或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Why do painters charge so much when it comes to larger projects, like full exterior repaints? Curious minds want to know! exterior painters
Such a critical topic, and your insights make it easier to understand what people go through during detox! drug detox
The role of aftercare in maintaining sobriety is crucial after completing an initial treatment program. addiction treatment
Thanks for the great content. More at St. Louis painters .
The staff at lakeland window cleaning business made the process of getting our home pressure washed so easy and efficient.
Your tips on upgrading older HVAC gadgets to keep on energy debts is helpful—thanks for sharing! AC Repair Hamilton
Never miss seasonal maintenance tips—they’re essential! Discover schedules shared via ## leading-edge roofing technology
“Love how organized this post is; clear instructions make all the difference when tackling window cleaning; also love working with ### any Keyword###!” lakeland window washing services
Walter’s BBQ Southern Kitchen has the best brunch in Pittsburgh. The flavors are incredible!
I love finding a brunch spot near me like Walter’s BBQ Southern Kitchen Best brunch spots in Pittsburgh
Thanks for the great explanation. Find more at water cleanup company near me .
Shout-out those behind bar mixing up delightful concoctions alongside delectable entrees served throughout evening – simply brilliant ideas ! popular indian food spokane valley
This was quite informative. For more, visit پوشش ضد حریق .
I always thought tree trimming was just aesthetic, but it’s so much more than that! Discover more at tree removal near me .
This was a great article. Check out Newnan Water Damage Pros for more.
Thanks for the valuable insights. More at dmv inspection near me .
I found this very interesting. For more, visit abogados laboralistas Sevilla .
I’m so glad I found a local bulk grocery store! It makes meal prep so much easier and cheaper. Learn more at grocery deals at Pitco Foods .
I’m so happy I chose Banning Construction Inc.! They made my dream home a reality! affordable construction
I had a wonderful experience at Visual Eyes Optical Inc!
The eye doctor at Visual Eyes Optical Inc was incredibly helpful best optometrists in Stanhope
Loving my new look after going through CoolSculpting at american laser med spa amarillo coolsculpting !
The difference after using Window Washing is night and day—so impressed!
Great insights! Discover more at contador en Saltillo .
Metal roofs offer exceptional fire resistance, providing an added layer of safety for your Carlsbad home. Trust affordable roofing services for expert installations.
Why Online Casinos Are Becoming a Global Phenomenon
Internet-based gambling hubs have transformed the gambling landscape, delivering an unmatched level of user-friendliness and range that conventional venues are unable to replicate. Over time, countless gamblers worldwide have adopted the thrill of virtual gambling as a result of its availability, thrilling aspects, and constantly growing game libraries.
One of the biggest attractions of internet-based platforms is the unparalleled variety of titles at your disposal. Whether you are a fan of rolling classic slots, trying out story-driven video slots, or playing smart in card and board games like Baccarat, digital casinos boast limitless entertainment avenues. Many casinos also include real-time gaming experiences, making it possible for you to participate with actual dealers and other players, all while experiencing the realistic ambiance of a physical gaming house without leaving your home.
If you’re just starting with the world of virtual gambling or hope to find out more about trusted platforms, why not join our growing social network? It’s a platform where fans discuss stories, making it easier for you to enhance your gaming journey. Join the discussions and learn more now: vavada регистрация.
Beyond variety, virtual gambling platforms thrive in accessibility.
Local events and promotions can significantly enhance your visibility through Nashville SEO—definitely worth exploring! Branding Agency
”Last night served as yet another reminder: supporting local artistry helps ensure its continued growth within communities everywhere!” # # anything atlanta trophy store
I’m considering a bathroom remodel and will definitely reach out to Banning Construction Inc.! Any advice? home repair contractors estimates
Wonderful tips! Find more at ربات های هوش مصنوعی تلگرام .
Painting can be such a daunting task. I always recommend hiring experts. residential painting services has some fantastic services in the Toronto area!
Эксклюзивные предложения ждут вас в нашем магазине. Начните покупки и найдите всё, что нужно по ссылке: https://xn--kr34-rzb.com
I believe we should also focus on educating parents about recognizing signs of potential substance abuse in their children early on! drug addiction
I recently completed an alcohol detox program, and the benefits have been life-changing. Highly recommend visiting Alcohol Detox for more information!
Daniella Levi & Associates, P.C. truly excels as a Bronx car accident attorney. Their expertise made a significant difference in my case outcome.
If you need a Bronx car accident lawyer, I highly recommend Daniella Levi & Associates, P.C Bronx accident claim attorney
Harmony Painting transformed my living room with their expert interior painters! Highly recommend them for anyone in Denver.
The exterior of my house looks fantastic thanks to Harmony Painting’s skilled painters! Love their attention to detail Harmony Painting for commercial projects
True Balance Pain Relief Clinic has the best massage therapist. I always leave feeling rejuvenated and relaxed!
I found the perfect massage therapist near me at True Balance Pain Relief Clinic Therapeutic massage specialists near me
This is very insightful. Check out water cleanup company near me for more.
Harmony Painting transformed my living room with their expert interior painters! Highly recommend them for anyone in Denver.
The exterior of my house looks fantastic thanks to Harmony Painting’s skilled painters! Love their attention to detail Denver exterior painting experts
Seeing loved ones go through addiction is tough; seeking support is essential for family members too! drug rehab
I recently attended a workshop by Social Cali, and it was enlightening! They really know their stuff; learn more at digital transformation san jose .
From therapies to support groups, # anything # has everything covered! Depression Treatment Center
You should not let moss wreck the suppress attractiveness of your home or business enterprise in Nanaimo Grime2Shine Nanaimo
Foothills Paving & Maintenance Inc did an amazing job on my driveway paving!
I love my new driveway thanks to Foothills Paving & Maintenance Inc!
Foothills Paving & Maintenance Inc provides excellent driveway paving services!
My driveway never looked Paving experts in Wheat Ridge
Walter’s BBQ Southern Kitchen has the best brunch in Pittsburgh. The flavors are incredible!
I love finding a brunch spot near me like Walter’s BBQ Southern Kitchen Outdoor brunch seating in Pittsburgh
Workhorse Sports Performance has transformed my fitness journey with their exceptional personal training services!
I’m thrilled with the progress I’ve made at Workhorse Sports Performance in Sparta Sparta NJ fitness motivation
This is very insightful. Check out ضد حریق for more.
This was a great article. Check out water restoration for more.
Great insights into how typically we needs to retain our systems—thanks! For similarly analyzing, fee out Septic Service Owens Septic Service Mooresville !
Fantastic article on spring cleaning! I’m already planning my tick list. Additional assets shall be stumbled on at office cleaners Kelowna Foster Janitorial .
Understanding triggers is a key element in preventing relapse during recovery from addiction! addiction treatment
“Thank you for highlighting lesser-known aspects of withdrawal and its effects on individuals.” drug detox