或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
I had a wonderful experience at Visual Eyes Optical Inc!
The eye doctor at Visual Eyes Optical Inc was incredibly helpful Visual Eyes Optical Inc eyewear selection
Anyone else shopping for sustainable fixtures? Loving the green choices at dining room furniture
Новости спорта
Wonderful tips! Find more at roofers houston tx
Kudos to you Health insurance agent
I love how you highlighted the importance of qualifications for plumbers in Brisbane dog washer
Appreciate the thorough analysis. For more, visit water heater repair nearby
The peace of mind provided by A Buyer’s Choice during my home’s inspection was priceless – highly recommended! Home inspector
I enjoyed this article. Check out The Water Restoration Team for more
Internet-based gambling hubs have changed the gambling world, delivering an exceptional degree of comfort and selection that brick-and-mortar venues are unable to replicate. Over the past decade, a growing community across the globe have turned to the thrill of virtual gambling thanks to its accessibility, engaging traits, and progressively larger game libraries.
If you’re just starting with the world of online gaming or hope to learn about reliable sites, why not sign up for our vibrant online hub? It’s a hub where gamblers offer reviews, enabling you to improve your virtual play. Join the community and see it here now:
One of the strongest selling points of virtual gambling hubs is the sheer variety of choices available. Whether you are a fan of interacting with retro fruit machine slots, diving into theme-based visual slot games, or playing smart in card and board games like Texas Hold’em, digital casinos boast numerous opportunities. A large number of platforms also present live gaming streams, allowing you to communicate with actual dealers and fellow gamblers, all while enjoying the immersive feel of a brick-and-mortar establishment right at home.
Besides the wide selection, virtual gaming providers are known for constant connectivity.
Looking for tips on choosing a good Vallejo movers in Vallejo; any
Thanks for the insightful write-up. More like this at Integris Roofing
Appreciate the detailed insights. For more, visit Local fire damage restoration company near me company
Appreciate the comprehensive advice. For more, visit Bedrock Restoration – Water Fire Mold Damage Service
I had an incredible experience at the Dental Group of Beverly Hills! The best dentist I’ve ever visited!
If you’re looking for a dentist near me Beverly Hills teeth cleaning near me
This was highly informative. Check out roof repair Washington IL for more
Thanks for the practical tips. More at Local roofing contractor company
Thanks for the comprehensive read. Find more at home remodeling
This is very insightful. Check out Stamford Realtor for more
Thanks for the valuable article. More at Water damage restoration contractor near me
I found this very interesting. For more, visit water damage repair nearby
“My neighbors were impressed by how quickly & efficiently # # any Keyword # # completed our NYC Sidewalk Repair
This was a great help. Check out Air Conditioning Contractor Houston for more
Ocean AC Repair’s commitment to customer satisfaction makes them the best choice for AC repairs in Miami! Hvac company
This was quite helpful. For more, visit Priority Carpet Cleaning
Appreciate the thorough insights. For more, visit READY ROOF Inc.
This was a wonderful post. Check out roofers near me for more
Thanks for the useful suggestions. Discover more at water heater installation Phoenix
Thankful for the speedy service from Summit Services; they really know how to h Air conditioning repair
Great job! Find more at commercial carpet cleaning
This was a wonderful post. Check out https://odintsovalada.ru/user/onovenwepe for more
Новости АПЛ
Appreciate the thorough information. For more, visit Smile Dental Bakersfield
” Kudos once again to trindi as they continue revolutionizing processes while ensuring quality outcomes each time !! # # anykeyword # #” digital marketing agency in dallas
Can’t believe how good of a deal I got with my movers from Mount Dora apartment movers #! Highly recommend
If you need cheap movers Lochloosa, look no further than Lochloosa apartment movers
I’ve never felt better since visiting North Atlanta Chiropractic Center! They’re the best chiropractor in town.
North Atlanta Chiropractic Center is my go-to chiropractor in Duluth North Atlanta Chiropractic Center appointment
Has anyone ever had an issue while using mango comercial mover? I’m hoping everything goes smoothly for me!! # # anyKeyWord Mango commercial movers
Digital casinos have reshaped the betting industry, providing an exceptional degree of user-friendliness and diversity that conventional venues fall short of. In recent years, a vast number of enthusiasts across the globe have chosen the excitement of internet-based gaming thanks to its availability, exciting features, and progressively larger collections of titles.
If you’re unfamiliar with the world of virtual gambling or are looking to explore reliable sites, why not become part of our lively social network? It’s a destination where gamblers discuss tips, guiding you to improve your online casino experience. Join the connections and visit us now: https://lovewiki.faith/wiki/User:SherrieSackett4
One of the main appeals of online gaming options is the vast selection of gaming experiences ready to play. Whether you enjoy interacting with retro fruit machine slots, immersing yourself in narrative-rich video-based games, or playing smart in strategy-based games like Blackjack, digital casinos provide infinite choices. Numerous services also include live casino options, letting you to engage with human game hosts and opponents, all while taking in the engaging vibes of a physical gaming house in your own space.
Apart from the game range, internet-based gambling hubs are known for seamless entry.
I recently started using a new best crm that has completely transformed my approach to project management. The task tracking features are incredibly intuitive, making it easy to keep my team on the same page
Does anyone know the best vehicle shipping agent in Oakland? I’ve heard good things about Rancho Cucamonga car moving companies
The dedication displayed continuously striving uphold ethical st criminal lawyers arlington tx
”Excited about settling down soon after coming across insightfully gathered lists provided by %% Local movers Sunnyvale
It’s reassuring knowing that companies like WIl mer Moving Company prioritize quality service over everything else!!!! Wilmer Mover’s
I’ve never seen such dedication to customer satisfaction as with A+ Gutters—great job Gutter installation
If you’re planning a move Best Addison movers
Pin Up Casino в Казахстане – это одно из самых популярных мест для любителей азартных игр. Здесь предлагаются уникальные возможности для удачной игры и больших выплат. Если вы хотите найти проверенное казино, то Pin Up Casino обеспечит всё нужное.
Преимущества Pin Up интернет-казино
Большой ассортимент игр. На платформе Pin Up вы найдёте более 2000+ игровых решений, настольных и лайв-игр. В игровой коллекции представлены такие известные разработчики, как NetEnt и другие лидеры. Это значит, что вас ждут только качественные и увлекательные игры, совместимые с любыми устройствами.
Привлекательные акции и бонусы. Для новых игроков доступны фриспины и бонусы, которые дадут хорошие шансы на выигрыш. Также действуют регулярные акции, дополнительные фриспины и акции для постоянных игроков, что обеспечивает ещё больше шансов на выигрыш.
Наш сайт: https://bk.kz/news/?ELEMENT_ID=3245&PAGEN_2=15
Высокий уровень безопасности. Pin Up Казино Онлайн использует только проверенные методы защиты персональных данных и выплат, чтобы гарантировать защиту данных. Официально лицензированное казино обеспечивает честные игры и оперативные выплаты призов.
Мобильность и удобство использования. Наше казино легко доступно через мобильные устройства, что позволяет наслаждаться игрой в любое время и в любом месте. Доступно мобильное приложение или просто зайти на сайт через браузер смартфона.
Обслуживание клиентов. В любой ситуации, служба поддержки Pin Up Казино всегда готова к общению. Вы можете написать в службу поддержки через электронную почту, и операторы ответят в кратчайшие сроки на родном языке.
Daniella Levi & Associates, P.C. are the best car accident lawyers I’ve ever worked with!
If you’re in the Bronx, this car accident lawyer is truly exceptional!
I found the perfect car accident lawyer near me at Daniella Levi & Associates, P.C Bronx personal injury legal expert
Such an insightful piece—I’ve had fantastic experiences with mobile tire installation
Если ты хочешь быть в курсе самых последних версий модов, заходи на apkmaster.ru! Мы обновляем все игры и приложения сразу после выхода новых версий, чтобы ты всегда мог качать самые новые файлы!