diff --git a/PerfectSSL.conf b/PerfectSSL.conf index 8471f78..d2971ba 100644 --- a/PerfectSSL.conf +++ b/PerfectSSL.conf @@ -1,27 +1,42 @@ -## 将本文件放在 nginx.conf 同级目录,在需要配置 HTTPS 的 server 里引入本文件 -## 本配置评分可以达到 A+,评分地址:https://www.ssllabs.com/ssltest/ -## 引入方法: include PerfectSSL.conf; +## +## 本配置评分可以达到 A+,评分地址: https://www.ssllabs.com/ssltest/ +## 更多配置信息可以看: https://mozilla.github.io/server-side-tls/ssl-config-generator/ +## +# Nginx 1.9+ 才支持 HTTP2 协议 +# listen 443 ssl http2; +listen 443 ssl; + +# 开启 SSL 功能 ssl on; -# 修改这里,SSL 密钥文件路径 -ssl_certificate_key /PATH/xxxxxx.key; +# 修改这里,SSL 证书文件路径,由证书签发机构提供 +ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; + +# 修改这里,SSL 密钥文件路径,由证书签发机构提供 +ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; + +# 修改这里,CA 根证书文件路径,由证书签发机构提供 +ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem; -# 修改这里,SSL 证书文件路径 -ssl_certificate /PATH/xxxxxx.crt; +# 修改这里,Diffie-Hellman 密钥文件路径,建议定期更改 +# 生成方法: openssl dhparam -out dhparam.pem 4096 +ssl_dhparam /etc/nginx/ssl/dhparam.pem; -# 修改这里,CA 根证书文件路径 -ssl_trusted_certificate /PATH/CA.crt; +# 修改这里,加密或解密 session_ticket 密钥文件路径,建议定期更改 +# 生成方法: openssl rand 48> session_ticket.key +ssl_session_ticket_key /etc/nginx/ssl/session_ticket.key; -# 修改这里,Diffie-Hellman 密钥文件路径 -# 生成方法: openssl dhparam -out dhparam.pem 4096 -ssl_dhparam /PATH/dhparam.pem; +# TLSv1.3 需要 Nginx 1.13+,OpenSSL draft-18+ 分支 +# ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; +# ssl_ciphers "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; + +ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; -ssl_protocols TLSv1.2 TLSv1.1 TLSv1; -ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; ssl_prefer_server_ciphers on; -ssl_session_timeout 10m; -ssl_session_cache shared:TLS:10m; +ssl_session_timeout 1d; +ssl_session_cache shared:SSL:50m; ssl_session_tickets on; ssl_buffer_size 1400; ssl_stapling on; @@ -30,14 +45,9 @@ ssl_stapling_verify on; # 修改这里,国内填 223.5.5.5 223.6.6.6,国外填 8.8.4.4 8.8.8.8 resolver 8.8.4.4 8.8.8.8 valid=300s; -resolver_timeout 10s; -spdy_headers_comp 6; +resolver_timeout 5s; add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; - -# 取消注释这里,如果支持 SPDY 的话 -# add_header Alternate-Protocol "443:npn-spdy/3"; - add_header X-Content-Type-Options "nosniff"; add_header X-Frame-Options "DENY"; add_header X-XSS-Protection "1; mode=block";

AltStyle によって変換されたページ (->オリジナル) /