或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Ahaa, its pleasant discussion about this piece
of writing at this place at this website, I have read all
that, so at this time me also commenting here.
mitolyn Reviews的最新文章:mitolyn Reviews
Плавсредства бренда из российской федерации «Гладиатор» производятся https://blogstory.co.uk/hurrilet/ в китае. при выборе продукции надобно определиться с его предназначением, а также количеством человек, собирающихся проходить водной прогулке.
Both nations have so-known as “patent bargains” that require the disclosure of a
drug’s chemical compounds in sufficient detail so that scientists can replicate it and learn from the invention, thus benefiting society.
GRATIS VIAGRA的最新文章:GRATIS VIAGRA
Grateful for the help from Winter Garden moving company during my Winter Garden relocation. They were lifesavers!
I recently moved to Orlando and have been searching for the best medical weight loss solutions available medical weight loss winter park
Moving doesn’t have to be expensive when you choose **#** anykeyword ## Lakeland moving companies
I like discussing concepts and forecasts about upcoming episodes with fellow followers! Do you take part in any kind of discussions? joya9.tv features
I can’t worry enough just how vital it is to hire licensed arborists for tree solution needs! There’s valuable info on this subject at tree trimming .
Hello, constаntlʏ i uѕed to check blog ρosts here early in the
morning, because i like to learn more and morе.
Also visit my bl᧐g post tote bags supplier
tote bags supplier的最新文章:tote bags supplier
Moving offices soon? Don’t forget to get a quote from Nokomis commercial movers ; they have competitive pricing.
Someone essentially help to make severely articles I’d state.
That is the first time I frequented your web page and up to now?
I amazed with the research you made to create this
actual post incredible. Wonderful task!
my site zamorano01
zamorano01的最新文章:zamorano01
Anyone considering shipping their car during a move? Let’s discuss options available over on my blog: Elfers Mover’s !
Thanks for the detailed guidance. More at abogado laboralista Sevilla .
Way cool! Some very valid points! I appreciate you penning this article and also the rest of
the site is very good.
kra31.cc的最新文章:kra31.cc
I was more than happy to uncover this page. I wanted to thank you for ones time due to this wonderful read!! I definitely liked every bit of it and i also have you book-marked to look at new things on your blog.
I love it when people come together and share ideas. Great website,
keep it up!
My page :: the growth matrix
the growth matrix的最新文章:the growth matrix
С этим я полностью согласен!
main of the risks faced by lps is the temporary loss of aerodrome finance, which appears when the value of the deposited tokens changes.
Hmm is anyone else having problems with the images on this blog loading?
I’m trying to find out if its a problem on my end or if it’s the blog.
Any responses would be greatly appreciated.
blog的最新文章:blog
You ought to take part in a contest for one of the highest quality websites online.
I am going to recommend this website!
electric nail的最新文章:electric nail
Curious whether there are limits placed upon weight restrictions when shipping certain items over state lines utilizing these teams?? **## any Keyword** Long distance movers Ochopee
Excellent, what a webpage it is! This website gives helpful data to us,
keep it up.
drugstore online的最新文章:drugstore online
It is not my first time to go to see this web site, i am visiting this web site
dailly and obtain nice information from here everyday.
best crypto casinos的最新文章:best crypto casinos
Bounce houses really make parties unforgettable! Got mine from bounce house rental with generator and loved it!
“Enjoyed your thoughts on prototyping—it’s an effective tool in our toolkit over here at Website Design Firm !”
Has anyone experienced any side effects from their aesthetic treatments in Marylebone? Sharing is caring! Aesthetic Clinic Marylebone
If you want your trees to thrive, don’t be reluctant to call emergency tree service fresno ! Their understanding is unrivaled.
This was a fantastic read. Check out reparaciones de persionas for more.
Часто задумываюсь над тем , как правильно вести свои страницы в социальных сетях , чтобы достичь максимального эффекта ! # # anyKeywo rd ## https://www.click-bookmark.win/issledovania-pokazyvaut
Ho scoperto che ci sono molte promozioni sulle slot di giochi popolari tra italiani , non perdetele!
Cabinet IQ
8305 Stɑte Hwy 71 #110, Austin,
TX 78735, United Ѕtates
254-275-5536
Diykitchen
Diykitchen的最新文章:Diykitchen
I enjoyed this post. For additional info, visit loan agency new orleans .
Моя подруга делала лазерное удаление бородавок, и теперь у нее идеальная кожа! Убедилась в эффективности метода. http://www.video-bookmark.com/user/cormanvstv
Я слышала о новой технологии удаления бородавок в клиниках Ташкента. Узнайте подробнее на https://nine-bottom-0eb.notion.site/1f13ba7f0b5b8073bc37cf3688df8305?pvs=4 .
I love how no two classes are ever the same in martial arts; it’s always fresh and exciting! kids martial arts
It’s pleasing how tree removing can in reality fortify your landscape. I located some necessary materials at emergency tree service that explain the blessings!
I appreciated this article. For more, visit abogados laboralistas en Sevilla .
I didn’t realize how much stress was affecting my body until starting regular treatments; grateful for the guidance here!!#SelfCare#ChiropracticSuccess###aniykeyword## Chiropractic care for neck pain
Just had my first visit for Headache pain relief in Lubbock, and I feel amazing already!
Есть ли у вас отзывы о дерматологах в Ташкенте? Я планирую записаться на прием через https://padlet.com/machilawia/bookmarks-iy2krnp8mdh7nj88/wish/lkDVaK4y6EgGQPp9 .
Boston Medical Ԍroup
3152 Red Hill Ave. Ste. #280,
Costa Mesa, ᏟᎪ 92626, United States
800 337 7555
erectile dysfunction pathophysiology
erectile dysfunction pathophysiology的最新文章:erectile dysfunction pathophysiology
Wоnderful web site. Plenty of useful info here.
I’m sending it to sеveral рals ans additionally sharing in delicious.
And of course, thank you on your sweat!
Visit my web blog: Tote bags Supplier
Tote bags Supplier的最新文章:Tote bags Supplier
fantastic put up, very informative. I wonder why the other experts of
this sector don’t notice this. You must proceed your writing.
I’m confident, you’ve a huge readers’ base already!
nationwide expos的最新文章:nationwide expos
I was curious if you ever thought of changing the structure
of your site? Its very well written; I love what
youve got to say. But maybe you could a little more in the way of content
so people could connect with it better. Youve got an awful lot of text for only having 1 or two images.
Maybe you could space it out better?
webradio hosting的最新文章:webradio hosting
I recently moved to Orlando and have been searching for the best medical weight loss solutions available medical weight loss winter park
Live 2 B Healthy
Bloomington, Minneapolis 55402, United Ѕtates
16124200445
Senior-Focused Fitness And Wellness Strategies (https://List.Ly/I/10926136)
https://List.Ly/I/10926136的最新文章:https://List.Ly/I/10926136
I can not believe how much far better my backyard cares for making use of HDZ Tree Service Inc ! Very recommend their team.
Какая нужная фраза… супер, отличная идея
If both brigades score (btts): This bet involves predicting whether two brigades will score at least only goal in a match, or betwinner https://www.drshyamoncology.com/unlock-your-potential-with-baji-app-the-ultimate not score.
I never realized how much I would love the meditation aspect of martial arts until I tried it myself! adult martial arts classes Bergen County
Хорошая статья о важности здоровья кожи и роли дерматолога в этом процессе! Спасибо за информацию! https://www.bookmark-maker.win/hirurgiceskoe-udalenie-rodinok-pozvolaet-izbezat-riska-malignizacii-prevrasenia-dobrokacestvennogo-obrazovania-v-1
I seriously love your blog.. Pleasant colors & theme. Did you develop this web site yourself?
Please reply back as I’m trying to create my very own blog and would like to find
out where you got this from or what the theme is called. Thank you!
mesut bisiklet的最新文章:mesut bisiklet