或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Omni Dental Specialty saved my weekend when I needed an emergency dentist in Oxnard CA. Their team was amazing!
I’m so grateful for Omni Dental Specialty’s emergency dentist services. They relieved my pain quickly and professionally Emergency dental extraction
Vitality Dental is the best dentist I’ve ever visited, their gentle approach made my dental anxiety disappear completely!
My search for a reliable dentist near me ended when I discovered Vitality Dental, truly exceptional care every visit Can Vitality Dental help with broken teeth in Plano?
What’s up, I read your blog on a regular basis. Your story-telling style is
awesome, keep up the good work!
plinko ball的最新文章:plinko ball
I’ve attempted different manufacturers, yet nothing compares to the high quality of http://alr.7ba.info/out.php?url=https://www.kilobookmarks.win/the-electricity-competent-design-of-the-nang-tank-minimizes-environmental-have-an-effect-on-although-making-sure-gold-standard-functionality-for-all nitrous oxide cream chargers.
Kerner Law Group, P.C. provides exceptional service as a Bronx car accident attorney. Their expertise is truly unmatched!
I’m grateful for the dedicated support from Kerner Law Group, P.C. as my Bronx car accident lawyer.
Choosing Kerner Law Group, P.C Truck accident lawyer Bronx
Nice post. I learn something totally new and challenging on websites I stumbleupon on a daily basis.
It will always be interesting to read through content from other authors and practice something
from other websites.
site的最新文章:site
Just had some friends over and used what are nitrous oxide cylinders used for for our Nang needs—everyone loved it!
So thankful for the excellent service from A+ Gutters—their installation has transformed our home’s appearance! Gutter installation
” The versatility supplied with the aid of these canned merchandise is noteworthy-I would like changing thoughts thru #AnyKeywords#!” nangs cylinders
Hey everyone,
I’ve been diving into the world of online gaming lately, and I’ve gotta say — it’s surprisingly fun. At first, I was a bit wary. I mean, how do you even believe in an online platform with your cash, right? But after doing a ton of research (and trying out a few dodgy sites so you don’t have to), I figured out a few things that separate a reliable casino from a total scam. First off, if you’re new to all this, here’s the golden rule: **licenses matter**. If a casino doesn’t have a proper license (like from the Malta Gaming Authority or the UK Gambling Commission), just run. No bonus is worth the risk of never seeing your money again. Also — and I know no one wants to — go through the small print. That’s the only way to know what kind of wagering requirements they’ve slapped onto those so-called “juicy” bonuses.
Now, let me share a site I’ve been playing on these last few weeks. It’s been a game-changer. The interface? Super easy to navigate. Payouts? No waiting around. And the game selection? *Wild*. Slots, live dealers, blackjack, even some oddball options I hadn’t tried before. Check it out here: https://www.avvocatosiviero.it/incremento-pensioni-di-invalidita-civile/ What really stood out was the customer service. I had a tiny issue with a bonus not working, and they got back to me in like 10 minutes. Compare that to other sites where you’re just ghosted by support — yeah, hard pass.
Also, if you’re into bonuses (and who isn’t?), this place offers some juicy ones. But here’s the trick: don’t just chase bonuses. It’s smarter to stick to reasonable terms than a huge bonus you’ll never be able to withdraw. I’m not saying you should go and blow your whole paycheck — please don’t. But if you’ve got a little extra fun budget and you’re looking for a fun way to unwind, online casinos can totally deliver. Just keep your head on, set a budget, and don’t treat it like a side hustle. It’s for fun, not for a paycheck. Anyway, just wanted to drop my experience here in case anyone’s looking for solid info or trying to find a trustworthy place to play. If you’ve got your own recommendations or even some horror tales, I’m all ears — love talking shop about this stuff.
Good luck out there, and may the odds be ever in your favor ??
Замечательно, очень хорошее сообщение
#file_linksC:\Users\Admin\Desktop\file\gsa+en+10kPBNRoma27031P2URLBB.txt”,1,N], launched in {2020|current} year, {is one of the {newest|unique} available {casino|gambling house|gaming establishment} for {real|real} money.
Anyone else to find themselves experimenting more considering that they all started using personalized nang delivery options ? It’s most exciting!
The importance of professional pest control services cannot be overstated—thanks for emphasizing that! Learn more at pest management .
I become skeptical first and foremost, however selling my condominium for coins grew to become out to be a useful option! Explore greater at https://www.empowher.com/user/4493426 .
Unblocking drains can be such a hassle. I recently used a professional service, and it made all the difference! Learn more at Drain Cleaning Romford .
Your description really aided me recognize the distinctions much better! Whether aiming for expert training or simply taking pleasure in dancing, it’s essential to choose intelligently. I discovered added info at Dance Studio that could be useful also!
Trust me, if you have a junker laying around, contact the pros at we buy junk cars fort myers fl # today.
Just completed an ombre wall effect in my daughter’s room—it turned out beautifully! exterior painters near me
I had a fantastic experience with Summit Services when my AC broke down last summer. Their team is professional and quick to respond! Highly recommend them for anyone in Bluffton or Hilton Head Island needing AC repairs. More info here: AC repair near me .
If you want to get fit and learn self-defense, a boxing gym is the way to go! More info is available at boxing coaches .
I advise all of us attempt whip cream chargers for his or her holiday cakes this 12 months—get them from nang bottles .
Appreciate the detailed post. Find more at water heater repair .
Thanks for the insightful write-up. More like this at https://vi.gravatar.com/manhinhhp .
“What do you think is the best age to start learning how to drive? Share thoughts and read others’ experiences over on: driving school !”
Appreciate the thorough insights. For more, visit Local window replacement near me .
It seems еveryone рrefers Ьetting on tһe European footbaⅼl leagues.
Soccer cаn be popuⅼar with betting traders. Cannοt get enlightenment througһ tһe sunshine of the rest.
Here is my web-site; แทงบอลออนไลน์เว็บไหนดี 10 เว็บแทงบอลไม่ผ่านเอเย่นต์ เชื่อถือได้
แทงบอลออนไลน์เว็บไหนดี 10 เว็บแทงบอลไม่ผ่านเอเย่นต์ เชื่อถือได้的最新文章:แทงบอลออนไลน์เว็บไหนดี 10 เว็บแทงบอลไม่ผ่านเอเย่นต์ เชื่อถือได้
Hey everyone,
I’ve been diving into the world of virtual casinos lately, and I’ve gotta say — it’s pretty damn addictive. At first, I was a bit wary. I mean, how do you even believe in an online platform with your cash, right? But after doing a ton of research (and trying out a few questionable sites so you can avoid that mess), I figured out a few things that separate a legit casino from a complete fraud. First off, if you’re new to all this, here’s the golden rule: **licenses matter**. If a casino doesn’t have a proper license (like from the Malta Gaming Authority or the UKGC), just walk away. No bonus is worth the trouble of never seeing your funds again. Also — and I know no one wants to — read the T&Cs. That’s the only way to know what kind of hidden traps they’ve slapped onto those so-called “generous” bonuses.
Now, let me share a site I’ve been hooked on these last few weeks. It’s been a total win. The interface? Super easy to navigate. Payouts? No waiting around. And the game selection? *Massive*. Slots, live dealers, blackjack, even some oddball options I hadn’t tried before. Check it out here: http://9mektep.ayagoz-roo.kz/index.php?subaction=userinfo&user=ShelliAbell What really impressed me was the support team. I had a tiny issue with a bonus not working, and they got back to me in like no time. Compare that to other sites where you’re just ghosted by support — yeah, no thanks.
Also, if you’re into bonuses (and who isn’t?), this place offers some juicy ones. But here’s the trick: don’t just go crazy over promos. It’s smarter to stick to fair terms than a huge bonus you’ll never be able to withdraw. I’m not saying you should go and blow your whole paycheck — please don’t. But if you’ve got a little extra cash and you’re looking for a fun way to unwind, online casinos can totally deliver. Just keep your head on, set a budget, and don’t treat it like a side hustle. It’s for fun, not for a paycheck. Anyway, just wanted to drop my experience here in case anyone’s interested or trying to find a good place to play. If you’ve got your own recommendations or even some casino nightmares, I’m all ears — love talking shop about this stuff.
Good luck out there, and may the odds be ever in your favor ??
The idea of layering products can be intimidating; how do you approach it without overwhelming your skin? Dermaplaning
I am regular visitor, how are you everybody? This paragraph posted at this web page
is really fastidious.
Here is my site :: read more
read more的最新文章:read more
Has anyone tried chemical peels for their skincare concerns? I’m curious about their effectiveness! Read more about it at Laser Hair Removal .
Appreciate the detailed information. For more, visit personal injury lawyers services .
So many major tips in this put up! I’m heading over to ###ANYKEYWORD### perfect now! more info
I appreciated this post. Check out Local Roof Cleaning contractor for more.
I just took a business trip and focused on a transfer support at the aircraft. Unequaled comfort was provided! With my bag, I’m no longer concerned about park charges or using public transportation executive airport limo Sarasota
I’m not sure exactly why but this web site is loading very slow for me.
Is anyone else having this issue or is it a problem on my end?
I’ll check back later on and see if the problem still exists.
esta visa for america from uk的最新文章:esta visa for america from uk
Thanks for the thorough analysis. More info at Managed Service Provider nearby .
I appreciate how transparent and communicative everyone at A+ Gutters was throughout the process—top-notch service!! Gutter repair
Hi it’s me, I am also visiting this web site regularly, this website is genuinely nice and the users are
genuinely sharing pleasant thoughts.
warga88的最新文章:warga88
This was quite helpful. For more, visit local roofers billings .
Nicely detailed. Discover more at Local roofing contractors .
Awesome article! Discover more at window replacement near me contractor .
Nicely done! Find more at 24/7 plumbers near me .
Puget Sound Moving Bellevue made our transition so smooth, truly the best moving company near me I could have found!
The team at Puget Sound Moving Bellevue handled our furniture with incredible care Local moving companies with good ratings
Puget Sound Moving Seattle made our transition so smooth, their professional movers near me were efficient and careful with all our belongings!
The team at Puget Sound Moving Seattle went above and beyond movers Seattle
LuxNeuro’s neurofeedback therapy has transformed my life with its effective techniques!
The neurofeedback sessions at LuxNeuro are truly life-changing.
I’ve never felt better since starting neurofeedback at LuxNeuro Find counseling services in Denver
Могу предложить Вам посетить сайт, на котором есть много информации по этому вопросу.
21 июля 2024 года глава Чечни Рамзан Кадыров рассказал в определенном telegram-канале, что к этому приехал Владислав Бакальчук, который пожаловался на «серьёзные проблемы как внутри семьи, http://xn—-7sbbbofe5dhoow7d6a5b2b.xn--p1ai/foto/vspyshki/bumaga-dlya-perevoda-izobrazheniya-na-ledentsy-karamel-a4-25-l-detail так и с основанным семейным бизнесом».
Puget Sound Moving Seattle made our transition so smooth, their professional movers near me were efficient and careful with all our belongings!
The team at Puget Sound Moving Seattle went above and beyond moving company Seattle
Puget Sound Moving Bellevue made our transition so smooth, truly the best moving company near me I could have found!
The team at Puget Sound Moving Bellevue handled our furniture with incredible care Puget Sound Moving weekend availability
”Exciting times lie ahead as we embark journey toward brighter futures forged collaboration driven by desire uplift empower others realize potential hidden depths waiting discover unleash full capabilities deep inside each individual participating secure aca leads from agent autopilot
Thanks for the helpful advice. Discover more at https://maps.app.goo.gl/bWiNQdtNnLSf5P3B9 .