或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
The form of styles at furniture store makes it common to in finding a specific thing for each and every room
This was very well put together. Discover more at albergue palas de rei
Well explained. Discover more at Local Family lawyer near me
Thanks for the valuable insights. More at abogados Vigo
Thanks for the valuable article. More at taxi Arzúa
Thanks for the detailed guidance. More at contador saltillo
I can’t recommend Air Solution 7 highly enough; they’re reliable, efficient Hvac services near me
I’ve heard great things about auto locksmiths here; they can really make life easier when you’re locked out! Check out the one I found at Auto locksmith inEnglishAuto locksmith Melbourne10 Melbourne local auto locksmith Melbourne
I had a wonderful experience at Visual Eyes Optical Inc!
The eye doctor at Visual Eyes Optical Inc was incredibly helpful contact lens fitting near me
Thanks for the detailed post. Find more at Smyle Dental Bakersfield
The credit score uniion with which you have already got a relationship is the place to
go.
Here is my web page … Ezloan
Ezloan的最新文章:Ezloan
На [url=https://apkmaster.ru]apkmaster.ru[/url] ты найдешь самые свежие версии Android-игр и приложений. Мы обновляем базу модов каждую неделю, чтобы ты всегда мог скачать только актуальные версии. Просто заходи на сайт и выбирай самые свежие обновления!
Thanks for the valuable insights. More at Water Restoration
Pin Up Casino в Казахстане – это топовое казино для игроков для игроков, любящих азарт. Здесь вы сможете найти идеальные условия для игр с реальными выигрышами. Если ищете идеальное место для ставок, то лучший выбор для вас – Pin Up Casino.
Преимущества Pin Up Casino
Огромный выбор игр. Здесь вас ждёт более 2000 игровых автоматов, настольных игр и игр с живыми дилерами. В игровой коллекции представлены такие известные разработчики, как NetEnt и множество других компаний. Это значит, что вы сможете наслаждаться качеством и азартом, адаптированные для всех устройств.
Щедрые бонусы и предложения. Для новых игроков доступны приветственные бонусы, которые дадут отличный старт. К тому же, игроки получают кэшбэки, дополнительные фриспины и акции для постоянных игроков, что увеличивает ваши шансы на успех.
Наш сайт: http://www.dotybrew.com/2012/11/i-know-its-been-long-time-since-i.html
Высокий уровень безопасности. Pin Up Казино использует надёжные методы защиты данных данных пользователей, для полной защиты вашего опыта. Казино работает по лицензии гарантирует справедливость игр и честные и быстрые выплаты.
Полная мобильная совместимость. Платформа казино легко доступно через мобильные устройства, что позволяет наслаждаться игрой в любом удобном месте. Вы можете скачать мобильное приложение или просто запустить игры через браузер.
Обслуживание клиентов. В любом вопросе, служба помощи всегда к вашим услугам. Вы можете пообщаться с поддержкой через удобный чат, и операторы ответят быстро на вашем языке.
Finding reliable coverage shouldn’t be stressful— Health insurance agent
It’s appropriate time to make some plans for the longer term and it is time
to be happy. I have read this post and if I may I desire to counsel
you few fascinating things or tips. Perhaps you could write next articles
relating to this article. I wish to learn even more things approximately it!
Here is my web-site: click here for info
click here for info的最新文章:click here for info
A Buyer’s Choice provided me with an exceptional home inspection experience—definitely the best in St Johns County! Check it out: Home inspection
Appreciate the thorough information. For more, visit roofers houston services
I blog frequently and I really appreciate your content. This great article has truly peaked my interest.
I’m going to bookmark your site and keep checking for new information about once per week.
I opted in for your Feed too.
hey的最新文章:hey
The prices at dog washer are pretty reasonable considering the quality of service you get—definitely worth
Digital casinos have changed the gambling scene, delivering an exceptional degree of comfort and breadth that physical casinos fall short of. Over the past decade, millions of players across the globe have chosen the excitement of online gaming thanks to its availability, engaging traits, and widening collections of titles.
If you’re just starting with the world of digital casinos or would like to delve deeper into reliable sites, why not engage with our growing community? It’s a space where gaming aficionados discuss reviews, guiding you to improve your gambling adventure. Check out the conversation and check it out now: https://www.mindevolution.lt/2019/04/03/kaip-ismokti-pasitiketi-savimi/
One of the strongest selling points of digital gambling sites is the astounding variety of entertainment options ready to play. Whether you enjoy playing on vintage reel games, trying out theme-based thematic slots, or strategizing in strategy-based games like Blackjack, online platforms offer countless possibilities. Many casinos moreover feature live gaming streams, allowing you to connect with live hosts and other players, all while immersing yourself in the realistic ambiance of a land-based casino from anywhere you want.
Beyond variety, virtual gambling platforms are known for ease of access.
Aviator Game Online: Accessibility and Convenience
One of the main reasons behind the Aviator game’s widespread appeal is its accessibility. The online Aviator game is available on different systems, allowing players to experience it on the go. Whether you’re gaming from a PC, a phone, or a larger screen, the Aviator official website delivers a seamless betting adventure. For players in India, the Aviator India game has become widely loved due to its straightforward nature and opportunities for big winnings. The user-friendly setup makes it convenient for beginners to pick up, while experienced players can perfect their approaches to maximize winnings.
Link: https://websitehubs.com/advanced-predictive-analytics-for-e-commerce-demand-planning/
Aviator Game Download and Bonuses
For those who enjoy having a dedicated app, the Aviator game download possibility is highly appealing. Many betting sites provide exclusive bonuses for downloading the game, giving players an added incentive to try it out. These rewards often include bonus funds, extra credits, and other rewards that add value to your bets. The Aviator bonus game is another element that enhances the thrill. These special rounds offer better chances of winning or introduce unique challenges, giving players greater thrills and rewards. The combination of standard sessions and bonus rounds ensures that the Spribe Aviator game stays engaging.
I had an incredible experience at the Dental Group of Beverly Hills! The best dentist I’ve ever visited!
If you’re looking for a dentist near me Dental Group of Beverly Hills dental insurance
This was quite helpful. For more, visit water remediation services
Appreciate the detailed information. For more, visit Local real estate lawyer near me
Appreciate the comprehensive advice. For more, visit Local fire damage restoration company near me
I appreciated this post. Check out roofing contractor for more
Thanks for the great content. More at fire damage restoration nearby
Appreciate the detailed post. Find more at payday loans new orleans la
Thanks for the detailed post. Find more at READY ROOF Inc.
Great post. I will be dealing with many of these issues
as well..
bong88的最新文章:bong88
Thanks for the insightful write-up. More like this at basement remodeling
Thanks for the great content. More at Realtor services
This is quite enlightening. Check out klinika stomatologiczna warszawa for more
This was quite helpful. For more, visit Water damage restoration contractor near me
Definitely consider that that you stated. Your favourite justification seemed to be at the web
the simplest factor to bear in mind of. I say to you, I certainly get irked
at the same time as folks consider issues that they plainly
do not know about. You managed to hit the nail upon the top and also outlined out the entire thing with no need side effect ,
people can take a signal. Will likely be back to get more.
Thank you
pornexpand.com的最新文章:pornexpand.com
This was very well put together. Discover more at water damage repair nearby
Spot on with this write-up, I truly believe that this amazing site needs far more attention. I’ll
probably be back again to read more, thanks for
the advice!
sabung ayam sv388的最新文章:sabung ayam sv388
Wonderful tips! Find more at Best HVAC contractors in Houston
Nothing beats the quality of service from Summit Services when it comes to fixing an air conditioner!! Air conditioning repair
Every time I walk my dog concrete sidewalk repair
Appreciate the thorough write-up. Find more at carpet cleaning near me
This was highly helpful. For more, visit Local roofing company near me
Nicely done! Discover more at Smyle Dental Bakersfield
This was nicely structured. Discover more at roofers near me
Ik kijk uit naar mijn volgende afspraak bij mijn nieuwe tandartspraktijk delft tandarts
Appreciate the helpful advice. For more, visit carpet cleaning company
Valuable information! Discover more at water heater installation near me
I had a great experience with Ocean AC Repair last week—quick, professional Ac conditioning services
I’ve never felt better since visiting North Atlanta Chiropractic Center! They’re the best chiropractor in town.
North Atlanta Chiropractic Center is my go-to chiropractor in Duluth Best chiropractic care in Duluth