或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
I wish I had known about hiring a motor vehicle accident lawyer sooner! If you’re in this situation, visit motor vehicle accident attorney for guidance
Rejoignez notre casino en ligne sans attendre et tirez avantage d’un Bonus exclusif de 100% ! Avec un acces simplifie et un acces securise, vous etes a un instant de l’excitation. N’oubliez pas d’utiliser votre coupon exclusif pour maximiser vos avantages . Consultez les retours des joueurs pour en savoir plus sur pourquoi tant de joueurs nous font confiance . Accedez a votre compte facilement avec notre acces instantane et explorez un monde de divertissement avec notre plateforme innovante . Partant pour l’aventure ? Demarrez votre session avec le meilleur du gaming !
Essayez des aujourd’hui notre casino en ligne et beneficiez d’un offre exclusive pour nouveaux joueurs pour augmenter vos gains. Que vous soyez un debutant ou confirme , ce bonus est concu pour vous offrir une session de jeu optimisee. Ne manquez pas de nos offres exclusives grace a un bon de reduction . Utilisez notre application mobile pour acceder a vos jeux favoris, tout le temps. Pour commencer , connectez-vous simplement via casinozer se connecter et accedez a un espace gaming captivant. Consultez egalement les casinozer avis pour decouvrir ce que notre communaute apprecie.
Inscrivez-vous sur notre plateforme.
Utilisez votre code promo casinozer pour augmenter vos recompenses. Recuperez votre recompense et commencez a jouer immediatement . Avec casinozer gg , vous etes assure de profiter d’un divertissement exceptionnel . Rejoignez-nous des maintenant et vivez le meilleur du gaming en ligne.
Link: https://livetechspot.com/casinozer-casino-france-offre-bonus-bienvenue-100-pour-cent-2/
Decouvrez une plateforme innovante avec notre casino en ligne . Que vous soyez un expert de bandits manchots, de poker ou de hasard, notre plateforme propose une bibliotheque de jeux variee pour tous les gouts . Ne manquez pas l’opportunite de maximiser vos gains avec un code de reduction . Grace a nos offres regulieres , vous beneficiez de bonus incroyables . Pour une accessibilite sans faille , installez l’ app dediee et amusez-vous en deplacement , tout le temps. Les Avis Casinozer confirment la excellence de cette plateforme . Connectez-vous facilement avec notre systeme securise et plongez dans un espace ludique immersif . Rejoignez notre site des aujourd’hui et laissez-vous emporter par l’experience.
My favorite thing about ### anykeyword### is their commitment to quality and customer satisfaction Handmade jewelry for sale
Fantastic tips on troubleshooting! Boiler repair can be tricky. I found more helpful resources at emergency boiler repair edinburgh
Online casinos have reshaped the casino gaming world, providing a unique kind of ease and selection that physical venues can’t match. Over time, a growing community internationally have welcomed the pleasure of virtual gambling due to its ease of access, thrilling aspects, and progressively larger game libraries.
If you’re just starting with the world of internet-based gaming or would like to find out more about reputable operators, why not become part of our lively social network? It’s a destination where players post tips, enabling you to maximize your gambling adventure. Explore the connections and see it here now:
One of the main appeals of digital gambling sites is the vast diversity of games at your disposal. Whether you are a fan of rolling traditional slot machines, immersing yourself in plot-filled video-based games, or testing your strategy in table games like Baccarat, internet-based gambling sites feature endless entertainment avenues. A large number of platforms additionally present live dealer games, letting you to engage with live hosts and gaming peers, all while soaking in the realistic feel of a land-based casino right at home.
Beyond variety, virtual gambling platforms excel ease of access.
Hello, just wanted to say, I liked this article. It
was practical. Keep oon posting!
my web page http://users.atw.hu/samp-info-forum/index.php?PHPSESSID=4a1ede9d18d535bd964d93e2ec451f08&action=profile;u=186064
http://users.atw.hu/samp-info-forum/index.php?PHPSESSID=4a1ede9d18d535bd964d93e2ec451f08&action=profile;u=186064的最新文章:http://users.atw.hu/samp-info-forum/index.php?PHPSESSID=4a1ede9d18d535bd964d93e2ec451f08&action=profile;u=186064
Dank voor deze informatieve blogpost; ik ga zeker meer aandacht besteden aan mijn t tandarts
Hi there, just wanted to say, I enjoyed this post.
It was inspiring. Keep on posting!
my blog – https://mixclassified.com/user/profile/775809
https://mixclassified.com/user/profile/775809的最新文章:https://mixclassified.com/user/profile/775809
I gotta favorite this site it seems extremely helpful invaluable.
my blog post; https://e-plaka.com/197498-2/
https://e-plaka.com/197498-2/的最新文章:https://e-plaka.com/197498-2/
Understanding your rights after a car accident is essential. A motor vehicle accident lawyer can provide the guidance you need. Learn more at motor vehicle accident lawyer near me
Heavy-duty towing can be a lifesaver in emergencies heavy duty towing
This was quite useful. For more, visit Bird Dog Trainer Near Me
Hello, just wanted to mention, I loved this post. It was helpful.
Keep on posting!
Here is my page :: https://skills4sports.eu/blog/index.php?entryid=27717
https://skills4sports.eu/blog/index.php?entryid=27717的最新文章:https://skills4sports.eu/blog/index.php?entryid=27717
The advice about getting quotes from multiple plumbers in Brisbane is so true! I saved a lot of money that way cpr
Lovelly just what I was looking for. Thanks to the author for taking his clock time on this one.
My weeb page: https://www.ch-valence-pro.fr/CollDSIO/community/profile/rosettatan3160/
https://www.ch-valence-pro.fr/CollDSIO/community/profile/rosettatan3160/的最新文章:https://www.ch-valence-pro.fr/CollDSIO/community/profile/rosettatan3160/
I found relief from migraines after starting treatment with a # chiropractic care dallas # here in Dallas—such a
Aw, this was ann exceptionally good post.
Spending some time and actual effort to creafe a good article…
but what can I say… I put things off a whole lot and
don’t seem to get nearly anything done.
my page: https://knowledgekh.com/blog/index.php?entryid=140011
https://knowledgekh.com/blog/index.php?entryid=140011的最新文章:https://knowledgekh.com/blog/index.php?entryid=140011
Determined continue building upon foundation laid down thus far focusing solely achieving optimal levels wellness achieved primarily through unwavering support offered via direct involvement stemming directly originating from those practicing under field arlington tx chiropractor
Great resources for finding moving companies in Belle Glade exist online—start your search at Belle Glade Mover’s
I love how you highlighted the importance of qualifications for plumbers in Brisbane Chest Compressions
Online casinos have modernized the betting industry, delivering an unmatched level of convenience and selection that land-based gambling houses struggle to rival. Recently, countless gamblers around the world have turned to the fun of internet-based gaming thanks to its anytime, anywhere convenience, appealing qualities, and widening selection of games.
If you’re new with the world of virtual casino play or seek to learn about proven options, why not participate in our dynamic community? It’s a hub where enthusiasts discuss tips, making it easier for you to enjoy more of your casino activities. Discover the connections and see it here now: https://www.ozportal.tv/home.php?mod=space&uid=2849434&do=profile&from=space
One of the key draws of digital gambling sites is the unparalleled array of titles provided. Whether you are a fan of spinning vintage slot machines, trying out plot-filled visual slot games, or playing smart in table games like Texas Hold’em, casino websites deliver countless opportunities. Several sites moreover include live gaming streams, letting you to engage with live hosts and fellow gamblers, all while enjoying the engaging vibes of a brick-and-mortar establishment in your own space.
Beyond variety, virtual gambling platforms thrive in availability.
Your tips on energy-efficient boilers were eye-opening! For more insights boiler repair cost edinburgh
Скачивай моды с [url=https://mod-zone.ru]mod-zone.ru[/url] по прямой ссылке — никаких долгих ожиданий! Все файлы доступны мгновенно и без ограничений!
Basically to follow up on the update of this subject on your web-site and would like to let you
know how much I treasured the time yoou took to producee this useful post.
Within the post, you actually spoke oon how to truly handle this problem with all convenience.
It would be my own pleasure to accumulate some more strategies from your web-site
and come as much as offer otherr people what I have learned from you.
Thank you for your usual terrific effort.
My web site – https://prospertify.com/2025/02/25/the-best-schools-their/
https://prospertify.com/2025/02/25/the-best-schools-their/的最新文章:https://prospertify.com/2025/02/25/the-best-schools-their/
There is evidently a bunch to realize about this. I suppose yyou
made certain good points in features also.
Also visit my website – http://librarymice.com/picturebook-appreciation-club/profile/dottyduerr5887/
http://librarymice.com/picturebook-appreciation-club/profile/dottyduerr5887/的最新文章:http://librarymice.com/picturebook-appreciation-club/profile/dottyduerr5887/
This was nicely structured. Discover more at cheap car rental toronto
На mod-zone.ru скачивание модов происходит по прямой ссылке, без задержек и ожиданий. Мы гарантируем, что каждый файл доступен для мгновенной загрузки. Просто заходи на сайт, выбирай нужный мод и скачивай без лишних шагов. Получай файлы сразу и без ожиданий!
Just favor to claim thanks lower back to # moss removal Nanaimo #; your team did wonders on our old
This ebook has empowered me as a home-owner—I consider waiting now if whatever thing goes unsuitable with my formulation; checking to come back by hvac companies hamilton
I gotta bookmark this wweb site it seems very beneficial very beneficial.
Review my site … http://xn--o39akk533b75wnga.kr/bbs/board.php?bo_table=review&wr_id=16304
http://xn--o39akk533b75wnga.kr/bbs/board.php?bo_table=review&wr_id=16304的最新文章:http://xn--o39akk533b75wnga.kr/bbs/board.php?bo_table=review&wr_id=16304
I enjoyed this post. For additional info, visit Apeldoorn tandartspraktijk
I’ve been struggling with a leaky faucet for weeks! Your suggestions are just what I needed. Explore more helpful content at plumber
I came upon perfect counsel on hiring a advertisement lawyer in Dubai on commercial Lawyer THINC – The In-House Company Dubai
This was quite enlightening. Check out Breda makelaardij for more
I found this very interesting. For more, visit requisitos nacionalidad española
If you’re planning a day out with your pooch nightclub
Vooral als je bang bent voor beh tandarts
Yay google is mmy world beatr helped me to find this outstanding web site!
Feel free to visit my webpage https://dethi365.vn/blog/index.php?entryid=166075
https://dethi365.vn/blog/index.php?entryid=166075的最新文章:https://dethi365.vn/blog/index.php?entryid=166075
I consider something genuinely special in this internet site.
my page: https://www.spairkorea.co.kr:443/gnuboard/bbs/board.php?bo_table=g_inquire&wr_id=3610741
https://www.spairkorea.co.kr:443/gnuboard/bbs/board.php?bo_table=g_inquire&wr_id=3610741的最新文章:https://www.spairkorea.co.kr:443/gnuboard/bbs/board.php?bo_table=g_inquire&wr_id=3610741
Internet-based gambling hubs have modernized the casino gaming world, providing a unique kind of ease and diversity that traditional gambling houses don’t provide. Recently, countless gamblers internationally have chosen the excitement of online gaming thanks to its accessibility, thrilling aspects, and constantly growing range of offerings.
If you’re unfamiliar with the world of virtual casino play or hope to delve deeper into safe services, why not participate in our lively online hub? It’s a space where gamblers exchange reviews, guiding you to improve your online casino experience. Discover the discussions and learn more now: http://cocacola.blog.rs/blog/cocacola/nagradne-igre/2012/05/01/coca-cola-fudbalmanija
One of the strongest selling points of internet-based platforms is the incredible variety of entertainment options ready to play. Whether you love spinning old-school fruit machine slots, exploring story-driven modern slot games, or playing smart in classic casino games like Baccarat, casino websites deliver countless entertainment avenues. Plenty of operators moreover include interactive dealer games, making it possible for you to engage with real dealers and co-players, all while enjoying the authentic environment of a physical gaming house in your own space.
Adding to the extensive catalog, internet-based gambling hubs thrive in ease of access.
Thanks for breaking down the signs of a failing boiler! More information can be found at emergency boiler repair edinburgh