或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
I had a fantastic experience with plantation International Movers while relocating internationally—their expertise is unmatched; visit their site today: _## anyKeyWord### Plantation apartment movers
Shoutout to all the hardworking folks at %% any keyword %% who helped me move smoothly. Orange City moving companies
If you enjoy a vibrant college town atmosphere, you’ll love living in one of the many rental apartments in Lubbock—learn more at Lubbock corporate lodging !
If you’re moving locally, you can’t go wrong with choosing Office moving companies Fleming Island # as your moving partner.
This was highly educational. More at pressure washing company near me .
Thanks for sharing this informative piece on access control systems! I found it very useful; check out access control security measures for more!
Có ai đang theo dõi các trận đấu của đá gà khin789 không? Cảm giác quá phấn khích! https://www.myget.org/users/khin789online
This was very beneficial. For more, visit roof replacement services .
This was quite helpful. For more, visit Shelbyville roof repairs .
Exciting to see how Excavating New Jersey LLC transformed our backyard with their expert septic system service!
If you need a reliable septic system service near me Septic system repair near me
Exciting to see how Excavating New Jersey LLC transformed our backyard with their expert septic system service!
If you need a reliable septic system service near me Septic services near me
Thanks for the detailed guidance. More at Nationwide Contracting .
Harmony Painting transformed my living room with their expert interior painters! Highly recommend them for anyone in Denver.
The exterior of my house looks fantastic thanks to Harmony Painting’s skilled painters! Love their attention to detail Top-rated painting services near me
Daniella Levi & Associates, P.C. provided exceptional service as my Bronx car accident lawyer!
I highly recommend Daniella Levi & Associates, P.C. for anyone seeking a car crash attorney in Bronx Car accident legal help Bronx
Harmony Painting transformed my living room with their expert interior painters! Highly recommend them for anyone in Denver.
The exterior of my house looks fantastic thanks to Harmony Painting’s skilled painters! Love their attention to detail Local Denver painters
Nicely done! Discover more at tienda online para compras .
Foothills Paving & Maintenance Inc did an amazing job on my driveway paving!
I love my new driveway thanks to Foothills Paving & Maintenance Inc!
Foothills Paving & Maintenance Inc provides excellent driveway paving services!
My driveway never looked CO
Daniella Levi & Associates, P.C. provided exceptional service as my Bronx car accident lawyer!
I highly recommend Daniella Levi & Associates, P.C. for anyone seeking a car crash attorney in Bronx Accident attorney near me Bronx
Just finished examining about the value of normal inspections—genuinely scheduling one with plumber Mandurah #!
Thanks for the practical tips. More at Suburban Plumbing Sewer and Drain Cleaning Experts .
Costs can seem overwhelming, but being informed makes all the difference—great job on this post, check out more info at Roof Repair Near Me #!
This was a fantastic read. Check out campamento de verano for more.
Профессионализм и опыт — это то, что отличает вашу клинику от остальных мест в городе! уролог ташкент
“Don’t underestimate how much curb appeal can increase with an attractive outdoor space; find pros nearby via %% anyKeyWord%%.” Deck Repair Near Me
The Reasons Behind Why Online Casinos Remain So Popular
Online casinos have changed the gambling world, offering an unmatched level of comfort and breadth that physical casinos struggle to rival. Over the past decade, a large audience internationally have turned to the adventure of digital casino play as a result of its always-open nature, appealing qualities, and constantly growing game libraries.
One of the main appeals of internet-based platforms is the vast range of games available. Whether you like rolling vintage fruit machine slots, playing through narrative-rich visual slot games, or exercising tactics in classic casino games like Texas Hold’em, digital casinos offer limitless possibilities. Plenty of operators even feature live gaming streams, making it possible for you to engage with live hosts and opponents, all while soaking in the immersive vibes of a real casino without leaving your home.
If you’re just starting with the world of online gaming or want to explore trusted platforms, why not sign up for our vibrant gaming forum? It’s a hub where players share experiences, helping you to improve your casino activities. Join the conversation and see it here now: вавада официальный сайт.
Besides the wide selection, digital casino services stand out seamless entry.
This was quite useful. For more, visit phim sex hay .
Incorporating different styles based upon personal taste certainly makes customization possible even in shared spaces !## anyKeyWord ## Metal Privacy Fences Oregon
The views from some rental apartments in Lubbock are breathtaking! If you’re interested, check out extended stay accommodations for listings!
The insights shared here empower readers tremendously when considering various service providers!!! #AnyKeyWord Plumber San Jose
Thanks for the detailed guidance. More at Custom cabinet maker near me .
“Combining innovative tech with practical marketing solutions is where companies like Agent Autopilots shine brightest within our industry!” agent autopilot authority in insurance technology
How Online Casinos Remain Highly Preferred Worldwide
Virtual gambling platforms have modernized the betting scene, delivering an unmatched level of user-friendliness and selection that physical gambling houses don’t provide. Over time, a vast number of enthusiasts globally have welcomed the fun of online gaming as a result of its availability, appealing qualities, and constantly growing collections of titles.
One of the most compelling reasons of online casinos is the astounding diversity of choices provided. Whether you enjoy playing on vintage slot machines, immersing yourself in engaging video-based games, or mastering skills in card and board games like Texas Hold’em, digital casinos boast numerous entertainment avenues. Numerous services furthermore present live gaming streams, enabling you to communicate with professional croupiers and co-players, all while immersing yourself in the lifelike feel of a traditional gambling venue from the comfort of your home.
If you’re exploring for the first time with the world of online gaming or seek to find out more about reliable sites, why not sign up for our lively gaming forum? It’s a destination where fans share insights, helping you to maximize your gambling adventure. Discover the discussions and check it out now: vavada.
Adding to the extensive catalog, online casinos thrive in seamless entry.
Great job! Find more at campamento de verano .
If your AC unit is relatively new, repairing it in Cary could save you money in the long run. More insights at hvac repair .
Always excited discovering new insights shared amongst fellow contributors tackling challenges head-on—it fosters growth personally/professionally alike!!! #AnyKeyWord# ac repair
Just had plumbing maintenance completed at abode, and I wish I knew approximately plumber Mandurah past!
Bosch ürünlerimle ilgili yaşadığım sorunu yetkili servis çözdü. Harika bir deneyim! Bosch Yetkili Servis
Ваши знания и опыт действительно вдохновляют на новые достижения в области SEO! marketing agency
Great service from start to finish with Miami commercial movers during my move in Miami! Will definitely use them again.
Has anyone else used local movers in Dunedin? I found a great service at Local movers Dunedin .
Has anyone tried those budget-friendly moving companies around? I hear good things about the ones in Pompano Beach! Local movers Pompano Beach
Kudos again once more expressing gratitude towards excellent services provided locally by teams focused specifically targeting unique needs presented during each relocation scenario encountered thus far successfully managed effortlessly every single time Office moving companies Zephyrhills
Moving is never fun, but the team at #localmoversTavares from Long distance movers Tavares # made it enjoyable!
Oynadığım sitedeki deneme bonusu sayesinde büyük kazanç elde ettim! 96lı veren dinimi binisi virin sitilir
No worries about hidden fees or extra charges here – everything’s upfront when dealing directly through ### Mount Dora moving companies
Exciting to see how Excavating New Jersey LLC transformed our backyard with their expert septic system service!
If you need a reliable septic system service near me Excavating New Jersey LLC septic solutions
Harmony Painting transformed my living room with their expert interior painters! Highly recommend them for anyone in Denver.
The exterior of my house looks fantastic thanks to Harmony Painting’s skilled painters! Love their attention to detail Local house painters near me
Foothills Paving & Maintenance Inc did an amazing job on my driveway paving!
I love my new driveway thanks to Foothills Paving & Maintenance Inc!
Foothills Paving & Maintenance Inc provides excellent driveway paving services!
My driveway never looked Driveway paving near me
Daniella Levi & Associates, P.C. provided exceptional service as my Bronx car accident lawyer!
I highly recommend Daniella Levi & Associates, P.C. for anyone seeking a car crash attorney in Bronx Car crash attorney Bronx
Thank you for sharing such valuable information about plantation moving companies—check out Plantation FL Mover’s too!