或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Denver Print Company exceeded my expectations with their yard signs!
I recently ordered yard signs from Denver Print Company and was impressed yard sign printing services near me
Thanks for the helpful article. More like this at buy men’s messenger bag .
The Appeal of Online Gambling
The surge in popularity of online casinos is driven by several factors. A key benefit is that online casinos are available anytime, anywhere. While land-based casinos have restrictions, online platforms operate 24/7, letting players enjoy their favorite games at any time.
Another major reason for their popularity is the sheer variety of games. While land-based venues have space constraints, online casinos provide an endless assortment of games. From classic fruit machines to cutting-edge video slots with immersive themes, the choices are practically limitless. Want to get the hottest casino updates and promotions? Click here to follow us! – https://1winapk.co/
How Online Casinos Keep Players Engaged
The abundance of promotions is one of the key benefits of playing at online casinos. New players are often welcomed with attractive sign-up bonuses, deposit matches, and free spins. Regular players can take advantage of loyalty programs, cashback deals, and exclusive VIP rewards. While many casino games are based purely on luck, some require skill and strategy. In games like poker, knowledge and tactics can give players a significant edge over less experienced opponents. If you prefer a fast-paced, unpredictable experience, slots and roulette provide thrilling, luck-based gameplay.Responsible Gambling & Choosing a Safe Casino
To ensure a positive experience, it’s vital to play responsibly and within limits. Setting personal limits, managing your budget wisely, and avoiding chasing losses are key to enjoying online casinos safely. Trustworthy sites encourage responsible play through features like voluntary betting caps and time-out options. Do you enjoy online casinos? What are your favorite games and biggest wins? Drop your opinions and stories in the discussion thread!
Kerner Law Group, P.C. is my top recommendation for anyone needing a Bronx car accident attorney! Their dedication is unmatched.
I had a fantastic experience with Kerner Law Group, P.C. Their team includes the best Bronx car accident lawyer I’ve ever met Car accident legal help Bronx
Thanks for the insightful write-up. More like this at colchones en Albacete .
This was beautifully organized. Discover more at carpintería de aluminio .
Detoxing isn’t just about stopping drugs; it’s about starting new healthy habits too! drug detox
Paxos Electric Company LLC delivered exceptional service as my go-to commercial electrician Wharton NJ commercial lighting experts
Water damage can lead to severe structural issues if not addressed quickly—learn more on mold remediation about what steps to take!
Daniella Levi & Associates, P.C. gave me peace of mind with their exceptional Brooklyn car accident attorney services!
I couldn’t be happier with the support from Daniella Levi & Associates, P.C Brooklyn traffic accident lawyer
Dr. Fisher’s Medical Weight Loss Centers have been a game changer for me with their Semaglutide program!
I’m thrilled with the results from Dr. Fisher’s Semaglutide program, especially here in Philadelphia, PA Dr. Fisher’s Medical Weight Loss Centers reviews
Dr. Fisher’s Medical Weight Loss Centers have been a game changer for me with their Semaglutide program!
I’m thrilled with the results from Dr. Fisher’s Semaglutide program, especially here in Philadelphia, PA Best weight loss medication in Philadelphia
If some one needs to be updated with most recent technologies therefore he must be pay
a quick visit this website and be up to date daily.
lenball24.com的最新文章:lenball24.com
I never realized how important a structured detox plan was until I tried it myself. Great insights on this topic! Visit alcohol detox for more info.
Paxos Electric Company LLC delivered exceptional service as my go-to commercial electrician top-rated electricians in Wharton
The Injury Recovery Center has been a lifesaver for my back pain!
I can’t believe the difference a chiropractor makes at the Injury Recovery Center!
Looking for a chiropractor near me led me to the amazing team at Injury Recovery Center Lakewood injury recovery center
buy viagra
We need more discussions about the role of nutrition in supporting individuals recovering from substance use disorders! addiction treatment
This article is a great reminder that healing takes time! Find more tips on recovery at eating disorder treatment .
This was very beneficial. For more, visit roofing contractors .
“Every picture tells a story thanks to # # any Keyword ###’s expert styling!” virtual staging services
I love seeing discussions about holistic approaches in drug rehab; they can enhance traditional methods significantly! drug rehab
I’m so pleased with the work done by Summit Services—they truly deserve the title of best electrician in Bluffton! Check out their services at Electrician !
Excellent blog! Do you have any helpful hints for
aspiring writers? I’m planning to start my own blog soon but I’m a little lost on everything.
Would you propose starting with a free platform like WordPress or
go for a paid option? There are so many options out there that I’m totally confused ..
Any recommendations? Appreciate it!
авиатор играть的最新文章:авиатор играть
Очень забавное сообщение
Испытайте игровой процесс в демо-режиме и вы обязательно убедитесь в sweet bonanza её захватывающих бонусах. играть в sweet bonanza возможно как бескорыстно, так и на реальные наличные в большинстве своем онлайн игорные дома, что предлагают классические однорукие бандиты с барабанами, включая sweet bonanza.
Love that you’ve highlighted both traditional and modern styles—it helps people find something they resonate with!!! # # anyKeyWord ## painting companies
I’m planning to repaint my bedroom and want something soothing—what colors do you recommend? house painters
Thanks for the thorough analysis. More info at dayton roofing .
Did you recognize that utilizing self-garage can support with staging your private home on the market? Look into it at self storage Belleville !
Thanks for the great information. More at Air conditioning repair Houston .
В этом что-то есть. Теперь всё понятно, спасибо за объяснение.
особенно это затрагивает вейджера – множителя, который определяет, сколько раз необходимо сделать ставки на бонусную сумму, https://hospostuff.com.au/poket-option-fibonacci-fan-ponimanie-i-primenenie/ раньше, чем можно будет забрать сумму.
This is very insightful. Check out local rodent control for more.
buy viagra
This was very beneficial. For more, visit rustic outdoor wedding venues .
Denver Print Company exceeded my expectations with their yard signs!
I recently ordered yard signs from Denver Print Company and was impressed yard sign printing services near me
The personalized care from my local chiropractor made all the difference in recovering from my injuries. Auto accident chiropractor near me
Mostbet Chile – experiencia de usuario personalizable.
Mostbet Chile的最新文章:Mostbet Chile
Proud showcasing achievements made possible through joint efforts preserving justice extended everyone involved personal injury attorney texas
Just had my first visit at Car accident injury clinic and was impressed by the thorough examination.
This was very beneficial. For more, visit wedding venues near me .
I found this very interesting. Check out Bedrock Restoration – Water Fire Mold Damage Service for more.
Mostbet registrering – användarvänligt gränssnitt för
svenska spelare .
mostbet se的最新文章:mostbet se
If you want peace of mind after experiencing a personal injury consult skilled lawyers available through platforms like # # anykeyword # # relevant to locals around arlington tx ! car accident lawyer arlington tx
Прошел курс лечения в Dr.Hasan, теперь чувствую себя полностью здоровым! клиника
Thanks for the valuable insights. More at local roofing contractors .
This was very enlightening. More at water damage repair near me .
Thanks for the helpful advice. Discover more at dumpster contractor Hobe Sound .
Thanks for the thorough article. Find more at gutter services near me .
Appreciate the thorough write-up. Find more at roof repair near me .
I’ve heard mixed reviews about window security film. Does it really work, or is it just a gimmick? security film for windows Louisville