或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Very useful information here about maintaining drains! Everyone should know these basics. Check out more at plumbing services !
Fantastic guidance, thanks! Just how frequently should I check in with my electrical contractor throughout a project? dallas electricians
Have you considered optimizing your law firm’s website? It could drastically improve client engagement; learn how at dallas ppc agency .
https://champion-sport.ru
Trong đội tuyển bóng đá quốc gia hiện tại thì cầu thủ nào khiến bạn ấn tượng nhất ??? Tôi khá thích phong cách chơi của anh ấy !!! ## anykeyword ## Visit here
Remarkable insights shared throughout this whole blog site item– it’s extremely practical electrical contractors near me
“The importance of good communication with your moving team cannot be overstated—I learned that from my experience with folks at Ochopee full service movers #.”
Omni Dental Specialty saved my weekend when I needed an emergency dentist in Oxnard CA. Their team was amazing!
I’m so grateful for Omni Dental Specialty’s emergency dentist services. They relieved my pain quickly and professionally Broken tooth pain relief Oxnard
The thrill of navigating through thrilling environments during high-stakes moments is unparalleled—what’s a memorable level from an action game that left an impression on you? Share memories with us over on Find out everything !
Appreciate your efforts in assembling such necessary recommendations on employing experienced electrical contractors; it’s truly valued by lots of edison electricians of rancho cucamonga
Sculpted MD transformed my life with their medical weight loss program!
I found the best medical weight loss near me at Sculpted MD!
Sculpted MD in Highlands Ranch CO offers incredible medical weight loss solutions Weight management assistance Highlands Ranch CO
Sculpted MD has transformed my life with their amazing semaglutide treatments!
I had an incredible experience at Sculpted MD getting semaglutide near me Local weight loss clinics
Oxnard Dentistry made my dental visit so comfortable, their dentist was professional and gentle throughout my entire appointment!
I’ve been searching for a reliable dentist near me for years, finally found perfection at Oxnard Dentistry Tooth extraction aftercare Oxnard Dentistry
Kerner Law Group, P.C. provides exceptional service as a Bronx car accident attorney. Their expertise is truly unmatched!
I’m grateful for the dedicated support from Kerner Law Group, P.C. as my Bronx car accident lawyer.
Choosing Kerner Law Group, P.C Motorcycle accident attorney Bronx
MAP Engineering transformed our property with their expert septic design Residential wastewater management solutions
Kerner Law Group, P.C. provided outstanding service as my Bronx car accident attorney.
I highly recommend Kerner Law Group, P.C. for anyone needing a Bronx car accident lawyer.
Thanks to Kerner Law Group, P.C Truck accident lawyer Bronx
After the job was complete, they took the time to walk me through what had been done and answered all my questions. Their transparency is commendable. Permanent Outdoor Lighting Installation Tampa Bay Pressure Washing
**Affordable Pricing**: Bounce Genie offers competitive pricing without compromising on quality indian rocks beach slide rentals for parties
I’ve been discovering non-invasive chances as effectively; does anyone recognise how they compare to liposuction? More data is plausible at Liposuction Glasgow .
Santorini may not be tropical, but its sunsets are divine! What’s your favorite island? Let’s discuss at travel agency near me .
“Utilizing modern technology allows prospective clients access vast array resources simplifying task locating ideal candidates promptly fulfilling needs efficiently throughout processes undertaken diligently moving forward!” dallas texas injury lawyer
A quick trim is all it takes sometimes; so grateful for reliable hairstylists who know just what we need!! brazilian blowout
convenient website search of the platform allows easy to get admission to available educational resources useful for this success worldwide https://airlex.com.my/pocket0pti0n-com/pocket-option-colombia-your-comprehensive-guide-to/.
Широкий выбор дженериков на сайте https://cialis24.ru с доставкой курьером
в день заказа отправка в регионы России
I never thought about it this way! Another perspective on the article emphasizes the cultural factors at play. Learn more at There’s more to see .
I’m impressed by how smooth my move went thanks to the team at Oneco Mover’s in Bradenton.
I can’t believe the selection of bounce houses in Tampa! Check out bounce house rentals pinellas county for amazing rentals.
This was highly helpful. For more, visit social media agency delhi .
Такова жизнь. Ничего не поделаешь.
Profiteer van de Welkom bonus, indien aanwezig, en u can onmiddellijk start uw initiele gameplay op de https://thebitcoinproject.club/wiki/index.php/Online_Gaming_Establishment. De geringste afwijking in de regels van games , of in interiors zal you vertellen dat similar een nep is.
Магазин дженериков https://cialisbrand.ru/ большой выбор низкие
цены быстрая доставка по городу отправка в регионы почтой России
Yes, this article really resonates with me! Explore further at Find out everything .
OMG ONE MORE GLASS SAI1 เป็นร้านที่มีเครื่องดื่มหลากหลาย ครบครันสุดๆ เลยค่ะ ผับแอนด์เรสเตอรองท์ สาย1
Eagerly awaiting future posts filled with fresh takes surrounding household chores undertaken collaboratively; after all teamwork truly makes dream work happen!!### 任何关键词### house cleaning las vegas
If you’re looking to save money on your move, check out the deals at Local movers Dade City .
Beach bonfire nights under starry skies create lasting memories full of warmth and connection 🔥✨ #GoodTimesTogether ## travel agent myrtle beach
Have any performances left lasting impressions on stage or screen—they often shift our perceptions entirely. Unlock more info
Магазин дженериков по адресу https://cialis-deshevo.ru предлагает
широкий выбор препаратов для повышения потенции с доставкой
Excellent blog, I love it! When you have a car break, it’s always important to know who to contact. A trustworthy pulling service can save lives in difficult conditions best wrecker service
This was a wonderful post. Check out aannemer airconditioning for more.
Moved last month with some fantastic long distance movers from Intercession City—shout out to Intercession City international movers !
The challenges of navigating healthcare services can be overwhelming; I found excellent guidance at dementia care !
Had such positive interactions when calling around different ***mover*** services; now just need advice on final selection! Groveland moving company
Wow, I had no idea about the importance of regular drain inspections. Thank you for sharing! More insights at Kent plumber .
If you desire to obtain a good deal from this article then you have to apply such
techniques to your won web site.
Feel free to surf to my web page mounfit drops
mounfit drops的最新文章:mounfit drops
Дженерики на сайте https://cialis-hit.ru/ с доставкой по городу курьером
в день заказа отличное качество по низкой цене
Just returned from an unforgettable escape filled with beauty and tranquility; find more adventures here: ## travel agency laurel
Really appreciate hearing stories fellow community members have regarding experiences had engaging sought-after services rendered seamlessly delivered effortlessly helping traversing aspects transition occurring amidst lives touched profoundly journeys Best Pinellas Park movers
Fantastic insight into the value of trustworthy pulling companies! Knowing a reliable winch business can save you time and stress whether you find yourself stranded due to a malfunction or have a scrapper for a auto that met an terrible tragedy towing company Johnstown, CO
Các bạn có nhớ bộ phim nào nổi bật trên platform này không? Hãy chia sẻ cho nhau cùng biết nhé: #anything#. Learn the rest here
Just finished unpacking after using Miami apartment movers for my move, and everything went perfectly!