或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Are your windows looking dull? Call up King of Gleam; they truly know how to bring back the shine!!! # # anyKeyWord# # Window Cleaning Fort Collins
I’ve read several excellent stuff here. Certainly value bookmarking for revisiting.
I surprise how so much effort you set to make this sort of magnificent informative site.
mitolyn reviews and complaints reddit的最新文章:mitolyn reviews and complaints reddit
Thanks for the clear advice. More at tienda colchones Albacete .
What a fantastic post! I’ve been considering chiropractic care in Dallas and will check out Auto accident injury clinic
Very informative piece discussing the significance of collaboration with professionals in the field—I’m eager to connect with ### anyKeyWord### https://quebeck-wiki.win/index.php/Proven_Off-Page_Link_Building_Techniques_for_Dublin_Businesses
What an engaging read about the evolution of real estate—thank you for sharing your knowledge! realtors
Virtual gambling platforms have modernized the betting industry, providing an exceptional degree of comfort and breadth that conventional gambling houses are unable to replicate. Recently, a vast number of enthusiasts around the world have turned to the fun of virtual gambling because of its anytime, anywhere convenience, exciting features, and continuously increasing catalogs of games.
If you’re unfamiliar with the world of online gaming or seek to discover trusted platforms, why not engage with our lively gaming forum? It’s a platform where fans offer reviews, guiding you to maximize your online casino experience. Discover the community and see it here now:
One of the biggest attractions of online casinos is the incredible variety of gaming experiences on offer. Whether you enjoy engaging with retro slots, exploring story-driven thematic slots, or strategizing in classic casino games like Texas Hold’em, casino websites offer numerous entertainment avenues. A large number of platforms even present live gaming streams, making it possible for you to connect with live hosts and gaming peers, all while soaking in the immersive vibes of a traditional gambling venue from the comfort of your home.
Beyond variety, virtual gambling platforms shine availability.
Медицинская помощь при зависимости в современной наркологической клинике
клиника наркологическая http://platnaya-narkologicheskaya-klinika-01.ru/ .
Appreciate the thorough analysis. For more, visit pittsburgh gutters .
Fantastic read! I’m eager to consult with a trusted Fencing Company Washington State for my home improvement project
в частности, https://www.makecoworking.com.br/index.php/2025/03/27/kupit-diplom-v-nazrani/ должны быть под рукой кандидаты на расходные специальности. Современные взгляды абитуриентов нередко заключаются в тому, что люди не готовы тратить годы на получение теоретических сведений в вузе, а предпочитают овладеть практическими опытом, и сразу устроиться на работу.
How does everyone feel about using rubber membranes on their flat roofs? Are they worth it? Let’s discuss comparisons on this topic over at flat roofing contractor !
Shipping your vehicle doesn’t need to be stressful; just go with the pros at Baltimore auto transport
Your conversation on the relevance of a strong structure was spot-on! It’s essential for the long life of any type of structure. For more expert guidance, take a look at masonry contractor .
The aeronautics market is actually quickly progressing, consequently are actually the financing remedies on call for aircraft acquisitions. It is very important to keep improved on the most up to date patterns affordable aircraft financing
Замена смесителей, унитазов и раковин в СПб – прайс на сантехнические работы
вызов сантехника на дом стоимость услуги [url=http://remont-santehniki-price.ru/]http://remont-santehniki-price.ru/[/url] .
Sculpted MD transformed my life with their medical weight loss program!
I found the best medical weight loss near me at Sculpted MD!
Sculpted MD in Highlands Ranch CO offers incredible medical weight loss solutions Weight loss therapy near me
Sculpted MD helped me regain my energy levels with their effective testosterone therapy!
The best testosterone therapy near me is definitely at Sculpted MD.
Feeling revitalized thanks to Sculpted MD’s testosterone therapy in Aurora CO Sculpted MD testosterone therapy experts near Aurora
Sculpted MD transformed my life with their medical weight loss program!
I found the best medical weight loss near me at Sculpted MD!
Sculpted MD in Highlands Ranch CO offers incredible medical weight loss solutions Sculpted MD Highlands Ranch CO weight loss program
Sculpted MD has transformed my life with their amazing semaglutide treatments!
I had an incredible experience at Sculpted MD getting semaglutide near me Parker weight loss clinics
Looking forward to seeing more beautiful homes listed on cash home buyers
If you need to transport your vehicle in New Mexico, NM, definitely consider Albuquerque car shipping
Thank you for clarifying the closing process; it can be confusing without proper guidance – very helpful indeed! Learn about closing steps at we buy houses sacramento !
Preferir empresas dedicadas exclusivamente al sector ayudará fomentar mejores prácticas dentro del ámbito tecnológico relacionado específicamente hacia Drones.#Anykeyword# Reparación de motor de drones
“I never realized how much paperwork goes into closing until I experienced it firsthand; let’s share tips regarding handling it through# # anyKeyWord#!” cash home buyers
Качественная замена стояков и труб в СПб – актуальные прайс лист услуг сантехника
услуги сантехника стоимость https://24-santehniki-price.ru/ .
I found this very helpful. For additional info, visit ##Bic Construction##. Basement Finishing Castle Pines
Night creams seem to work wonders while we sleep—what’s your favorite one to use? microneedling benefits for skin
The Injury Recovery Center has been a lifesaver for my back pain!
I can’t believe the difference a chiropractor makes at the Injury Recovery Center!
Looking for a chiropractor near me led me to the amazing team at Injury Recovery Center Injury recovery specialist in Lakewood
Nicely done! Find more at año escolar Irlanda .
Paxos Electric Company LLC delivered exceptional service as my go-to commercial electrician Wharton NJ lighting installation
Such valuable information on the role of chiropractic care in overall wellness! Definitely seeking out a Tacoma chiropractor now! Chiropractor Tacoma
Paxos Electric Company LLC delivered exceptional service as my go-to commercial electrician Wharton NJ electrical contractors
My friend recommended Cat Nail Trimming Las Vegas and I’m so glad she did—my cat has never looked better!
Die Rohrreinigung in Gießen ist ein wichtiges Thema, das oft unterschätzt wird. Wenn man Probleme mit verstopften Rohren hat, sollte man schnell handeln, um größere Schäden zu vermeiden Rohrreinigung Gießen
It’s reassuring to know that there are skilled local accountants ready to assist small business owners like myself—thank you for highlighting this topic! accountancy services
Dr. Fisher’s Medical Weight Loss Centers have been a game changer for me with their Semaglutide program!
I’m thrilled with the results from Dr. Fisher’s Semaglutide program, especially here in Philadelphia, PA Find weight loss medication in Philadelphia
Digital casinos have reshaped the casino gaming scene, delivering an unmatched level of ease and breadth that conventional casinos don’t provide. Recently, a large audience around the world have chosen the fun of virtual gambling in light of its always-open nature, appealing qualities, and constantly growing catalogs of games.
If you’re a beginner with the world of virtual gambling or would like to learn about proven options, why not sign up for our dynamic interactive platform? It’s a destination where enthusiasts post tips, guiding you to get the most out of your gaming journey. Explore the experience and learn more now:
One of the most compelling reasons of online gaming options is the sheer range of gaming experiences at your disposal. Whether you enjoy engaging with old-school slots, trying out story-driven video slots, or playing smart in traditional table offerings like poker, virtual venues boast endless options. Several sites also present interactive dealer games, letting you to participate with professional croupiers and gaming peers, all while taking in the lifelike ambiance of a traditional gambling venue in your own space.
In addition to diversity, online casinos shine ease of access.
What’s your fashionable feature on your leased SUV which you couldn’t live devoid of? Share your emotions! suv for lease near me
The professionalism displayed by the crew at LJR Tree Services is truly commendable!” emergency tree service san jose
I fully concede that customer care creates a substantial distinction when picking an auto body shop. It is actually great to find businesses that prioritize their customers. If you need fixings, I encourage seeing tesla body shop for outstanding solution.
. Today’s society places heavy emphasis upon appearance—which makes professional assistance invaluable during such times constantly evolving trends occur!!!! https://insightsalonerie.com/
I entirely concur that client service makes a big distinction when choosing an auto body shop. It’s terrific to observe businesses that prioritize their clients tesla collision center
It is actually excellent to observe additional dialogues regarding the importance of security personnel in TX. They participate in an important job in keeping our areas secure! Have a look at security guards austin for more information.
O’zbekistonda barcha uylar uchun energiya tejamkorligi zarur!!! Quyosh paneli har bir uyda bo’lishi kerak!!! ###Anykeyword### http://212.109.221.174/user/haburtoein
Exactly how perform you find the most ideal shaded seats in a stadium? It can be difficult often! Thankfully, I found out some useful tactics at overview of shaded seating options that cost sharing.
It is actually excellent to find even more dialogues concerning the usefulness of security guards in TX. They play a vital job in maintaining our communities safe and secure! Look into security guards dallas to find out more.
Thanks for the helpful article. More like this at loan agency new orleans .
This was a fantastic read. Check out implantologia warszawa for more.
Mental health is thus crucial, specifically in a hectic metropolitan area like New York. See therapist nyc to find out counselors that suit your needs wonderfully!