首先奶陈，需要升級(jí)系統(tǒng)自帶的 openssl抱完，因?yàn)橄到y(tǒng)自帶的 openssl 比較老，openssl 已經(jīng)被爆出很多漏洞蟆盹，升級(jí)無(wú)疑是最佳選擇我這里以 nginx1.11.6為例孩灯，搭建了一個(gè) https關(guān)于openssl ，參考centos 編譯安裝 openssl關(guān)于ssl 證書(shū) 參考Let's Encrypt 申請(qǐng)免費(fèi)ssl證書(shū)
升級(jí)nginx
1.下載 openssl逾滥，然后解壓后修改為 openssl
wget -c https://www.openssl.org/source/openssl-1.0.2j.tar.gz
tar zxvf openssl-1.0.2j.tar.gz
cd openssl-1.0.2j
2.進(jìn)入 nginx 目錄
cd nginx-1.11.6
./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-openssl=/root/openssl && make
3.復(fù)制編譯后的 nginx 文件替換 nginx
cp /usr/local/nginx/sbin/nginx{,.old} # 備份之前的 nginx
cp ./objs/nginx /usr/local/nginx/sbin/
4.查看nginx
[root@host-133-130-118-235 sbin]# ./nginx -V
nginx version: nginx/1.11.6
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)
built with OpenSSL 1.0.2j? 26 Sep 2016
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-openssl=/root/openssl
5.修改nginx 配置文件峰档，注意這里只貼下 ssl 的相關(guān)配置
server
{
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server ipv6only=on;
server_name www.awen.me awen.me blog.awen.me;
index index.html index.htm index.php;
root? /home/wwwroot/default;
ssl on;
ssl_certificate? ? /etc/letsencrypt/live/awen.me/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/awen.me/privkey.pem;
ssl_protocols? ? ? TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
ssl_prefer_server_ciphers on;
resolver 114.114.114.114;
resolver_timeout 30s;
#error_page? 404? /404.html;
include enable-php.conf;
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
return? ? ? ? 444;
}
6.去這里測(cè)試https://www.ssllabs.com/ssltest/analyze.html
