或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Who else envisions potential harmonizing indoor/outdoor living experiences creating seamless transitions fostering connectivity among nature enhancing overall well-being positively enriching lives ultimately thriving together as families??? Join exchanges Tampa modern decor
Connecting with nature while volunteering for clean-up days along our waterways makes such a difference—have you participated yet? Get involved opportunities detailed on my site, Auto Glass !
Your web publication has impressed me to elevate my baking video game, beginning with # 3.3L nang tank characteristics #’s N2O rates!
Tôi thấy các trò chơi trên game bài đổi thưởng rất đa dạng, ai có thể gợi ý trò nào hay không?
Love your tips on DIY roof repairs! They tie back perfectly to proper roof installation techniques as well. Visit affordable roofing company options for more ideas!
Nicely done! Find more at Emergency Electrician .
Mọi người nghĩ gì về dịch vụ khách hàng của nổ hũ ? Tôi thấy khá tốt.
The company’s entrepreneurial approach {is aimed|oriented|concentrated|pays maximum attention} to {maintenance|maintaining} the status of a leading {player|gamer}, and an #file_linksC:\Users\Admin\Desktop\file\gsa+en+one4anotherLords180420258P2URLBB.txt”,1,N] ensures long-term {growth|growth} and {stability|sustainability|smooth operation}. Recent legislative proposals {aim|are working} {on this|that|that} {to|direct income from {online|internet|virtual}-{betting|sports betting|sports betting} to support problem gambling {entertainment|games} and youth sports.
I enjoyed this article. Check out oil change for more.
“This makes me think about how important it is to have effective CRM systems—excited about exploring options like Agent Autopilot further!! automated CRM for insurance ”
This was very beneficial. For more, visit Roofers .
Reasons Why Online Casinos Are a Global Phenomenon
Online casinos have modernized the casino gaming market, offering an unmatched level of user-friendliness and breadth that conventional gambling houses are unable to replicate. Throughout the last ten years, a large audience around the world have turned to the fun of internet-based gaming due to its anytime, anywhere convenience, exciting features, and widening collections of titles.
One of the main appeals of internet-based platforms is the astounding variety of titles at your disposal. Whether you prefer playing on vintage fruit machine slots, playing through engaging modern slot games, or playing smart in table games like Blackjack, casino websites deliver infinite entertainment avenues. A large number of platforms additionally offer real-time gaming experiences, letting you to connect with actual dealers and other players, all while enjoying the realistic atmosphere of a brick-and-mortar establishment without leaving your home.
If you’re unfamiliar with the world of virtual casino play or hope to explore reputable operators, why not sign up for our dynamic interactive platform? It’s a place where gaming aficionados offer reviews, guiding you to get the most out of your online casino experience. Dive into the conversation and learn more now: вавада телеграм.
Besides the wide selection, internet-based gambling hubs are known for availability.
“Delicious memories linger long after plates empty reminding us why gathering around table matters so much—join us whenever possible!.# ”97#. ” ” spokane best indian restaurants
Happy to have found such a dependable service like chimney sweep houston # here in Houston.
Elevating concerns voiced assists establishing stronger rapport formed between clients attorneys paving way clearer understandings moving forward towards successful conclusions achieved ultimately ! personal injury lawyer near me
Wow that was odd. I just wrote an very long comment but after I clicked submit my comment didn’t appear.
Grrrr… well I’m not writing all that over again. Regardless, just wanted
to say fantastic blog!
logical casino login的最新文章:logical casino login
บริการของพนักงานที่ OMG OneMoreGlass เป็นกันเองสุดๆ เลยครับ! ผับแอนเรสเตอรองท์ ใกล้ฉัน
Kerner Law Group, P.C. provided exceptional service during my case! Their Bronx car accident attorney team is truly top-notch.
I’m so grateful to the Bronx car accident lawyer from Kerner Law Group, P.C. They really helped me through a tough time Pedestrian accident lawyer Bronx
Kerner Law Group, P.C. provided outstanding service as my Bronx car accident attorney.
I highly recommend Kerner Law Group, P.C. for anyone needing a Bronx car accident lawyer.
Thanks to Kerner Law Group, P.C Free consultation car accident lawyer Bronx
Pragmatic Play Gates Of Olympus Oyununda Büyük Kayıplar Yaşıyorum!
casino dede oyunu, Pragmatic Play tarafından sunulan eğlenceli bir slot oyunudur.|Pragmatic Play’in sunduğu Gates of Olympus, efsanevi bir temaya sahiptir. Oyun, Zeus’un büyüleyici dünyasında eşsiz bir macera sunuyor.
Gates of Olympus demo oyna seçeneği ile oyunun nasıl işlediğini öğrenebilir ve kendinizi geliştirebilirsiniz.
Gates of Olympus oyna demo modunda, oyunun farklı özelliklerini ve kazanç sistemini deneyimleyebilirsiniz. Oyunun ana özellikleri arasında çok sayıda ücretsiz dönüş ve yüksek kazanç potansiyeli bulunur. Gates of Olympus ile büyük kazanç fırsatlarını değerlendirin!
Lead generation in the insurance niche can be challenging, but with Agent Autopilot, it’s simplified! agent autopilot reputable insurance marketing
Kerner Law Group, P.C. provided exceptional service during my case! Their Bronx car accident attorney team is truly top-notch.
I’m so grateful to the Bronx car accident lawyer from Kerner Law Group, P.C. They really helped me through a tough time Bronx car accident lawyer
Kerner Law Group, P.C. provided outstanding service as my Bronx car accident attorney.
I highly recommend Kerner Law Group, P.C. for anyone needing a Bronx car accident lawyer.
Thanks to Kerner Law Group, P.C Motorcycle accident attorney Bronx
Thanks for the great information. More at hail damage specialists near Austin .
Always excellent to be told more approximately plumbing protection—thank you for sharing! I’ll be vacationing plumber belmont quickly.
If you’re getting married in Birmingham, don’t forget to check out the local photographers for amazing deals! Birmingham wedding photographers
Sculpted MD Westminster has transformed my life with their hormone replacement therapy!
Thanks to Sculpted MD Westminster, I found the best hormone replacement therapy near me Female hormone replacement therapy
I’ve been thrilled with my results at Sculpted MD, the best medical weight loss near me!
Sculpted MD in Scottsdale Sculpted MD medical weight loss evaluation
Sculpted MD Westminster has transformed my life with their hormone replacement therapy!
Thanks to Sculpted MD Westminster, I found the best hormone replacement therapy near me Low T treatment near me
Appreciate the detailed information. For more, visit Auto Repair Centerville .
What Makes Online Casinos Have Become Highly Preferred Worldwide
Virtual gambling platforms have revolutionized the gambling industry, providing an unmatched level of accessibility and variety that brick-and-mortar establishments fall short of. Recently, a vast number of enthusiasts worldwide have turned to the thrill of virtual gambling in light of its availability, appealing qualities, and widening range of offerings.
One of the key draws of internet-based platforms is the astounding variety of choices available. Whether you prefer interacting with classic one-armed bandits, exploring engaging modern slot games, or mastering skills in strategy-based games like Baccarat, casino websites boast numerous possibilities. Plenty of operators also include real-time gaming experiences, giving you the chance you to participate with real dealers and opponents, all while experiencing the engaging ambiance of a real casino without leaving your home.
If you’re exploring for the first time with the world of online gaming or hope to delve deeper into reliable sites, why not engage with our vibrant gaming forum? It’s a hub where fans offer insights, enabling you to get the most out of your online casino experience. Check out the discussions and see it here now: вавада телеграм.
Besides the wide selection, online casinos thrive in accessibility.
There’s nothing quite like feeling secure knowing capable h Local movers Daytona Beach
I liked this article. For additional info, visit commercial painting service .
Harmony Painting did a fantastic job on my Denver home!
I love the cabinet painting service provided by Harmony Painting!
The best cabinet painting in Denver CO comes from Harmony Painting!
Harmony Painting made my interior walls look Top-rated cabinet painting experts Denver
“Always keep your eyes peeled for quality services in your area with ‘AC repair near me!’” AC repair near me
Avra Dental is my go-to place for dental emergencies. They’re always ready to help!
I recently visited Avra Dental and was amazed by their swift emergency services!
If you’re in Ventura CA and need an emergency dentist, Avra Dental is fantastic Affordable emergency dentist Ventura
Harmony Painting did a fantastic job on my Denver home!
I love the cabinet painting service provided by Harmony Painting!
The best cabinet painting in Denver CO comes from Harmony Painting!
Harmony Painting made my interior walls look Denver cabinet painting experts
Wonderful tips! Find more at https://maps.app.goo.gl/seyCfu1L8P2aVviq5 .
This was a wonderful guide. Check out Electrician near me for more.
Clearly presented. Discover more at interior painting near me .
I’ve been thrilled with my results at Sculpted MD, the best medical weight loss near me!
Sculpted MD in Scottsdale Sculpted MD personalized nutrition plans
Hibernia Bar has the best Irish atmosphere in town! I love spending time there.
I’m so happy to have discovered Hibernia Bar, my go-to Irish bar near me.
If you’re looking for an Irish bar in New York, Hibernia Bar is the place to be Hibernia Bar brunch specials
Avra Dental is my go-to place for dental emergencies. They’re always ready to help!
I recently visited Avra Dental and was amazed by their swift emergency services!
If you’re in Ventura CA and need an emergency dentist, Avra Dental is fantastic Best emergency dentist Ventura CA
Thanks for the practical tips. More at https://maps.app.goo.gl/gsomqk5mWyNVSHqPA .
“Goals set around enhancing aesthetics remain attainable regardless backgrounds… explore possibilities offered throughout resources curated specifically here: %% anyKeyWord%%.” Deck Repair Near Me
Thanks for the valuable insights. More at Outdoor Artificial Grass Landscaping services .
Thanks for emphasizing low-maintenance plants as part of your recommendations; they’re perfect for busy homeowners !## anyKeyWord ## Metal Privacy Fences Oregon
Making prudent choices based upon research conducted could lead significant savings over time thus highlighting importance taking initiative early before committing fully onto chosen paths ahead & discover potential strategies outlined throughout articles Roof Repair Near Me
I appreciate that Nang canisters effectiveness regularly continues me up to date on my order popularity.
Appreciate the detailed insights. For more, visit exterior painting .