或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
. Exploring alternative transportation options may help reduce traffic congestion and minimize accidents auto injury attorney
”Appreciative vibes flowing abundantly across posts here—it serves as motivation knowing help exists just beyond reach while keeping tabs towards discovering opportunities highlighted amid dialogues occurring focused upon logistics explored throughout Groveland full service movers
Thanks for the informative post. More at abogados en Vigo
Consistency in branding across all platforms strengthens local recognition! Explore tips at Expert in on-page SEO optimization
Hi there, You have done a fantastic job. I’ll certainly digg it and personally
suggest to my friends. I’m sure they’ll be benefited from this site.
gede 4d的最新文章:gede 4d
I’ve seen some incredible before-and-after photos from cosmetic dentists in Los Angeles. It’s inspiring to see how much of a difference they can make emergency dentist studio city
Where aⅼways be very betting sites additionalⅼy,
үou will can a person know if tһey are ⅼegal? This is a awfullү
good enquiry. There are several guidelines adhere to ԝhen searching for the right betting weЬ.
Since there are extremely many determіne on from, proper sitе should be inviting.
These typeѕ οf be to be able to navigate thrοugh, and it should feel satisfied.
Deciding which sitеs to visit, card ցambling oг sports gambling may be the first
saut. Online poker sites have gаined in popularity over time.
Thesе ѕiteѕ are fun ƅecause they are also
іnstructive. Many people begin using these sites learn the correct bеfore plɑying аt a reɑl pokеr game.
Bonus is often a multiplе сount of cash where its claimed as rіsk free techniques to
place any choices. However, it seems yoᥙ neѵer tһіnk itrrrs great if you lose.
Whenever you know, every betting must involve tԝo ѕides a good oppоsite.
Ⴝpecialists . call it Ьetting exchanges
and bߋokmaҝers. Bookmakeгs like a friend of you thɑt will win ought to yοu win.
Then your next step that have to do is to evaluate tһe bonus
which is proviԁed on the games. If your bonus are going to more total amount that sһipped to you ᴡiⅼl definitely be mᥙch more.
Thus it becomes very necessary learn hοw to win at
Casino s оnline if you don’t you can lose your dollars. Ƭhe peopⅼe must alѕo be
privy to the Wаgering Requirement which usually nothing however thе percentage of bonus a person ԝill get if you ѡin. So there
loads of items that come inside of effect if yoᥙ get to
learn about the waү to win online casino.
Now, permit me to come to sports ⲣlayіng. If your рortal offers sports betting choose betting on games which are popսlar
the actual country the portal is targetеd togetһer with.
In US baѕeball dеfіnitely needs being in the list whilе in Europe they will
be sports. Other interesting games can easily draw people to place bets are F1
racing, cricket and snooker. The right games is likely to make
all the main between a really and failᥙre of
computer ցames site. On-line is dynamіc and changes rapidly.
It is important to understand player psychology and keеp a close track on tһe games are generally being ⲣⅼaүed
more often than definitely. Based upon the input it crucial to align the gaming oрtions inside of site.
There a couple of days a person first find it doesn’t matter ԝhat you
play, ultimately you droopіng. In such a daү, it a very good idеa to ѕtoⲣ and keep extra for an additional pair day.
Casino Online marketers use them when they
find that they’re not equipped to win just one game, they keep on betting on other games
and ultimately they land up fгom a mess.
Ϝree online slots are matched to the same regulations and tactiϲs ɑctual slots.
And, while observіng not have the same busyness aѕ an absolute Casino Online betting, could probably be just as
excited. Best of all, could certainly play in the comforts of one’s own assеt.
Tһat’s great news if you like pⅼaying within your paјamas.
Other regarding betting programs include poker, backgammon, and dominoes.
Each time a game could be played online, there is гeally a site out tһеre that takes bets on the cover.
If a person likeѕ perform games with others, eаch of
the ingredients the sites for them all. It iѕ exciting to win a hand at poker-online.
It is like staying in the cart. For thosе who do not lіve to your neighbors to a casino, plɑying cards іs madе ѕimple with the web.
In օrder to win at οnline casino, you need to understand fundamental premisе tips or strategies the
ways to play simple . game in a winning way s᧐ that you will minimize acquire waterbοrne illnesses
losing and stay at most dеѕirable chance of winning.
Heгe is my blog … portfolio.newschool.edu
portfolio.newschool.edu的最新文章:portfolio.newschool.edu
Wow, I had no idea about the impact of hard water on plumbing systems! Your insights are invaluable. Learn more at plumber Canberra
Just had my first appointment with a Tacoma chiropractor and it was amazing! Thanks for the tips on finding one, Tacoma Chiropractor
Best decision I ever made was to work with Greg Wolff for my health insurance Best Health insurance agent
Wonderful site. Plenty of useful info here. I’m sending
it to a few friends ans also sharing in delicious. And certainly, thank you in your sweat!
Here is my blog … خرید بک لینک
خرید بک لینک的最新文章:خرید بک لینک
This paragraph will assist the internet visitors for setting up new blog or even a blog from
start to end.
drake rapper的最新文章:drake rapper
Pin Up Казино на просторах Казахстана – это казино с хорошей репутацией для тех, кто ищет азарт. Здесь предоставляются отличные условия для развлечений и крупных выигрышей. Если вы хотите найти проверенное казино, то Pin Up Казино создано для вас.
Преимущества Pin Up интернет-казино
Большой ассортимент игр. Пользователям доступен более 2000 слотов и игр, настольных игр и игр с живыми дилерами. В каталоге игр представлены разработчики уровня Play’n GO и ещё много других. Это значит, что каждая игра адаптирована для любого устройства, оптимизированные для телефонов и ПК.
Специальные предложения и бонусы. Каждый новый игрок получит щедрые приветственные бонусы, которые дадут хорошие шансы на выигрыш. Кроме приветственных бонусов, доступны кэшбэки, дополнительные фриспины и акции для постоянных игроков, что даёт возможность выиграть ещё больше.
Наш сайт: https://abai.kz/index.php/lt/post/58719
Честность и надёжность. Pin Up интернет-казино использует современные технологии для защиты данных и транзакций, чтобы обезопасить вашу игру. Казино работает по лицензии гарантирует честную игру и мгновенные выплаты выигрышей.
Мобильность и удобство использования. Pin Up полностью оптимизировано для мобильных устройств, что позволяет играть в любимые игры в любом месте. Есть приложение для мобильных или просто использовать браузер для игры на смартфоне.
Обслуживание клиентов. В любых трудностях, служба поддержки Pin Up Казино всегда на связи. Вы можете задать вопрос операторам через электронную почту, и вам помогут решить любые вопросы на любом удобном для вас языке.
Such practical advice here! Plumbing issues can be stressful; that’s why I rely on Plumbing Company whenever needed
Very useful post. For similar content, visit hardwood flooring
Wow, amazing blog layout! How long have you been blogging for?
you make blogging look easy. The overall look of your web site is great, let
alone the content!
viagra的最新文章:viagra
Thanks for the useful suggestions. Discover more at Plumber Near Me
I do not know whether it’s just me or if perhaps everyone else
encountering problems with your website. It appears like some of the text
within your posts are running off the screen. Can somebody else please
comment and let me know if this is happening to them as well?
This could be a issue with my internet browser because I’ve had this happen previously.
Kudos
Here is my website พนันออนไลน์ เว็บไหนดี เครดิตฟรี
พนันออนไลน์ เว็บไหนดี เครดิตฟรี的最新文章:พนันออนไลน์ เว็บไหนดี เครดิตฟรี
This is such a valuable resource for truck drivers! Semi towing can really enhance performance and safety heavy duty towing near me
Thanks for sharing such a nice thought, post
is fastidious, thats why i have read it completely
bbigcasino的最新文章:bbigcasino
I’ve had great experiences with my partial dentures , and this article reflects those benefits perfectly
Thanks for the great information about tree trimming! I’ll definitely be reaching out to tree removal soon
This was highly educational. For more, visit tandartspraktijk Apeldoorn
Internet-based gambling hubs have transformed the betting scene, offering an unmatched level of accessibility and range that traditional gambling houses struggle to rival. Over the past decade, a growing community across the globe have embraced the thrill of digital casino play due to its anytime, anywhere convenience, captivating elements, and ever-expanding selection of games.
If you’re new with the world of virtual gambling or hope to discover reliable sites, why not become part of our lively gaming forum? It’s a platform where enthusiasts exchange insights, making it easier for you to improve your online casino experience. Dive into the community and visit us now: https://www.valeurs-francaises.fr/web/Valeurs-de-la-Chanson-francaise.html
One of the biggest attractions of online gaming options is the vast variety of titles ready to play. Whether you like spinning classic slot machines, trying out theme-based video-based games, or mastering skills in classic casino games like Blackjack, internet-based gambling sites deliver limitless possibilities. Many casinos furthermore offer live dealer games, letting you to participate with real dealers and other players, all while immersing yourself in the realistic atmosphere of a physical gaming house in your own space.
Apart from the game range, virtual gambling platforms shine accessibility.
This was quite informative. For more, visit abogado laboralista Sevilla
Wonderful tips! Find more at fábrica de cocinas en Granada
Has anyone switched chiropractors Everett Accident chiropractor reviews
Great job! Find more at seguros para estudiantes
Good day! This is my first visit to your blog! We are a team of
volunteers and starting a new initiative in a community in the same niche.
Your blog provided us valuable information to work on. You have done a
marvellous job!
Design and Build pleasant hill的最新文章:Design and Build pleasant hill
This was highly educational. For more, visit Breda makelaarskantoor
Does any person possess referrals for reputable security personnel companies in Texas? I’ve discovered some useful relevant information at security guards near me that might
Лучшие девушки Донецка ждут вас на нашем сайте, чтобы поделиться настоящими моментами счастья. Каждая красавица готова сделать ваш вечер незабываемым, а удобный интерфейс позволит вам легко с ней связаться. Не упустите возможность испытать это на себе https://t.me/prostitutki_donetsk_individualki
Регулярные обновления на 5play1.ru — у нас ты найдешь только игры с русским языком! Мы постоянно добавляем новые версии игр с русским интерфейсом и обновляем уже существующие, чтобы ты всегда мог наслаждаться игрой на родном языке. Скачивай игры с русским языком для Android без ограничений — всё бесплатно, быстро и безопасно!
Если вы готовы к настоящему приключению, индивидуалки Мариуполя ждут вас с открытыми объятиями. Они знаКак создать уникальную атмосферу для истинных ценителей интима. Погрузитесь в их мир, наполненный страстью и нежностью, и наслаждайтесь каждым мгновением https://t.me/prostitutki_mariupol_indi
Your style is really unique compared to other people I’ve read stuff from.
Thank you for posting when you have the opportunity, Guess I will just book mark this
blog.
Erek Erek 2D Bergambar的最新文章:Erek Erek 2D Bergambar
I feel this is one of the so much significant
info for me. And i am satisfied studying your article.
But should statement on some common things, The website taste is wonderful, the articles is in reality excellent :
D. Just right task, cheers
bokep indonesia的最新文章:bokep indonesia
Great delivery. Great arguments. Keep up the amazing spirit.
yen china的最新文章:yen china
Home protection exams have to be a priority when constructing a plan for long-term wellbeing—uncover sources on this theme at gloucester senior care Care Right There NJ
Регулярные обновления на 5play1.ru — у нас ты найдешь только игры с русским языком! Мы постоянно добавляем новые версии игр с русским интерфейсом и обновляем уже существующие, чтобы ты всегда мог наслаждаться игрой на родном языке. Скачивай игры с русским языком для Android без ограничений — всё бесплатно, быстро и безопасно!
Does anyone know of good movers in Grovel Groveland commercial movers
I’m so glad I took the plunge into cosmetic dentistry; it’s been life-changing! For tips and info dentist sherman oaks
Just had a wonderful experience with Summit Services for my AC repair—professional Air conditioning repair
Howdy! I could have sworn I’ve been to this blog before but after
checking through some of the post I realized it’s
new to me. Anyways, I’m definitely happy I found it
and I’ll be bookmarking and checking back frequently!
madepornstories.com的最新文章:madepornstories.com
Virtual gambling platforms have changed the gambling industry, offering an unmatched level of ease and selection that land-based casinos can’t match. Recently, countless gamblers across the globe have welcomed the fun of virtual casinos as a result of its anytime, anywhere convenience, thrilling aspects, and widening catalogs of games.
If you’re a beginner with the world of online gaming or seek to explore trusted platforms, why not engage with our dynamic interactive platform? It’s a hub where gamblers share stories, making it easier for you to enjoy more of your gambling adventure. Join the discussions and start your journey now: http://hptech.co.kr/bbs/board.php?bo_table=04_order&wr_id=57739
One of the strongest selling points of online casinos is the unparalleled variety of entertainment options provided. Whether you love playing on retro reel games, diving into plot-filled video slots, or strategizing in table games like Baccarat, internet-based gambling sites feature countless opportunities. Numerous services even include live casino options, giving you the chance you to interact with human game hosts and other players, all while soaking in the immersive ambiance of a physical gaming house right at home.
In addition to diversity, internet-based gambling hubs stand out availability.
Appreciate the useful tips. For more, visit Plumber Near Me
Just had an incredible chocolate cake that was completely plant-based! Check out the recipe at vegan bakery bristol
Do you have any success stories about pregnant women seeing chiropractors in Tacoma? Would love insights from Chiropractor Tacoma
Are there any grants or programs that help with home flooring upgrades specifically in Colorado? arvada floor company
Had a wonderful experience with tree care just trees CO Arvada for my tree removal needs in Arvada. They truly care about their customers
Awesome article! Discover more at abogados en Vigo