或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
The personalized care at my local ##Puyallup Chiropractor## is unmatched! It’s like having a health partner prenatal chiropractor
Fantastic tips on gathering evidence for a personal injury claim—this is essential knowledge for Sacramentans! motorcycle accident lawyer
I’ve heard stories about people getting under-settled because they didn’t consult a lawyer first in San Diego—so sad! personal injury lawyer
It’s essential for victims to document everything after an accident motorcycle accident lawyer
Thank you for breaking down the different types of SEO strategies! There’s so much to consider, and I share my experiences at SEO Agency London
Virtual gambling platforms have reshaped the gaming world, providing an unmatched level of convenience and diversity that conventional establishments can’t match. Over time, a growing community globally have turned to the fun of online gaming due to its always-open nature, captivating elements, and constantly growing collections of titles.
If you’re just starting with the world of digital casinos or hope to find out more about safe services, why not sign up for our vibrant interactive platform? It’s a platform where gaming aficionados offer stories, enabling you to maximize your virtual play. Check out the experience and see it here now: http://www.maxes.co.kr/bbs/board.php?bo_table=free&wr_id=576456
One of the most compelling reasons of internet-based platforms is the unparalleled array of titles available. Whether you love spinning traditional reel games, diving into theme-based modern slot games, or playing smart in table games like Texas Hold’em, online platforms boast limitless entertainment avenues. Many casinos moreover feature real-time gaming experiences, allowing you to connect with human game hosts and co-players, all while taking in the engaging ambiance of a land-based casino right at home.
In addition to diversity, virtual gaming providers thrive in accessibility.
The details provided about slip and fall accidents are so helpful! Moseley Collins Law seems like a trusted choice for legal help in LA accident lawyer
The statistics surrounding medical malpractice are shocking; it’s great that firms like Moseley Collins Law are working hard to combat this issue in Phoenix accident lawyer
Knowing what steps to take after an incident is critical; I’m glad there’s guidance available through articles like these from professionals at Moseley Collins Law!! personal injury lawyer
A diligent #caraccidentlawyer will ensure you’re not shortchanged by insurance companies accident lawyer
Daniella Levi & Associates, P.C. are the best car accident lawyers I’ve ever worked with!
If you’re in the Bronx, this car accident lawyer is truly exceptional!
I found the perfect car accident lawyer near me at Daniella Levi & Associates, P.C P.C. legal services in Bronx
My move with Local movers Lochloosa was seamless! You can read about my experience at Lochloosa Mover’s
Our first experience using mango apartments ended up being delightful; we will definitely call them again!” # # anyKeyWord Mango Mover’s
. Anyone else feel overwhelmed trying to navigate medical records requests following serious accidents?? This entire process feels daunting sometimes especially given access limitations depending on where treatment took place—not all clinics offer easy personal injury lawyer
Just wanted to express gratitude towards ##### anyKeywords####—they made my cross-state relocation simple and smooth Local movers Mount Dora
Nicely done! Discover more at albergue en Palas
Wonderful tips! Find more at contadores Saltillo
Hoping everyone’s journeys lead them toward healing and resolution—let’s keep sharing via 82 motorcycle accident lawyer
If anyone asks me who they should contact when needing an accurate assessment done on their future dream homes or investments here locally – I’d refer nothing short of @A Buyer’s choice!!! ### anyKeyWord Home inspector
Wonderful tips! Find more at taxi Arzúa
Sharing stories triumphs serves inspire uplift motivate countless souls embarking journeys discovering strengths weaknesses alike discovering inner truths long hidden waiting emerge gracefully into light shining brightly illuminating paths ahead leading Nakrutka
I had a wonderful experience at Visual Eyes Optical Inc!
The eye doctor at Visual Eyes Optical Inc was incredibly helpful eye exams near me
Trendi Marketing Agency is definitely a leader in innovative digital marketing solutions! internet marketing dallas tx
Shout out to emergency locksmith New Orleans LA for being such a dependable locksmith service here in
I came across a fantastic article about the latest trends in task management software and how they can enhance productivity for teams. It’s amazing how the right crm platform can help prioritize tasks and manage deadlines effectively
This was very beneficial. For more, visit SmyleDent Bakersfield
I often struggle with time management during the reading section; your tips are excellent! More insights available at privacy and data protection
#DingmansFerry is beautiful but unpredictable—thankfully ### anyKeyboard### has reliable help when it comes to flats Mobile Tire Service LLC
Looking for price range-pleasant strategies for furnishing my first dwelling? Check out furniture store near me
I had an incredible experience at the Dental Group of Beverly Hills! The best dentist I’ve ever visited!
If you’re looking for a dentist near me Beverly Hills teeth straightening
If you’re into DIY projects, consider creating your own beauty products using ingredients purchased from a bulk store—it’s fun and rewarding! Recipes available on %%yourLink%% pitco foods grocery wholesale
Virtual gambling platforms have modernized the gaming industry, delivering a level of user-friendliness and range that conventional gambling houses fall short of. Throughout the last ten years, countless gamblers globally have welcomed the pleasure of online gaming as a result of its always-open nature, appealing qualities, and constantly growing catalogs of games.
If you’re exploring for the first time with the world of digital casinos or are looking to explore safe services, why not participate in our growing social network? It’s a space where enthusiasts offer stories, guiding you to maximize your casino activities. Explore the community and visit us now: http://www.alivelinks.org/1win–1-win–1win-app–1win-apk–1win-espa%C3%B1a–1win-apk-download–1win-app-download_460087.html
One of the main appeals of virtual gambling hubs is the incredible selection of games ready to play. Whether you enjoy rolling classic fruit machine slots, trying out story-driven modern slot games, or mastering skills in table games like Roulette, online platforms offer infinite possibilities. Plenty of operators also present live gaming streams, allowing you to engage with real dealers and other players, all while enjoying the engaging atmosphere of a traditional gambling venue without leaving your home.
Adding to the extensive catalog, internet-based gambling hubs are known for seamless entry.
What should I expect during my first visit to a ##Puyallup Chiropractor##? Any tips for Puyallup prenatal chiropractor
Just wanted everyone to know how satisfied I am after using ####Br 𝗕𝗮𝘆𝗳𝗹𝗼𝘄𝗲𝗿 𝗠𝗼𝘃𝗶𝗻𝗴 𝗚𝗿𝗼𝘂𝗽 [𝗕𝗿𝗮𝗻𝗱𝗼𝗻 𝗠𝗼𝘃𝗲𝗿𝘀]
If you’re relocating within Red Oak, don’t overlook the expertise offered by local movers like #.. anykeyword#. Road Oak Mover’s
I’ve never felt better since visiting North Atlanta Chiropractic Center! They’re the best chiropractor in town.
North Atlanta Chiropractic Center is my go-to chiropractor in Duluth North Atlanta Chiropractic Center reviews
Great insights! Discover more at Smyle Dental Office Bakersfield
I can’t believe how great my gutters look after A+ Gutters’ installation! Amazing work! Gutter repair
Наконец, в Донецке запустился сайт для интимных услуг с самым лучшим сервисом. Мы собрали великолепных девушек, которые ждут вашего внимания и готовы удивить вас. Откройте для себя новые возможности наслаждения и откровенной близости: донецк девушки индивидуалки
This was highly educational. More at loan agency new orleans
I appreciate how you addressed common mistakes people make when filing personal injury claims—very useful info! personal injury lawyer
Sharing my experience with an accident case and how helpful truck accident lawyer was during that time
Who knew there were so many different factors influencing settlement amounts? Your breakdown clarifies everything beautifully regarding expectations!!!! medical malpractice lawyer
Great insights into truck accident lawsuits—this kind of information is essential for victims looking for legal representation like that from Moseley Collins Law! accident lawyer
BayWin, dijital bahis dunyas?nda ad?ndan s?kca soz ettiren bir bahis sitesidir. Kullan?c?lar?na sundugu farkl? bahis imkanlar?, kolay erisim imkan? ve guvenilir hizmet anlay?s? ile begeni toplamaktad?r.
Bilhassa platforma erisim saglamak ve son giris adresleri, platformun kullan?c?lar? icin temel merak noktalar? aras?nda yer vard?r.
Baywin’in Hizmetleri
Bay Win, dijital bahis platformlar? aras?nda faaliyet gosteren bir sitedir. basketbol bahisleri, slot makineleri, dijital oyunlar gibi genis bir oyun yelpazesine sahiptir.
Bahis sitesinin en onemli dikkat ceken yonu, yuksek bahis oranlar? saglamas?d?r. Ayr?ca, cesitli odeme imkanlar?, finansal guvenlik sunar.
Baywin Giris Sorunlar? ve Cozumleri
Web: https://pearlbusiness.co.uk/2024/12/03/1win-vash-put-k-uspeshnym-stavkam-na-sport/
Baywin markas?n?n erisim k?s?tlamalar?yla kars?lasmas? kac?n?lmazd?r, fakat boyle durumlar kars?s?nda Bahis sitesi yetkilileri cozumler sunmaktad?r.
Siteye erisim engellendiginde, platform h?zla yeni bir giris adresi belirleyerek kullan?c?lar?na duyurur. Boylelikle, platformun aktif baglant?s? uzerinden kullan?c?lar oyunlar?n? kesintisiz oynayabilir.
Yeni adrese erisim saglamak amac?yla bircok erisim yontemi bulunmaktad?r. Ak?ll? telefonlar, pratik cihazlar ve dizustu bilgisayarlar uzerinden oyunlara kat?lmak mumkundur. platforma mobil olarak kat?lma avantaj? saglar.
Hi there, for all time i used to check blog posts here in the early hours in the break
of day, because i like to find out more and
more.
Also visit my website: tanker truck
tanker truck的最新文章:tanker truck
Internet-based gambling hubs have revolutionized the betting industry, delivering a level of comfort and range that brick-and-mortar venues fall short of. Recently, a large audience globally have chosen the thrill of online gaming thanks to its ease of access, thrilling aspects, and continuously increasing selection of games.
If you’re unfamiliar with the world of internet-based gaming or are looking to learn about proven options, why not sign up for our active interactive platform? It’s a platform where gaming aficionados offer reviews, making it easier for you to maximize your gambling adventure. Dive into the community and learn more now: http://cucq.co.uk/node/445695
One of the strongest selling points of digital gambling sites is the unparalleled variety of choices on offer. Whether you like playing on vintage slots, diving into narrative-rich modern slot games, or mastering skills in table games like Texas Hold’em, casino websites boast endless possibilities. Many casinos additionally offer live casino options, enabling you to interact with real dealers and co-players, all while taking in the lifelike atmosphere of a physical gaming house in your own space.
Adding to the extensive catalog, online casinos shine constant connectivity.
It’s crucial to have legal support when dealing with medical malpractice issues motorcycle accident lawyer
This is a topic which is near to my heart… Many thanks! Exactly where are your contact details though?
This post made me realize how important it is to have a knowledgeable attorney after an accidental injury—Moseley Collins Law sounds like a solid choice! car accident lawyer