或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
It’s amazing how pressure washing can remove years of grime in just a few hours! Govee RGBIC Lights Setup by Tampa Bay Pressure Washing
I cannot express enough gratitude towards those involved throughout every aspect leading up until finally receiving beautiful new replacements—that’s right folks…#DentalImplants# received courtesy skilled h dental surgery
Couldn’t be happier walking away feeling satisfied after collaborating closely alongside team members from GSVison!!# # anyKeyWord## cutting-edge real estate visuals
Priority Restoration did an amazing job with my water damage clean up near me. Highly recommend their services!
I had a fantastic experience with Priority Restoration Philadelphia Water Damage Restoration Near Me
participants of the game can highly see its unpretentiousness in maintenancehttp://www.auserprovincialenovara.it/?p=18544 betwinner – after all they often provide immediate high, and a first-class experience.
“Just obtained my first set of Nang cylinders and I’m already in love—can’t wait to scan greater from tricks located on cost-effective nang options !”
Interested in understanding the impact of mindfulness practices on leadership effectiveness via # anYKeYwOrk resources! Leadership coaching san francisco
The quality of product and service at nang delivery melbourne nangsta is unbeatable! Best nang delivery in Melbourne hands down.
Moving across long distances can be daunting! I hope to find reliable long distance movers in Ochopee. Cheap movers Ochopee
Planning a big family move soon? Don’t forget to book some awesome local movers in Nokomis to help out! Best Nokomis movers
Just moved my small business with an office moving company in Longboat Key, and it was a breeze! Longboat Key moving company
Nang Can offers such diversity in experiences—check out recommendations at nang tanks !
“So glad I found great resources like ### when searching for #LakelandMovers!” Office moving companies Lakeland
If you need help relocating within Winter Garden, look no further than Winter Garden moving company ! They are the best!
Thanks for the detailed post. Find more at abogados Vigo .
I found this very interesting. For more, visit Xtreme Fence .
Thanks for the detailed post. Find more at https://maps.app.goo.gl/TBMiJ7PapKD7MVTQA .
Smart Vision has transformed my approach to security with its excellent video surveillance software capabilities. The AI-powered features for detecting people, cats, dogs, and birds are incredibly useful, giving me peace of mind. It functions as a reliable IP camera recorder, and the time-lapse function adds an extra layer of utility. This software is a superb VMS choice, blending ease of use with powerful functionality. If you’re looking for the best video surveillance options to protect your property, I highly recommend it. smartvision video surveillance software with object detection
I found this very interesting. Check out https://youtu.be/IOSzmflsdfU for more.
Thanks for the useful suggestions. Discover more at casas rurales en Segovia .
Valuable information! Find more at https://youtu.be/IOSzmflsdfU .
Thanks for the valuable article. More at dog vaccinations .
“It’s essential that companies invest time and resources into building their brands—hopefully, that includes Agent Autopilot!” authoritative health insurance leads by agent autopilot
I liked this article. For additional info, visit Roof replacement near me .
Do you mind if I quote a few of your articles as long
as I provide credit and sources back to your website?
My blog is in the exact same niche as yours and my visitors would genuinely benefit
from a lot of the information you provide here. Please let me
know if this okay with you. Cheers!
penis enlargement的最新文章:penis enlargement
The importance of local SEO cannot be overstated. Thanks for shedding light on this topic, ##anyKeyword##!
I am sure this post has touched all the internet
users, its really really nice paragraph on building up new blog.
Tollywood Box Office Collection的最新文章:Tollywood Box Office Collection
I enjoyed this post. For additional info, visit iSOS Tech .
If you want your home to look stunning, contact Austin Painting & Cabinets for all your painting needs! exterior house painters near me
Appreciate the thorough write-up. Find more at https://www.collegeandmagnolia.com/users/Pet_Medical_Center/ .
This was quite informative. More at https://maps.app.goo.gl/gygB8dp8FBKdWNGf9 .
Thanks for the helpful article. More like this at architects nearby .
Clearly presented. Discover more at https://www.sbncollegehockey.com/users/Sunshine_Water/ .
Simply wish to say your article is as amazing. The clearness on your publish
is simply great and that i could suppose you are an expert
on this subject. Well together with your permission allow me
to grab your feed to stay up to date with impending
post. Thanks a million and please continue the gratifying work.
Tollywood Box Office Collection的最新文章:Tollywood Box Office Collection
Khám Phá Những Trò Chơi Mới Mẻ Hấp Dẫn Tại Sân Chơi # # b 5 2 # b52 club
“Hats off towards everyone involved throughout process; couldn’t ask better companions as we create together moving forward! trusted real estate photo stylists
Thanks for the insightful write-up. More like this at https://maps.app.goo.gl/5vdkAeZ2xkf7tU4t8 .
This was very beneficial. For more, visit kitchen remodeling services .
Valuable information! Discover more at Roofing Billings .
Thanks for the useful suggestions. Discover more at plumbers St Louis Park .
Thanks for the insightful write-up. More like this at https://maps.app.goo.gl/VwErVZZZ7ckkiYJM7 .
Thanks for the informative post. More at https://maps.app.goo.gl/GnFiuXoR6vcPjQ3C8 .
This was a wonderful guide. Check out https://www.openstreetmap.org/user/Blue%20Peaks%20Roofing%20LLC for more.
Great tips! For more, visit https://maps.app.goo.gl/Py8wNNmgL9mRkkLm7 .
“You can’t beat the expenditures at ###anDeliveryMelbourne###; such mammoth cost!” nang cylinders Melbourne
This was quite informative. For more, visit https://maps.app.goo.gl/3CR21VxBxNYu4iqQ9 .
Leadership authenticity can boost morale—what strategies does # anYKeYwOrk offer for cultivating it? Leadership coaching san francisco
The charm of having unique designer cabinets is undeniable; they add so much character to any room makeover—get inspired by various styles here: custom countertops !
Thankful meeting brilliant minds dedicated changing world inspiring others join cause embark adventures meant create differences matter positively impacting lives lift spirits raise awareness tackling urgent matters affecting communities cash for junk cars Fort Myers FL
This article sheds light on Nang Gun beautifully! For a deeper understanding, visit nang tanks .