或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
For anyone struggling with back pain in Arlington TX, I suggest checking out Premier Injury Clinics Arlington – Auto Accident Chiropractic .
Anyone else loving the community events hosted by Arlington Chiropractic Center? It’s a great way to learn more about wellness! chiropractors arlington texas
It’s amazing how chiropractic care can improve overall health. Dallas has some great options! Check out Chiropractors in dallas for more info.
I can’t recommend enough that people seek professional evaluations post-accident – check out the advice on Premier Injury Clinics – Auto Accident Chiropractic Dallas !
This was a fantastic read. Check out Open Wide La Jolla Dentist for more.
This was very well put together. Discover more at ربات های هوش مصنوعی تلگرام .
A friend mentioned that they had an excellent experience with somebody from ### anyKeyWord#.” Lakeland auto shippers
It’s fantastic that you are getting thoughts from this post as well as from our discussion made briansclub at login this time.
briansclub at login的最新文章:briansclub at login
Highly satisfied with my recent vehicle shipment through Clearwater car shipping —they really care about their customers.
Just wanted to share my positive experience with a local Palm Bay Palm Bay vehicle shipping —highly recommend them!
I had a great experience with my vehicle shipment through Fort Liberty auto shippers in Fort Bragg—highly recommend them!
I’m curious about other people’s experiences—did anyone else utilize ### anykeyword### recently? Fort Liberty full service movers
For anyone needing a moving company in Bakersfield, I can’t recommend Bakersfield auto shipping enough—amazing service!
Just wanted to share my positive experience with a Fernandina Beach Mover’s in Fernandina Beach; they were professional and affordable.
Appreciate the detailed post. Find more at ضد حریق .
This was very well put together. Discover more at Agency Assassin .
If you’re in Hawthorne and need to move, I suggest checking out Best Hawthorne movers . They really know how to make the process smooth.
This was a wonderful guide. Check out family-friendly Children’s Dentist La Jolla for more.
I enjoyed this article. Check out ربات های هوش مصنوعی تلگرام for more.
Appreciate the insightful article. Find more at bisutería en Albacete .
Thanks for the useful post. More like this at año escolar en Irlanda .
What an exciting time it is for anyone planning a move – especially with so many fantastic local options available here!! Keystone Heights moving company
I had an incredible experience at the Dental Group of Beverly Hills! The best dentist I’ve ever visited!
If you’re looking for a dentist near me pediatric dentist in Beverly Hills
Picking in between deep cleaning and normal cleansing can be hard! I constantly suggest analyzing how much dirt and gunk has built up in your home Cleaning Service Tigard
Have heard great things about LED light therapy—is it commonly offered among various medi-spas around town?? Curious if others have tried this method too!! # # anyKeyw ord# # semaglutide
If you’re unsure where to start after your crash, consider visiting dallas car accident attorney for valuable insight.
I had a wonderful experience at Visual Eyes Optical Inc!
The eye doctor at Visual Eyes Optical Inc was incredibly helpful advanced vision care Stanhope
buy viagra
What Makes Online Casinos Are Becoming an International Sensation
Online casinos have modernized the gambling world, delivering an unmatched level of comfort and breadth that physical gambling houses don’t provide. Throughout the last ten years, a growing community around the world have embraced the thrill of internet-based gaming because of its ease of access, exciting features, and continuously increasing range of offerings.
One of the most compelling reasons of online gaming options is the sheer array of gaming experiences at your disposal. Whether you prefer playing on old-school slot machines, diving into theme-based thematic slots, or testing your strategy in table games like Baccarat, online platforms deliver numerous options. Many casinos furthermore feature real-time gaming experiences, allowing you to connect with human game hosts and opponents, all while enjoying the authentic environment of a brick-and-mortar establishment right at home.
If you’re a beginner with the world of digital casinos or would like to explore reliable sites, why not join our lively gaming forum? It’s a destination where gamblers exchange stories, enabling you to maximize your gaming journey. Check out the experience and start your journey now: вавада зеркало.
Beyond variety, online casinos shine constant connectivity.
Appreciate the detailed information. For more, visit ضد حریق .
If you’re moving soon, do yourself a favor and call #Palatk Movers—they’re lifesavers! Palatka moving companies
If you’re relocating and need to ship your car, check out the services offered by Fort Worth vehicle shipping in Fort Worth.
VIP Cleaners & Laundry always exceeds my expectations with their alterations near me!
I love getting my clothes altered at VIP Cleaners & Laundry in San Diego CA!
VIP Cleaners & Laundry is my go-to for perfect alterations!
Alterations near me have San Diego clothing care experts
Thanks for the useful suggestions. Discover more at Agency Assasin .
I wish I had called a mishap attorney faster after my incident. It would certainly have conserved me a lot of tension! Look into truck accident lawyer for suggestions
If you’re involved in an accident, remember that consulting with a personal injury lawyer can protect your rights! best car accident lawyer
Smyle Dental Bakersfield provided the best emergency dentist service I’ve ever experienced!
I was so relieved to find an emergency dentist near me like Smyle Dental Bakersfield 24-hour dental clinic Bakersfield
The process couldn’t have been easier; they truly understand how stressful moving vehicles can feel. Oakland auto shipping
True Balance Pain Relief Clinic & Sports Massage offers the best sports massage I’ve ever experienced!
I always leave True Balance Pain Relief Clinic & Sports Massage feeling refreshed and rejuvenated Denver sports massage options
The dedication shown by my chosen representative was refreshing amidst such challenging circumstances fort worth car accident attorney
I’ve never felt better since visiting North Atlanta Chiropractic Center! They’re the best chiropractor in town.
North Atlanta Chiropractic Center is my go-to chiropractor in Duluth Chiropractic wellness care near me
Smyle Dental Bakersfield provided the best emergency dentist service I’ve ever experienced!
I was so relieved to find an emergency dentist near me like Smyle Dental Bakersfield emergency tooth extraction near me
Local Movers assisted me greatly during transition; discover who helped me via # anykeyword# Tangerine moving companies
I’ve never felt better since visiting North Atlanta Chiropractic Center! They’re the best chiropractor in town.
North Atlanta Chiropractic Center is my go-to chiropractor in Duluth Chiropractic pain relief Duluth GA
This was very enlightening. For more, visit Open Wide La Jolla Dentist .
This was a great help. Check out ربات های هوش مصنوعی تلگرام for more.
Moving doesn’t have to break the bank! Check out Long distance movers San Antonio for cheap options in San Antonio.
Just moved last weekend and couldn’t be happier with my choice from Best Pomona Park movers !
Why Online Casinos Remain a Worldwide Trend
Virtual gambling platforms have modernized the betting landscape, delivering an unmatched level of user-friendliness and variety that conventional gambling houses fall short of. Throughout the last ten years, millions of players worldwide have turned to the excitement of virtual casinos due to its anytime, anywhere convenience, captivating elements, and continuously increasing catalogs of games.
One of the biggest attractions of internet-based platforms is the unparalleled variety of choices available. Whether you prefer interacting with old-school one-armed bandits, immersing yourself in narrative-rich modern slot games, or exercising tactics in strategy-based games like Blackjack, internet-based gambling sites provide endless options. Plenty of operators furthermore present live dealer games, giving you the chance you to participate with professional croupiers and other players, all while taking in the authentic atmosphere of a traditional gambling venue without leaving your home.
If you’re new with the world of internet-based gaming or hope to delve deeper into reliable sites, why not participate in our dynamic online hub? It’s a place where gaming aficionados exchange experiences, assisting you to get the most out of your virtual play. Dive into the connections and see it here now: вавада казино.
Beyond variety, virtual gaming providers stand out availability.
Walter’s BBQ Southern Kitchen serves the best brunch I’ve ever had in Pittsburgh PA!
The brunch at Walter’s BBQ Southern Kitchen is absolutely delightful and always makes my weekend better Brunch with live music Pittsburgh