Nginx的SSL配置优化 – HTTPS SSL 教程
一般网站使用的 SSL证书都是RSA证书,这种证书基本都是2048位的密钥,但是证书密钥交换密钥必须要比证书密钥更长才能安全,而默认的只有1024位,所以我们需要手动生成一个更强的密钥。所以配置之前,如果没有DH-key就需要做下面的步骤
有screen则跳过,没则安装
yum -y install screen11
生成4096位的DH-Key(证书密钥交换密钥)
screen -S DH openssl dhparam -out dhparam.pem 40961212
执行之后需要等很长时间,总之慢慢等,网路出现中断,可以执行下面命令重新连接安装窗口
screen -r DH11
熬过漫长的等待时间后,建议生成的dhparam.pem文件最好跟SSL证书放在一起方便管理。
有了证书密钥交换密钥后,我们继续配置,打开网站所对应的Nginx的conf配置文件
假设我的配置文件是在 /usr/local/nginx/conf/vhost 的目录
vim /usr/local/nginx/conf/vhost/www.linpx.com.conf11
配置如下,只包含了ssl的部分,未包含其他比较重要的配置,如缓存、跳转、防盗链和强制HTTPS等等
server { listen 443 ssl http2; add_header Strict-Transport-Security "max-age=6307200; includeSubdomains; preload"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; ssl_certificate /usr/local/nginx/conf/vhost/sslkey/www.linpx.com.crt; ssl_certificate_key /usr/local/nginx/conf/vhost/sslkey/www.linpx.com.key; ssl_trusted_certificate /usr/local/nginx/conf/vhost/sslkey/chaine.pem; ssl_dhparam /usr/local/nginx/conf/vhost/sslkey/dhparam.pem; ssl_session_timeout 10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5; ssl_prefer_server_ciphers on; ssl_session_cache builtin:1000 shared:SSL:10m; ssl_session_tickets on; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s; ··· }12345678910111213141516171819202122232425262728293031321234567891011121314151617181920212223242526272829303132
各行解析:
server { listen 443 ssl http2;#使用HTTP/2,需要Nginx1.9.7以上版本add_header Strict-Transport-Security "max-age=6307200; includeSubdomains; preload";#开启HSTS,并设置有效期为“6307200秒”(6个月),包括子域名(根据情况可删掉),预加载到浏览器缓存(根据情况可删掉)add_header X-Frame-Options DENY;#禁止被嵌入框架add_header X-Content-Type-Options nosniff;#防止在IE9、Chrome和Safari中的MIME类型混淆攻击ssl_certificate /usr/local/nginx/conf/vhost/sslkey/www.linpx.com.crt; ssl_certificate_key /usr/local/nginx/conf/vhost/sslkey/www.linpx.com.key;#SSL证书文件位置ssl_trusted_certificate /usr/local/nginx/conf/vhost/sslkey/chaine.pem;#OCSP Stapling的证书位置ssl_dhparam /usr/local/nginx/conf/vhost/sslkey/dhparam.pem;#DH-Key交换密钥文件位置#SSL优化配置ssl_protocols TLSv1 TLSv1.1 TLSv1.2;#只允许TLS协议ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;#加密套件,这里用了CloudFlare's Internet facing SSL cipher configurationssl_prefer_server_ciphers on;#由服务器协商最佳的加密算法ssl_session_cache builtin:1000 shared:SSL:10m;#Session Cache,将Session缓存到服务器,这可能会占用更多的服务器资源ssl_session_tickets on;#开启浏览器的Session Ticket缓存ssl_session_timeout 10m; #SSL session过期时间ssl_stapling on; #OCSP Stapling开启,OCSP是用于在线查询证书吊销情况的服务,使用OCSP Stapling能将证书有效状态的信息缓存到服务器,提高TLS握手速度ssl_stapling_verify on;#OCSP Stapling验证开启resolver 8.8.8.8 8.8.4.4 valid=300s;#用于查询OCSP服务器的DNSresolver_timeout 5s;#查询域名超时时间··· }12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758591234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859
配置完后请记得重启Nginx!
CentOS 6.x:
service nginx restart11
CentOS 7.x:
systemctl restart nginx