或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Appreciate the insightful article. Find more at ortodoncja warszawa
Guard provide an invaluable company that typically goes undetected up until it’s needed very most security guards near me
If you’re looking for high-quality embroidery in Austin, look no further! I found an amazing place that does custom work. Visit them at Bulk embroidery orders
Great insights! Find more at instant payday loans new orleans
Great job! Find more at casas rurales Segovia
This was very well put together. Discover more at rent a car
This was very beneficial. For more, visit https://hoanghapc.vn/man-hinh-asus
Czy możesz polecić jakieś kursy online dotyczące tworzenie stron internetowych
Fishing Frenzy remains one of the most enduring as one of the most popular slot games in the realm of virtual slots. With its vibrant and captivating underwater theme, simple gameplay mechanics, and rewarding features, it has captured the attention of players worldwide. Unlike many modern slots that rely on multi-layered special features and complex mechanics, fishing frenzy slots a more straightforward yet highly enjoyable experience. Over the years, multiple variations have emerged, including Fishing Frenzy Big Splash Demo and the supercharged Even Bigger Catch release, each bringing new twists while staying true to its roots. Whether you want to enjoy Fishing Frenzy without wagering or try it on your mobile device, there are numerous ways to engage with this iconic slot. Players can experience free-to-play Fishing Frenzy versions to get a feel for the game before wagering real money, making it an accessible and flexible option for both casual and serious players.
Fishing Frenzy was first brought to life by Reel Time Gaming and later expanded by Blueprint Gaming, renowned brands in digital slot innovation. The game quickly gained massive popularity due to its simple yet addictive gameplay. Unlike modern slots that often feature dozens of paylines, complex reward mechanics, and overly complex rules, Fishing Frenzy delivers a classic slot experience that attracts both casual gamers and experienced bettors. The game’s theme immerses players in a deep-sea angling journey, where players cast their lines in hopes of reeling in valuable fish symbols. The bright and lively visuals depict an underwater world filled with vibrant fish, a fishing boat, and a jovial angler who plays a crucial role in the game. The carefully crafted sounds add depth to the gameplay, with ambient sea noises and engaging background tunes that immerse players in a deep-sea adventure. A critical aspect of its enduring success is its ability to evolve while staying true to its original format. New versions like the Big Splash variation and Fishing Frenzy: Ultimate Catch bring enhanced visuals and new and improved rewards, keeping the game engaging without losing its charm while preserving what players love most.
This was very well put together. Discover more at taxi arzua
Appreciate the comprehensive advice. For more, visit https://shoplook.io/profile/ultra9hoanghapc
Appreciate the thorough information. For more, visit https://courses.9marks.org/members/x870hoanghapc/
Thanks for the thorough analysis. More info at https://hackmd.okfn.de/s/BkNn8s6sJl
Great insights! Discover more at http://planforexams.com/q2a/user/ultra7hoanghapc
This was quite informative. For more, visit https://freeimage.host/h610hoanghapc
This was very enlightening. For more, visit https://li.sten.to/x670hoanghapc9sd
This was very enlightening. For more, visit https://www.proko.com/@b760hoanghapc/activity
This is highly informative. Check out https://challonge.com/z890hoanghapc for more
I found this very interesting. Check out https://crypt.lol/z690hoanghapc for more
Appreciate the detailed post. Find more at https://hoanghapc.vn/tan-nhiet-cpu
This was very beneficial. For more, visit http://onlineboxing.net/forum/user/z790hoanghapc
This is a topic that is near to my heart… Best wishes!
Where are your contact details though?
appli plinko avis的最新文章:appli plinko avis
Internet-based gambling hubs have modernized the gambling market, delivering an exceptional degree of convenience and diversity that physical casinos don’t provide. Over the past decade, a large audience worldwide have turned to the pleasure of digital casino play in light of its always-open nature, captivating elements, and ever-expanding collections of titles.
If you’re just starting with the world of virtual gambling or would like to learn about trusted platforms, why not participate in our growing social network? It’s a place where gamblers post tips, enabling you to enhance your virtual play. Join the conversation and see it here now: https://funsilo.date/wiki/User:BorisBlakeney81
One of the biggest attractions of internet-based platforms is the vast variety of games ready to play. Whether you like playing on classic slot machines, immersing yourself in story-driven video slots, or playing smart in traditional table offerings like Texas Hold’em, internet-based gambling sites deliver limitless possibilities. Plenty of operators moreover introduce real-time gaming experiences, making it possible for you to connect with live hosts and opponents, all while enjoying the engaging atmosphere of a brick-and-mortar establishment from the comfort of your home.
Adding to the extensive catalog, digital casino services thrive in seamless entry.
Feeling safe is actually a top priority for everyone, and also having security guards may substantially boost that sensation! Discover a lot more concerning their usefulness at security guards near me
Appreciate the comprehensive advice. For more, visit North Atlana Chiropractic Center
Бесконечный топик
Выдаются в индивидуальном порядке за присутствие в акциях и акциях, вавада приложение скачать и постоянную активность на официальном ресурсе. на входе в учетку обязательно загляните к своей странице и активируйте бездепозитные фриспины.
Very quickly this site will be famous among all blog people, due to
it’s fastidious posts
Check out my page – 75kw Diesel Generator
75kw Diesel Generator的最新文章:75kw Diesel Generator
Grateful for these insights into keeping our homes healthy with proper sewage management—I’m excited to learn even more from cesspool cleaning
This was a wonderful guide. Check out ##Oracle Law Firm## for more Personal Injury Lawyer Costa Mesa
AsanewhomeownerintheareaI’mgladyouguyspointedmetotreesecuritiesasaprofessionalserviceproviderforyourneedslocally! best security services Tucson
Thanks for the great tips. Discover more at Bronco Towing
Tworzenie stron internetowych to pasjonująca podróż! Sprawdźcie także strony internetowe dla dodatkowej wiedzy
Internet-based gambling hubs have changed the gaming landscape, offering an unmatched level of comfort and selection that traditional venues struggle to rival. Throughout the last ten years, a vast number of enthusiasts internationally have chosen the fun of online gaming because of its availability, engaging traits, and progressively larger range of offerings.
If you’re just starting with the world of virtual gambling or hope to find out more about trusted platforms, why not join our growing community? It’s a platform where gamblers share tips, guiding you to enjoy more of your casino activities. Join the connections and visit us now: https://www.europeansourcing.com/2023/04/09/revolutionize-your-business-with-our-cutting-edge/
One of the most compelling reasons of internet-based platforms is the incredible variety of entertainment options on offer. Whether you love spinning vintage reel games, trying out narrative-rich thematic slots, or testing your strategy in classic casino games like Texas Hold’em, online platforms deliver countless choices. A large number of platforms furthermore offer real-time gaming experiences, letting you to engage with actual dealers and gaming peers, all while taking in the lifelike atmosphere of a real casino in your own space.
In addition to diversity, virtual gaming providers are known for seamless entry.
Frequent check-ups are actually essential for maintaining dental health. If you schedule for one as well as stay in Bloomfield NJ, do not be reluctant to make a reservation for an appointment! Discover more at sleep apnea dentist
Appreciate the detailed post. Find more at colchones en Albacete
Ламинированные пластиковые окна различных цветов и фактур — каталог образцов и возможностей здесь https://jobs.theeducatorsroom.com/author/jonparker947/
”Thankful for being able to rely on such trustworthy professionals sidewalk repair nyc
Just got off the phone scheduling another appointment with ####Anykeyword# because they’ve done such an incredible job residential power washing Tampa
Navigating the aftermath of a car accident can be daunting personal injury attorneys near me
If you’re relocating to or from Jacksonville, check out Jacksonville vehicle shipping for all your auto shipping needs
Love using eco-friendly detergents when pressure washing; it feels good to help the planet! Pressure Washing Spring
Great post! I never knew how crucial a board up service was until I experienced a break-in board up service
The section on diagnosing power issues was super insightful! I often struggle with that part of electronics repair game console repair
Dışarıda otururken hangi ikramlıklarla birlikte içeriz diye düşünüyorsunuz? Ben genellikle atıştırmalıklarla birlikte tercih ediyorum.. en iyi nargile çeşitleri
If you’re a fan of unique gifts, visit the best embroidery shop in Austin—you won’t be disappointed with their selection! More info at Bulk embroidery orders
My recent visit to an auto parts store in Punta Gorda FL was a pleasant surprise; they had everything stocked well! scrap car buyers Venice FL
Digital casinos have changed the casino gaming world, providing a unique kind of comfort and variety that physical gambling houses are unable to replicate. Throughout the last ten years, countless gamblers globally have embraced the thrill of virtual gambling because of its anytime, anywhere convenience, exciting features, and ever-expanding game libraries.
If you’re just starting with the world of online gaming or seek to explore proven options, why not participate in our dynamic social network? It’s a hub where enthusiasts offer stories, making it easier for you to enhance your gambling adventure. Check out the connections and see it here now: https://shige.77ga.me/home.php?mod=space&uid=37699&do=profile&from=space
One of the biggest attractions of digital gambling sites is the astounding array of choices ready to play. Whether you enjoy playing on vintage slots, trying out theme-based video-based games, or strategizing in traditional table offerings like Roulette, virtual venues offer infinite choices. Numerous services even present interactive dealer games, allowing you to interact with live hosts and opponents, all while enjoying the lifelike vibes of a land-based casino in your own space.
Beyond variety, virtual gaming providers stand out availability.
I found this very interesting. Check out klinika stomatologiczna warszawa for more
I appreciated this article. For more, visit loan agency new orleans
This was highly helpful. For more, visit car hire