或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
I appreciate how knowledgeable the staff are about every piece of jewelry—they’re so Trendy gold and silver jewelry
Hi Dear, are you truly visiting this site on a regular basis, if so after that you will definitely obtain good know-how.
tc lottery login的最新文章:tc lottery login
This was a wonderful post. Check out cheap car rental for more
This was quite informative. For more, visit Labo Dental
Thanks for finally talking about > 在CentOS[lnmp]上部署新版本SSL协议+ECDHE_RSA正向加密和预防BEAST攻击 –
漩窝 < Loved it!
here的最新文章:here
Useful advice! For more, visit Denver Prints Co
Thanks for the insightful write-up. More like this at klinika stomatologiczna warszawa
سلام مقاله خوبی بود دوربین هایک ویژن https://sites.google.com/view/hikvisiontehran/
قیمت هایک ویژن的最新文章:قیمت هایک ویژن
Zou leuk zijn als elke praktijk regelmatig feedback verzamelt zodat ze hun service kunnen blijven verbeteren!! # # anyKeyWord # tandartspraktijk
Thanks for the clear breakdown. More info at Harmoney Drywall & Texture
I’ve been struggling with a leaky faucet for weeks! Your suggestions are just what I needed. Explore more helpful content at plumber Canberra
Digital casinos have revolutionized the gaming industry, offering a level of ease and diversity that land-based gambling houses fall short of. In recent years, a large audience around the world have chosen the excitement of virtual casinos due to its anytime, anywhere convenience, captivating elements, and constantly growing game libraries.
If you’re just starting with the world of internet-based gaming or are looking to learn about reliable sites, why not sign up for our dynamic interactive platform? It’s a platform where fans post stories, helping you to enjoy more of your online casino experience. Check out the experience and learn more now: http://jbnucri.com/bbs/board.php?bo_table=companylist&wr_id=50503
One of the strongest selling points of virtual gambling hubs is the astounding variety of games provided. Whether you enjoy spinning classic slots, immersing yourself in narrative-rich thematic slots, or exercising tactics in card and board games like Texas Hold’em, digital casinos deliver infinite entertainment avenues. Several sites even introduce interactive dealer games, enabling you to communicate with professional croupiers and other players, all while soaking in the lifelike environment of a brick-and-mortar establishment from the comfort of your home.
Apart from the game range, virtual gambling platforms are known for availability.
This was highly helpful. For more, visit towing near me
Thanks for the detailed guidance. More at https://penzu.com/p/f971e31cb6b7fac8
This blog is just what I needed! Finding a good plumber in Brisbane can sometimes feel overwhelming plumber
Thanks for the helpful advice. Discover more at https://givestar.io/profile/e26a766a-1e4b-406d-ad41-1c7a3542f6e9
This was highly useful. For more, visit https://null.community/profile/70537-ramgskill
This was a wonderful post. Check out https://www.faneo.es/users/ramecchoanghapc/ for more
This was a fantastic resource. Check out https://jobs.lajobsportal.org/profiles/6224491-ram-may-tinh-corsair for more
I found this very interesting. Check out https://hub.docker.com/u/nguongigabyte for more
Appreciate the detailed post. Find more at https://3dlancer.net/profile/u1087325
Appreciate the thorough information. For more, visit https://motion-gallery.net/users/728091
I appreciated this post. Check out https://inkbunny.net/nguonsegotep for more
I appreciated this article. For more, visit http://www.fanart-central.net/user/psusuperflower/profile
I’ve learned so much about investing simply by following along with updates from ### anyKeyWord### cash home buyers near me
I’ve been browsing online more than three hours these days,
but I by no means discovered any fascinating article like yours.
It is pretty value sufficient for me. Personally, if
all web owners and bloggers made excellent content
as you did, the internet might be a lot more useful than ever before.
bokep indonesia的最新文章:bokep indonesia
Its not my first time to go to see this web page, i am visiting this web page dailly and get nice
information from here daily.
Here is my blog post zupea02
zupea02的最新文章:zupea02
Highly descriptive blog, I liked that bit. Will there be a part 2?
dewi 288的最新文章:dewi 288
It’s amazing how an SEO agency can transform a website’s traffic SEO marketing company
Hello there! Would you mind if I share your blog with my zynga group?
There’s a lot of people that I think would really enjoy your content.
Please let me know. Many thanks
بهترین میوه بعد از عمل جراحی چشم的最新文章:بهترین میوه بعد از عمل جراحی چشم
Ты можешь скачать моды на topandroidmods.ru с уверенностью, что они прошли полную проверку безопасности и доступны для мгновенной загрузки. Все моды на сайте обновляются регулярно, чтобы ты мог всегда получить свежие и безопасные версии. Мы обеспечиваем быструю загрузку и полную безопасность файлов!
Thanks for the thorough analysis. More info at LavoDent
Appreciate the insightful article. Find more at Denver Pain Relief Specialists
Советую Вам посмотреть сайт, на котором есть много информации по этому вопросу.
bundan tashqari, bizning saytimizda mostbet mavjud bo’lim mostbet o’z ichiga olgan tez-tez so’raladigan savollar (faq) kompaniyasibatafsil javoblar eng ko’p umumiy o’yinchi so’rovlari.
This was very beneficial. For more, visit Harmony Drywall & Texture
Appreciating the commitment you put into your website and in depth information you
present. It’s nice to come across a blog every once in a while that isn’t the same old rehashed information.
Wonderful read! I’ve bookmarked your site and I’m including your RSS feeds to my Google
account.
https://www.2basnob.com/的最新文章:https://www.2basnob.com/
Virtual gambling platforms have transformed the betting landscape, providing a unique kind of comfort and range that conventional casinos don’t provide. In recent years, a large audience globally have welcomed the excitement of online gaming in light of its anytime, anywhere convenience, captivating elements, and constantly growing game libraries.
If you’re new with the world of digital casinos or would like to discover safe services, why not join our dynamic community? It’s a platform where gaming aficionados post tips, making it easier for you to enhance your gaming journey. Check out the discussions and see it here now:
One of the biggest attractions of digital gambling sites is the sheer selection of titles at your disposal. Whether you are a fan of spinning traditional slots, playing through plot-filled thematic slots, or strategizing in table games like poker, digital casinos deliver countless entertainment avenues. Numerous services also offer interactive dealer games, enabling you to interact with human game hosts and fellow gamblers, all while immersing yourself in the realistic atmosphere of a brick-and-mortar establishment from the comfort of your home.
Besides the wide selection, virtual gambling platforms stand out accessibility.
Baywin Bahis Platformu, internette bahis alan?nda ad?ndan s?kca soz ettiren bir web sitesidir. Musterilerine sundugu kapsaml? oyun yelpazesi, kolay erisim imkan? ve kaliteli hizmet sunumu ile begeni toplamaktad?r.
Bilhassa platforma erisim saglamak ve guncel giris adresleri, platformun kullan?c?lar? icin s?k sorulan meseleler aras?nda yer bulunmaktad?r.
Baywin Nedir?
Bay Win, online bahis ve casino dunyas?nda basar?l? bir platformdur. canl? bahisler, poker ve baccarat, dijital oyunlar gibi cok say?da oyun secenegine sahiptir.
Platformun en onemli avantajlar?ndan biri, kazanc oranlar?n? maksimize etmesidir. Ayr?ca, kolay ve h?zl? odeme yontemleri, finansal guvenlik sunar.
Baywin Giris Sorunlar? ve Cozumleri
Web: https://www.cintell.net/
Bahis platformunun engellemelerle kars?lasmas? olagand?r, ancak bu tur durumlar icin Platformun yonetimi h?zl?ca harekete gecmektedir.
Erisim engellemeleri gerceklestiginde, Baywin guncel giris adresini hemen aktif eder ve paylas?r. Bu yontemle, Baywin guncel linki uzerinden kullan?c?lar oyunlar?n? kesintisiz oynayabilir.
Yeni adrese erisim saglamak amac?yla kolay yontemler gelistirilmistir. Ak?ll? telefonlar, tabletler ve PC’ler uzerinden siteye erisim saglanabilir. Baywin’in her yerden erisilebilirligini art?r?r.
Many businesses underestimate the power of SEO. An agency such as SEO expert can guide you in the right direction
Excellent discussion about search engine algorithms SEO company
Все моды на topandroidmods.ru прошли тщательную проверку на вирусы, и ты можешь быть уверен в их безопасности. Мы также следим за тем, чтобы файлы были всегда актуальными и без угроз.
Has anyone tried the capabilities from roof and gutter cleaning Nanaimo for roof cleansing? I’m curious approximately their task
It’s attention-grabbing how common protection can prolong the life of an AC unit substantially—thank you for sharing this wisdom! I’ll discuss with hvac contractors hamilton
Is er behoefte aan meer transparantie rondom prijzen binnen bepaalde behandelingsmethodes binnen t tandartspraktijk
Avoid costly blunders by way of hiring an experienced commercial attorney in Dubai! Learn more at business lawyer dubai THINC – The In-House Company
It’s remarkable to visit this web page and reading the views of all friends about this post,
while I am also eager of getting familiarity.
hokidewa的最新文章:hokidewa
Believing oneself integral key unlocking potential inherent within each person nurtured supported environments conducive growth development fostering collaborative efforts yielding fruitful outcomes benefiting everyone involved collectively pursuing arlington tx chiropractor
This was very beneficial. For more, visit tienda de cocinas en Granada
Love your submit on natural pest regulate! It’s excellent to work out green features. Discover extra at Natural Pest Solutions Kamloops
I found this very helpful. For additional info, visit tandarts Apeldoorn