或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Great insights here about renting dumpsters in Orlando! Definitely going to explore pricing at javis orlando dumpster booking .
Love how different textures can enhance painted surfaces—has anyone experimented with this? interior painters near me
Painting trim can really enhance the overall look of a house. Love the ideas provided! house painters
Научись читать
4. Confirm access using the button specially created for http://schmooze.fr/discovering-1win-pro-your-comprehensive-guide-to/ on 1win. First goalscorer: Predict which player will score the first goal of the match.
Ready eager anticipating upcoming collaborations fostering growth opportunities arising throughout these ongoing dialogues shared openly here among peers alike!!!! Together we’ll flourish!!!!!#### anyKeyWord##### san jose ca tree service
Bonukset ja kampanjat – loistava pelialusta kaikille kasinofilteille.
MostBet Casino
MostBet Casino的最新文章:MostBet Casino
Enjoying quality time during our family movie nights has been made effortless, all thanks to the extensive range of movies available on Bibmax!! Bibamax
Mostbet AZ – inanılmaz təklifdir mobil tətbiqdən istifadə etmək sevənlər üçün.
mostbet azerbaycan
mostbet azerbaycan的最新文章:mostbet azerbaycan
Your blog post provides excellent insights into the qualities to look for in a roof contractor in Carlsbad. I’m grateful for the recommendation of roof leak repair – they tick all the boxes!
Mostbet Pakistan – quick withdrawals.
Mostbet Pakistani bettors的最新文章:Mostbet Pakistani bettors
Every time I need a dumpster, I turn to javis residential garbage services —they never disappoint!
The Appeal of Online Gambling
There are many reasons why online casinos have gained massive traction. A key benefit is that online casinos are available anytime, anywhere. Unlike traditional brick-and-mortar casinos, virtual casinos allow you to play whenever it suits you best.
One of the strongest attractions is the enormous range of gaming options available. Physical casinos may offer a few hundred games at best, but digital platforms feature thousands. Players can enjoy everything from nostalgic one-armed bandits to modern 3D slots packed with special features. Stay updated with the latest casino news, exclusive bonuses, and expert tips—follow us here! – http://www.mymcs.org/dev/1win-casino-y-casa-de-apuestas-explorando-las-opciones-de-entretenimiento-y-juegos-de-azar/
How Online Casinos Keep Players Engaged
The abundance of promotions is one of the key benefits of playing at online casinos. Many platforms offer newcomers fantastic welcome packages, boosting their bankroll instantly. Loyal customers are rewarded with tiered programs, reloading bonuses, and special incentives. Not all casino games are about luck—some demand strategic thinking and expertise. In games like poker, knowledge and tactics can give players a significant edge over less experienced opponents. If you prefer a fast-paced, unpredictable experience, slots and roulette provide thrilling, luck-based gameplay.Finding a Secure and Fair Casino
To ensure a positive experience, it’s vital to play responsibly and within limits. Smart bankroll management and self-control help players maintain a healthy approach to gambling. Licensed casinos provide responsible gambling measures, such as cooling-off periods and withdrawal restrictions, to help players stay in control. Have you played at an online casino before? What was your experience like? Share your thoughts and experiences in the comments below!
I love learning about tree health and care—LJR Tree Services sounds like a great resource in my area! arborist services san jose
”An open mind receptive toward possibilities lies ahead paired willingness adjust accordingly ensures longevity sustainability ultimately paving pathways success previously thought unreachable previously – grateful opportunity presented here connect agent autopilot insurance automation
VIP Cleaners & Laundry always exceeds my expectations with their alterations near me!
I love getting my clothes altered at VIP Cleaners & Laundry in San Diego CA!
VIP Cleaners & Laundry is my go-to for perfect alterations!
Alterations near me have CA
VIP Cleaners & Laundry always exceeds my expectations with their alterations near me!
I love getting my clothes altered at VIP Cleaners & Laundry in San Diego CA!
VIP Cleaners & Laundry is my go-to for perfect alterations!
Alterations near me have San Diego laundry service
I had an incredible experience at the Dental Group of Beverly Hills! The best dentist I’ve ever visited!
If you’re looking for a dentist near me Dental Group of Beverly Hills pain-free dentistry
Присоединяйтесь к Mostbet прямо сейчас и выигрывайте
призы . mostbet зеркало
mostbet зеркало的最新文章:mostbet зеркало
I had a wonderful experience at Visual Eyes Optical Inc!
The eye doctor at Visual Eyes Optical Inc was incredibly helpful where to find optometrists in Stanhope
I had an incredible experience at the Dental Group of Beverly Hills! The best dentist I’ve ever visited!
If you’re looking for a dentist near me dental consultation Beverly Hills
If you’re looking for local support groups for dementia, there are great listings at palliative care !
Thanks for shedding light on this topic! I didn’t realize how often I should consider καλές αποφραξεισ .
Self garage maintains my workspace geared up and clutter-loose; thanks to the crew at self storage !
Daniella Levi & Associates, P.C. are the best car accident lawyers I’ve ever worked with!
If you’re in the Bronx, this car accident lawyer is truly exceptional!
I found the perfect car accident lawyer near me at Daniella Levi & Associates, P.C Find Bronx car accident lawyer
Smyle Dental Bakersfield provided the best emergency dentist service I’ve ever experienced!
I was so relieved to find an emergency dentist near me like Smyle Dental Bakersfield Smyle Dental Bakersfield teeth whitening
Thanks for the valuable article. More at pool contractors near me .
Who else loves naan bread? It’s a staple that makes Indian dining so enjoyable! spokane indian cuisine
BaninngConstructionInc provided exceptional workmanship on our project; couldn’t be happier!!! ### anyKeyWord ### home remodeling contractors near me
The Attack On Titan Transformation Manuscript is fully insane!
Makes grinding so much faster and more fun. Easiest temperament to evade ODM gear upgrades and titan kills without stressing.
Arleen的最新文章:Arleen
I’ve never felt better since visiting North Atlanta Chiropractic Center! They’re the best chiropractor in town.
North Atlanta Chiropractic Center is my go-to chiropractor in Duluth North Atlanta Chiropractic Center hours
Walter’s BBQ Southern Kitchen serves the best brunch I’ve ever had in Pittsburgh PA!
The brunch at Walter’s BBQ Southern Kitchen is absolutely delightful and always makes my weekend better Walter’s BBQ Southern Kitchen location
“Wonderful tips on enhancing outdoor spaces; hoping my collaboration with a ### anyKeyw### goes smoothly!” Deck builder
Walter’s BBQ Southern Kitchen serves the best brunch I’ve ever had in Pittsburgh PA!
The brunch at Walter’s BBQ Southern Kitchen is absolutely delightful and always makes my weekend better Walter’s BBQ Southern Kitchen brunch hours
Reasons Why Online Casinos Are Booming
There are many reasons why online casinos have gained massive traction. A key benefit is that online casinos are available anytime, anywhere. While land-based casinos have restrictions, internet-based casinos never close, ensuring round-the-clock entertainment.
The vast selection of games also contributes to the widespread appeal. Traditional casinos are often limited by space, but online platforms can host thousands of different games. Whether you love old-school slots or cinematic video games, there’s something for everyone. Want to get the hottest casino updates and promotions? Click here to follow us! – https://www.apkgalaxsi.com/1win-descubre-los-increibles-bonos-y-juegos-en-el-casino-online/
How Online Casinos Keep Players Engaged
The abundance of promotions is one of the key benefits of playing at online casinos. Signing up usually comes with exciting perks like extra cash or free slot spins. Loyal customers are rewarded with tiered programs, reloading bonuses, and special incentives. While many casino games are based purely on luck, some require skill and strategy. In games like poker, knowledge and tactics can give players a significant edge over less experienced opponents. For those who want quick and easy entertainment, luck-based games like slots deliver pure adrenaline.Responsible Gambling & Choosing a Safe Casino
While online casinos offer fun and potential winnings, responsible gambling is crucial. Smart bankroll management and self-control help players maintain a healthy approach to gambling. Trustworthy sites encourage responsible play through features like voluntary betting caps and time-out options. Are you an online casino enthusiast? What’s your go-to game? Drop your opinions and stories in the discussion thread!
Natural sunscreen is a game changer for me! Glad to work out greater americans talking about it! men’s skincare tips
Your analysis regarding the future trends in digital marketing was very insightful; staying ahead with agencies like Social Cali of Rocklin makes a difference—visit them at ppc advertising agency !
True Balance Pain Relief Clinic & Sports Massage offers the best sports massage I’ve ever experienced!
I always leave True Balance Pain Relief Clinic & Sports Massage feeling refreshed and rejuvenated Pain relief and sports massage near me
Don’t enable a inaccurate sizzling water heater break your day! Contact Plumber Como for swift and safe maintenance in Perth. They’ll have your scorching water flowing lower back very quickly.
The biryani served at this Indian restaurant near me is so fragrant and flavorful. Can’t wait to try it out at indian lunch buffet spokane .
Really appreciate all effort put into creating such thorough resources surrounding topics like Roofing Companies’ reliability/trustworthiness!!! # # any Keyword # # residential roofing
This was an enlightening read about overcoming barriers in lead conversion rates! Consider using platforms like Agent Autopilot to facilitate better performance—check it out at agent autopilot reputable insurance marketing !
This was very well put together. Discover more at albergue en palas de rei .
Workhorse Sports Performance has transformed my fitness journey with their exceptional personal training services!
I’m thrilled with the progress I’ve made at Workhorse Sports Performance in Sparta Sparta NJ workout sessions guidance
Workhorse Sports Performance has transformed my fitness journey with their exceptional personal training services!
I’m thrilled with the progress I’ve made at Workhorse Sports Performance in Sparta Sparta NJ personal trainer experience
Kudos to the team at javis residential dumpster rental for providing such reliable and friendly service during my rental process.
Hydroseeding and Sod By Taravella’s Hydro Turf transformed my garden into a lush paradise! Highly recommend this sod company.
I had an amazing experience with Taravella’s Hydro Turf! The best sod company near me, hands down Affordable sod installation Manitou Springs
Anyone else had a good experience with a moving company in West Palm Beach? I loved West Palm Beach movers .
Hoping readers reflect back fondly memories made past year despite obstacles faced along way—there’s always silver lining waiting reveal itself eventually if remain hopeful!!!! ## anykeyword ## Office moving companies Keystone Heights
Anyone have tips on choosing the best Fernandina Beach commercial movers in Fernandina Beach? I’m moving soon!
Always appreciate companies that go above & beyond like our recent choice of ### Anykeyword### ! Best Astatula movers