-own/的最新文章:https://sewazoom.com/home-education-programs-ways-you-can-enroll-your-student-through-our-very-own-accredited-study-plan-data-protection-policy-is-strictly-maintained-obtain-quality-in-with-our-own/
For instance, a game with an RTP of 97% will trend towards paying out $97 for just about every $100 bet.
My website: http://gitea.yunshanghub.com:8081/roseword329819/sports-toto-sites-6398/wiki/Discover-Toto79.in%3A-The-Ultimate-Scam-Verification-Platform-for-Korean-Sports-Betting
I am not real great with English but I come up this real easy
to interpret.
My web site :: https://cursoslazostv.com/index.php/2025/02/20/educating-at-home-adviceparents/
https://cursoslazostv.com/index.php/2025/02/20/educating-at-home-adviceparents/的最新文章:https://cursoslazostv.com/index.php/2025/02/20/educating-at-home-adviceparents/
Excellent weblog right here! Also your website lods up fast!
What hkst are you the use of? Can I am getting your affiliate link for your host?
I wish my website loaded up as quicckly as yours lol
My blog post https://www.maratone.com/our-of-homeschooling/
https://www.maratone.com/our-of-homeschooling/的最新文章:https://www.maratone.com/our-of-homeschooling/
Write more, thaats all I have to say. Literally, it seems as though you relied
on the video to make your point. You definitely
know what youre talking about, why throw away your intelligence on just posting videos to your blog when you could be giving us
something informative to read?
My page: https://www.tobeop.com/commence-toof/
https://www.tobeop.com/commence-toof/的最新文章:https://www.tobeop.com/commence-toof/
To follow up on the updaqte of this subject oon your web page and want to let you know how much
I appreciated the time you tlok to generate this handy post.
In the post, you spoke on how to definitely handle this thing with all convenience.
It would be my owwn pleasure to build up some more strategies from your website and come up to offer some others what
I have learned from you. I appreciate your usual terrific effort.
Feel free to visit my blog post – http://www.djsink.bizweb.kr/bbs/board.php?bo_table=qna&wr_id=165092
http://www.djsink.bizweb.kr/bbs/board.php?bo_table=qna&wr_id=165092的最新文章:http://www.djsink.bizweb.kr/bbs/board.php?bo_table=qna&wr_id=165092
Thanks for the auspicious writeup. It in reality was a enjoyment account it.
Look complicated to far added agreeable from you!
However, how could we keep in touch?
deep seek的最新文章:deep seek
диплом купить в архангельске
Somme genuinely fantastic blog posts on this site,
appreciate it for contribution.
Here is my site: https://clil4yec.eu/advantages-of-home-education/
https://clil4yec.eu/advantages-of-home-education/的最新文章:https://clil4yec.eu/advantages-of-home-education/
Whoa quite a lot of awesome information!
Stop by my blog post Evolution Casino (https://git.jerl.zone/glenwilmer1371)
Hi! I simply wish to offer you a big thumbs up for your great information you’ve got
here on this post. I am coming back to your site for more soon.
crypto casinos的最新文章:crypto casinos
To follow up on the up-date of this topic on your website and would want to let you know simply how much I treasured the time you tok to create this beneficial post.
In the post, you really spoke of how to truly handle this problem with all ease.
It would be my pleasure to geet some more thoughts from your web page and
come as much as offer other folks what I have learned from you.
Many thanks for your usual wonderful effort.
Here iss mmy website: http://www.yogatherapy.kwk114.com/bbs/board.php?bo_table=qna&wr_id=84761
http://www.yogatherapy.kwk114.com/bbs/board.php?bo_table=qna&wr_id=84761的最新文章:http://www.yogatherapy.kwk114.com/bbs/board.php?bo_table=qna&wr_id=84761
Heya i am for the first time here. I came across this board and I find
It really useful & it helped me out much. I’m hoping to provide something
back and help others like you aided me.
play level devil 2的最新文章:play level devil 2
Arranging Ideal Budget Wedding 여수가라오케
여수가라오케的最新文章:여수가라오케
There is obviously a lot to know about this.
I consider you made certain nice points in features also.
my webpage – https://qodsic.com/pupils-more-with-the/
https://qodsic.com/pupils-more-with-the/的最新文章:https://qodsic.com/pupils-more-with-the/
Гарантия на все сантехнические работы – услуги сантехника для вашего удобства
вызов сантехника на дом спб http://www.santehniknadom-spb.ru/ .
Thank you, I have just been looking for information about this topic for a while
and yours is the best I’ve came upon so far.
But, what concerning the conclusion? Are you certain in regards
to the supply?
Vehicle database的最新文章:Vehicle database
I’d like to thank you for the efforts you have put in writing this website.
I really hope to view the same high-grade content by you in the
future as well. In truth, your creative writing abilities has motivated me to get
my own, personal site now 😉
My blog post: слово пацанки 1 серия
слово пацанки 1 серия的最新文章:слово пацанки 1 серия
5 A Person Need In Order To Provide A Perfect Massage 서울가라오케
서울가라오케的最新文章:서울가라오케
Скачивание дополнений на смартфоны становится всё более популярным среди геймеров, которые хотят персонализировать свои игровой опыт, встраивая эксклюзивные возможности, открывая платные функции или облегчая путь в игре. Для многих пользователей моды с читами являются отличным способом получить больше фана от видеоигр, будь то при помощи нововведений, делающих легче игровой процесс, или предоставляющих привилегии, которые в большинстве случаев были бы закрыты без вложения средств.
Переходите по ссылке для информации: https://www.c2088.cn/home.php?mod=space&uid=66651&do=profile
Эта традиция привлекает множество пользователей, ищущих моды для мобильных игр, потому что она делает возможным значительно увеличить время в игре по сравнению со исходной версией игры.
Особенно актуальны моды с читами для игр на Android, таких как шутеры, где пользователям нужно преодолевать сложные уровни или цели, которые без подобных взломов могут быть слишком трудными или затратными по времени.
Такие дополнения зачастую предоставляют читы на вечное здоровье, бесконечные ресурсы или получение специальных предметов, которые способствуют пользователям развиваться по приключениям, не потребляя огромное количество времени или финансовых вложений.
Learning Massage – Investigate The Best Study Programs
인천가라오케 – https://cameradb.review –
https://cameradb.review的最新文章:https://cameradb.review
I’m not sure where you are getting your information, but great topic.
I needs to spend some time learning much more or understanding more.
Thanks for magnificent info I was looking for this information for my mission.
my web page: Vacuum Truck
Vacuum Truck的最新文章:Vacuum Truck
Why people still make use of to read news papers when in this technological globe all is existing on web?
My blog post :: слово пацанки 2024
слово пацанки 2024的最新文章:слово пацанки 2024
Скачивание взломов на мобильные устройства становится всё более популярным среди игроков, которые хотят добавить свои геймплей, встраивая расширенные опции, включая внутриигровые ресурсы или облегчая геймплей. Для многих пользователей моды с читами являются отличным методом получить больше интереса от гейминга, будь то с помощью нововведений, делающих легче игровой процесс, или предлагающих возможности, которые в стандартной игре были бы неактивны без внесения платы.
Переходите по ссылке для информации: http://www.aragaon.net/bbs/board.php?bo_table=review&wr_id=1091805
Эта привычка привлекает множество любителей игр, ищущих моды для мобильных игр, поскольку она позволяет значительно расширить приключения в игре по сравнению со неизмененной версией игры.
Особенно запрашиваемы моды с читами для игровых приложений, таких как стратегии, где фанатам игр нужно решать сложные уровни или результаты, которые без подобных взломов могут быть чрезвычайно сложными или затратными по времени.
Такие модификации зачастую внедряют читы на бесконечное здоровье, бесконечные деньги или эксклюзивные ресурсы, которые ускоряют пользователям прогрессировать по задачам, не теряя большие ресурсы или денежных средств.
Cover letter generator with LinkedIn profile integration
cover letter converter http://createcoverletterfree.com/ .
Купить диплом бакалавра в Москве
купить диплом о среднем специальном