或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
I enjoyed this article. Check out nổ hũ đổi thưởng for more.
This was highly educational. For more, visit nhà cái nổ hũ .
fortunately highlighting function performed group companies advocating in your price range housing rules promoting inclusivity guaranteeing each Gold Coast buyers agent
Selling my dwelling fast for money used to be the superior decision I made! I stumbled on a significant source at https://www.demilked.com/author/rezrymnpzg/ that helped me as a result of the system.
Siempre es bueno tener el número de un cerrajeros santander a mano, nunca se sabe cuándo lo necesitaremos.
It’s excellent how a great deal which you can do with whipped cream chargers; thank you, nang bottles , for your complete inspiration!
Appreciate the thorough write-up. Find more at https://www.youtube.com/watch?v=NZz9O9cN4FY .
Don’t underestimate the importance of hiring a qualified waco personal injury lawyer after a car crash.
Thanks for shedding light on this subject! It’s very easy to overlook how different academies can be from routine classes in regards to their method and viewpoint. For more understandings, see Dance Studio Near Me !
I all the time used to read piece of writing in news papers
but now as I am a user of web therefore from now I am using net for articles or reviews,
thanks to web.
salt trick的最新文章:salt trick
Shipping vehicles is complex but not when you use *** anyKeywords***; they made everything effortless! A1 auto Transport Detroit
Such an informative read on preventing clogs! I can’t believe how much I didn’t know before this article. Explore further at Drain Cleaning Romford .
Shipping a vehicle can be stressful, but finding a good Santa Ana car shipping in Santa Ana made it easy.
What Makes Online Casinos Have Become a Worldwide Trend
Virtual gambling platforms have changed the gaming world, providing an unmatched level of convenience and selection that land-based establishments don’t provide. Over the past decade, countless gamblers across the globe have welcomed the thrill of virtual casinos due to its ease of access, exciting features, and widening catalogs of games.
One of the most compelling reasons of virtual gambling hubs is the unparalleled diversity of games on offer. Whether you are a fan of playing on classic fruit machine slots, diving into story-driven visual slot games, or testing your strategy in table games like Texas Hold’em, casino websites boast numerous entertainment avenues. Several sites additionally feature live casino options, enabling you to connect with actual dealers and fellow gamblers, all while taking in the realistic ambiance of a land-based casino from anywhere you want.
If you’re new with the world of online gaming or want to learn about reputable operators, why not become part of our lively interactive platform? It’s a place where gaming aficionados discuss tips, enabling you to get the most out of your online casino experience. Check out the discussions and check it out now: вавада вход.
Beyond variety, online casinos thrive in accessibility.
The customer service at A+ Gutters is top-notch—very satisfied with my experience from start to finish! Gutter installation
We should explore opportunities surrounding collaborative efforts made possible via platforms provided by professionals at ‘Agent’ AutoPilot!” #AnyKeyWord# dependable live transfers by agent autopilot
La prevención es lo mejor. Siempre tener a mano el contacto de un cerrajeros confiable.
Long-distance moves can be tricky; definitely look into #AnyKeyWord# before making decisions! Merritt Island moving company
“So thrilled with how seamless my transition was thanks to @@–top-notch service!” Local movers Sachse
Long distance moving made easy—thanks to the incredible service at Mesquite movers .
Hoping others will also benefit from using services like those offered through this site known as ####—highly rated too!! Pinellas Park international movers
Boxing is an incredible cardio workout! Who knew punching could get you so fit? Find out more benefits at boxing personal coaches .
I found my ideal moving company in Stuart through Long distance movers Stuart . They made everything so easy!
For anyone needing help with their air conditioning units, I highly recommend reaching out to Summit Services in Hilton Head Island! You won’t regret it! AC repair near me
Just wanted to say how much I appreciate all the info shared at # # anyKeyWord # #! Local movers Valrico
Great advice here! Local movers can really ease the burden of relocating; I found mine through Ralls international movers #.
“Looking forward to sharing more memories here; couldn’t have done it without #AnyKeyWord#!” Spring Hill moving companies
I wish I had found Office moving companies Land O’ Lakes before my last move in Land O’ Lakes! So many helpful resources there.
The Reasons Behind Why Online Casinos Are Becoming an International Sensation
Digital casinos have transformed the betting market, delivering a unique kind of accessibility and diversity that brick-and-mortar venues are unable to replicate. Recently, countless gamblers worldwide have chosen the excitement of virtual gambling because of its always-open nature, engaging traits, and progressively larger game libraries.
One of the most compelling reasons of online casinos is the unparalleled array of gaming experiences on offer. Whether you are a fan of spinning old-school one-armed bandits, playing through theme-based video slots, or mastering skills in strategy-based games like Roulette, digital casinos offer infinite opportunities. Several sites also feature interactive dealer games, enabling you to engage with actual dealers and gaming peers, all while taking in the engaging atmosphere of a physical gaming house from the comfort of your home.
If you’re exploring for the first time with the world of internet-based gaming or are looking to find out more about reliable sites, why not engage with our vibrant interactive platform? It’s a place where enthusiasts share tips, assisting you to enjoy more of your virtual play. Join the community and see it here now: vavada.
Besides the wide selection, virtual gaming providers stand out constant connectivity.
Puget Sound Moving Bellevue made our transition so smooth, truly the best moving company near me I could have found!
The team at Puget Sound Moving Bellevue handled our furniture with incredible care Puget Sound Moving loading and unloading services
Puget Sound Moving Seattle made our transition so smooth, their professional movers near me were efficient and careful with all our belongings!
The team at Puget Sound Moving Seattle went above and beyond moving company Seattle
Puget Sound Moving Bellevue made our transition so smooth, truly the best moving company near me I could have found!
The team at Puget Sound Moving Bellevue handled our furniture with incredible care Puget Sound Moving weekend availability
LuxNeuro’s neurofeedback therapy has transformed my life with its effective techniques!
The neurofeedback sessions at LuxNeuro are truly life-changing.
I’ve never felt better since starting neurofeedback at LuxNeuro LuxNeuro counseling experts
Puget Sound Moving Seattle made our transition so smooth, their professional movers near me were efficient and careful with all our belongings!
The team at Puget Sound Moving Seattle went above and beyond movers near me
Me gustaría recibir algunas recomendaciones específicas para cerrajeros locales; estoy buscando uno confiable y eficiente como el ###anKeywod#! cerrajeros baratos santander
Shoutout once more just because they deserve accolades beyond measure—best investment made recently hands down without question!!!# # any Keyword ## Rowlett Mover’s
LuxNeuro’s neurofeedback therapy has transformed my life with its effective techniques!
The neurofeedback sessions at LuxNeuro are truly life-changing.
I’ve never felt better since starting neurofeedback at LuxNeuro LuxNeuro neurofeedback therapy
Thanks for the great information. More at persianista .
I’m thrilled with the results from Foothills Paving & Maintenance Inc’s asphalt paving service!
Foothills Paving & Maintenance Inc provided top-notch asphalt paving near me!
The team at Foothills Paving & Maintenance Inc really knows their asphalt top-rated paving contractor Wheat Ridge
So happy you spoke of sturdiness comparisons among a considerable number of products achieveable this day—it reinforces why **$*Anykeyword** will have to be consulted! analysis of Melbourne Colorbond fence prices
Sculpted MD helped me regain my energy levels with their effective testosterone therapy!
The best testosterone therapy near me is definitely at Sculpted MD.
Feeling revitalized thanks to Sculpted MD’s testosterone therapy in Aurora CO Sculpted MD Aurora testosterone specialists
Dr. Fisher’s Medical Weight Loss Centers changed my life with their Semaglutide program!
I highly recommend Dr. Fisher’s for anyone in Philadelphia, PA seeking Semaglutide treatments.
Semaglutide near me was easy to find thanks to Dr Philadelphia based weight loss experts
Sculpted MD transformed my life with their medical weight loss program!
I found the best medical weight loss near me at Sculpted MD!
Sculpted MD in Highlands Ranch CO offers incredible medical weight loss solutions Sculpted MD weight loss journey
Sculpted MD has transformed my life with their amazing semaglutide treatments!
I had an incredible experience at Sculpted MD getting semaglutide near me Sculpted MD diet solutions
Sculpted MD transformed my life with their medical weight loss program!
I found the best medical weight loss near me at Sculpted MD!
Sculpted MD in Highlands Ranch CO offers incredible medical weight loss solutions Highlands Ranch CO weight loss health centers
Oxnard Dentistry made my dental visit so comfortable, their dentist was professional and gentle throughout my entire appointment!
I’ve been searching for a reliable dentist near me for years, finally found perfection at Oxnard Dentistry Oxnard CA affordable dental care
It’s great to know that Chimney Sweep Pros Houston services prioritizes customer satisfaction above all else!
For anyone still debating whether or not to get help—it’s worth every penny spent! chimney sweep houston near me
Omni Dental Specialty saved my weekend when I needed an emergency dentist in Oxnard CA. Their team was amazing!
I’m so grateful for Omni Dental Specialty’s emergency dentist services. They relieved my pain quickly and professionally Where do I go for a dental emergency at night in Oxnard?
Estoy empezando a darme cuenta de lo importante que es contar con una buena opción como el ###anKeywod# para emergencias! cerrajeros urgentes santander