或许有人会问我为啥那么久不更新 其实站点一直有在维护 但是呢優子秉承不发重复 不转帖 不伪原创。因此不会发不是自己倒腾过的东西出来的
今晚睡得晚 错过了睡点 于是直接失眠了QAQ。就想着折腾点啥打发时间 看着谷歌的SSL就有了自己折腾一个和谷歌一样前卫的HTTPS的想法
闲话到此为止
支持新版本TLS协议和ECDHE_RSA加密需要最低openssl1.0.1 而CentOS6通过默认源yum安装的openssl版本只有1.0.0 是不支持新版本TLS协议和ECDHE_RSA密钥交换方式的
一开始本想自己编译openssl 后来一想 自己编译会跟系统的openssl脱节 从而产生一些问题。谷歌是最好的老师 搜到了一个自定义源 里面有已经编译好的新版本openssl
导入源【请注意 此源仅支持64位系统。32位系统的抱歉了 暂时无法找到合适的源】
CentOS5 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-5-1.noarch.rpm
CentOS6 x64:
rpm -ivh --nosignature http://rpm.axivo.com/redhat/axivo-release-6-1.noarch.rpm
通过源升级安装最新版openssl1.0.1e
yum –enablerepo=axivo update openssl
不出意外的话 确认按一次y 导入KEY按一次y 即可完成安装
此时再输入openssl查看version的话 应该会显示【OpenSSL 1.0.1e 11 Feb 2013】
重新编译nginx
印象中这步是必须的 因为似乎编译时引用了openssl的头文档 需要重新编译
即使不是不是必须的 升级到1.4.1支持spdy协议还是不错的
由于我采用的是lnmp一键包 可以直接使用一键包中的upgrade_nginx.sh升级或者重新编译。如果不是使用一键包的 大致步骤如下:
wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar zxvf nginx-1.4.1.tar.gz
cd nginx-1.4.1
./configure –user=www –group=www –prefix=/usr/local/nginx【注:此处填你自己nginx安装目录 按照原先的编译参数 如果原先就没有 prefix直接去掉】 –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-http_spdy_module【注:使用一键包的也需要修改一键包的编译参数 此处加上红色字段】 –with-ipv6
make
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old【移除+备份老nginx的可执行文件 具体路径是看你的安装方式】
cp objs/nginx /usr/local/nginx/sbin/nginx【复制新的可执行文件进去 具体路径也是看你的安装方式】
/usr/local/nginx/sbin/nginx -t【执行新的可执行文件 测试是否配置文件有问题 具体路径同上】
make upgrade
修改nginx配置文件
需要修改的部分很多 不能像以前两三行解决了
首先
listen 你的ip:443 spdy;#新增spdy协议
SSL部分:
ssl on;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;#新增TLSv1.1 TLSv1.2
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;#新增SSL session支持 此处和上面的是设置超时和设置cache大小 减轻负载
ssl_stapling on;
ssl_stapling_verify on;#
ssl_certificate 你的公钥.crt;
ssl_certificate_key 你的私钥.key;
ssl_prefer_server_ciphers on;#设置由服务端决定加密方式 避免不安全问题
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-RC4-SHA:ECDHE-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!EDH:!kEDH:!PSK:!SRP:!kECDH;#去除所有不安全加密方式。确保不会遭受BEAST攻击。设置ECDHE_RSA正向密钥交换方式
注:红字是新增部分 蓝字可能是以前就有 如果以前有就需要加入红字部分 没有就直接添加。黑字是开启SSL加密所必需的
设置完毕后 reload nginx即可。
此时可以关闭浏览器重新访问你的SSL连接 你会发现你也变成了使用ECDHE_RSA的高级用户了
你同时可以使用SSL在线测试工具:https://www.ssllabs.com/ssltest/analyze.html。不出意外的话你应该是会得A了
这是本站的评分:https://www.ssllabs.com/ssltest/analyze.html?d=tucao.org
至于RC4的问题 我发现谷歌也在用 所以无所谓了。
如果你是考虑完全使用SSL 抛弃不加密的HTTP 可以考虑添加一个严格SSL的header
add_header Strict-Transport-Security max-age=2592000;
注意这个条目需要同时加到不经过加密的80端口的server块和经过HTTPS加密的server块。并且要在不经过加密的server块里设置跳转。设置方式不多说了 谷歌一搜一堆
使用ECDHE_RSA的优势:
1、具有良好前瞻性的密钥交换方式 保证数据安全
2、可以提升SSL握手速度 间接提升网站速度
3、和SPDY协议联合 最大限度提升HTTPS效率
至于见鬼的IE6的兼容问题呢 優子经过测试 XP 下的IE6是没有访问问题的 不需要担心。
p.s.总感觉“正向加密”这个词翻译有点怪?
~以上~
参考了以下文章:
https://blog.hasgeek.com/2013/https-everywhere-at-hasgeek
https://www.axivo.com/community/threads/upgrade-to-openssl-1-0-1-in-centos.180/
评论
Experiences shared often lead better outcomes overall hence why recommendations matter exceedingly much especially when faced challenges similar ones addressed within blog posts accessed via ### Car Accident Lawyer
Hi, I do think this is a great web site. I stumbledupon it 😉 I’m going to come back yet again since I book-marked it.
Money and freedom is the best way to change, may you be rich and continue to help others.
cewek telanjang的最新文章:cewek telanjang
Appreciate the detailed post. Find more at Conner Roofing, LLC .
This was a great article. Check out roofing contractors in St Louis for more.
I really love the number of therapists in New York City are actually including mindfulness with CBT techniques. It definitely enriches the curative knowledge! For even more knowledge, browse through group therapy nyc .
Grateful having stumbled upon this resourceful article while researching prior renovations efforts – essentials awaited down below via @# # anyKey wor d### fill dirt and gravel
”Collective intelligence harnessed strength diversity enables organization navigate complexities strategically optimize opportunities mitigate risks enhance decision-making foster innovation spur creativity cultivate collaboration inspire action achieve reliable medicare leads from agent autopilot
Safety should always come first on the road. Car accidents can be avoided with proper precautions. Car Accident Lawyer
Does anyone have tips on the best way to use 시알리스 후기 for optimal results?
Foothills Paving & Maintenance Inc did an amazing job on my driveway paving!
I love my new driveway thanks to Foothills Paving & Maintenance Inc!
Foothills Paving & Maintenance Inc provides excellent driveway paving services!
My driveway never looked Driveway paving cost estimate in Wheat Ridge
Valuable information! Find more at home remodeling services nearby .
Workhorse Sports Performance has transformed my fitness journey with their exceptional personal training services!
I’m thrilled with the progress I’ve made at Workhorse Sports Performance in Sparta Sparta NJ fitness training sessions
Hydroseeding and Sod By Taravella’s Hydro Turf transformed my garden into a lush paradise! Highly recommend this sod company.
I had an amazing experience with Taravella’s Hydro Turf! The best sod company near me, hands down Hydroseeding and sod installation Manitou Springs
Exciting to see how Excavating New Jersey LLC transformed our backyard with their expert septic system service!
If you need a reliable septic system service near me Where to find septic services in Wantage NJ
True Balance Pain Relief Clinic has the best massage therapist. I always leave feeling rejuvenated and relaxed!
I found the perfect massage therapist near me at True Balance Pain Relief Clinic Aurora’s top pain relief clinic
Harmony Painting transformed my living room with their expert interior painters! Highly recommend them for anyone in Denver.
The exterior of my house looks fantastic thanks to Harmony Painting’s skilled painters! Love their attention to detail Top-rated painters in Denver
I absolutely love my results from Sculpted MD Lakewood, they truly understand what it means to provide exceptional med spa services!
The staff at Sculpted MD Lakewood always makes me feel welcome, this med spa near me has become my self-care sanctuary Lakewood CO skin rejuvenation
Walter’s BBQ Southern Kitchen has the best brunch in Pittsburgh. The flavors are incredible!
I love finding a brunch spot near me like Walter’s BBQ Southern Kitchen Find brunch near me now
Sculpted MD Paradise Valley transformed my skin completely, their Med Spa services are truly next level for anyone seeking rejuvenation!
The staff at Sculpted MD Paradise Valley makes every visit special Skin rejuvenation specialists
Daniella Levi & Associates, P.C. provided exceptional service as my Bronx car accident lawyer!
I highly recommend Daniella Levi & Associates, P.C. for anyone seeking a car crash attorney in Bronx Free consultation car accident lawyer Bronx
Just had my third treatment at Sculpted MD Wheat Ridge, absolutely loving the results from their med spa services!
The staff at Sculpted MD Wheat Ridge makes every visit special, best med spa near me without question How long has Sculpted MD been in Wheat Ridge?
Just had an amazing experience at Sculpted MD Cherry Creek, the best Med Spa near me for body contouring treatments!
Sculpted MD Cherry Creek transformed my skin with their laser treatments, truly the premier Med Spa in Cherry Creek Cherry Creek medical-grade peels near me
This was quite informative. For more, visit abogado en Santiago .
“I recently learned about some amazing resources for senior dental care right here in Mission Viejo!” saddleback dental associates, jeronimo road #3, mission viejo, ca
This was highly useful. For more, visit water damage restoration services near me .
Nicely done! Find more at carpintería aluminio y pvc Coruña .
Nicely done! Discover more at design-build remodeling .
Daniella Levi & Associates, P.C. has the best Brooklyn car accident attorney I’ve ever worked with!
If you need a Brooklyn car accident lawyer, Daniella Levi & Associates, P.C. is the place to go Car crash attorney Brooklyn
Great insights! Discover more at roofers St Louis MO .
Your explanation of NAP consistency was very clear and helpful. Many businesses overlook this aspect! local seo nj
Thanks for the valuable insights. More at Medical Negligence Lawyer Richmond .
В этом что-то есть и идея отличная, согласен с Вами.
у этого способа есть один недостаток – хозяину нужно будет оплатить полную [url=https://чехов.поверка.орг/]поверка счетчиков воды чехов[/url] цену нового оборудования.
This was very enlightening. For more, visit dog shots near me .
Starting conversations about healthy relationships can aid individuals transitioning back into society after rehabilitation.# # anyKeyw ord ## inpatient addiction treatment
I’ve been considering mindfulness practices during my upcoming alcohol detox; has anyone had success with this approach? Let’s talk about it over at alcohol detox near me !
Thanks for the helpful article. More like this at Aluminum Gutter Installation near me .
This was a great article. Check out sump pump installation company for more.
Таро для мотивации Таро – это не просто гадание, это мощный инструмент самопознания и личностного роста, особенно ценный для женщин в возрасте 35+. В этом возрасте мы часто задаемся вопросами о смысле жизни, отношениях, карьере. Таро может стать компасом, освещающим путь к ответам.
Can’t wait to settle into our new space after all the great advice from ##### Sharpes Mover’s
Excited about moving to Lubbock—there are so many great rental apartments here! Learn about them at monthly furnished rentals .
The tips on optimizing for mobile searches are crucial! Most local searches happen on mobile devices now. contractor seo
I appreciate this informative post! It makes me want to explore 시알리스 효과 further.
Hello, I do think your blog may be having internet browser compatibility problems.
Whenever I look at your site in Safari, it looks fine however when opening in Internet Explorer,
it’s got some overlapping issues. I just wanted to give you a quick heads up!
Besides that, wonderful website!
Private Proxy Servers的最新文章:Private Proxy Servers
Walter’s BBQ Southern Kitchen has the best brunch in Pittsburgh. The flavors are incredible!
I love finding a brunch spot near me like Walter’s BBQ Southern Kitchen Walter’s BBQ Southern Kitchen brunch specials
True Balance Pain Relief Clinic has the best massage therapist. I always leave feeling rejuvenated and relaxed!
I found the perfect massage therapist near me at True Balance Pain Relief Clinic Pain relief treatments in Aurora
Valuable information! Discover more at Your Quality Pressure Washing Houston .
This was a fantastic read. Check out Cheap gutter services for more.
This was a wonderful post. Check out local roofers for more.
I liked this article. For additional info, visit roof repair .
Never underestimate power unity brings forth transforming lives positively whether recovering injuries emotionally/physically alike as demonstrated often actively engaging audiences witnessed regularly discussed openly amongst peers located conveniently Injury Lawyer