{"id":388,"date":"2020-04-23T05:06:28","date_gmt":"2020-04-22T21:06:28","guid":{"rendered":"https:\/\/unama.website\/?p=388"},"modified":"2020-04-23T05:09:49","modified_gmt":"2020-04-22T21:09:49","slug":"turn-your-website-ssl-labs-test-grade-to-a","status":"publish","type":"post","link":"https:\/\/unama.website\/?p=388","title":{"rendered":"Turn Your Website SSL Labs Test Grade to A+"},"content":{"rendered":"\n<p>\u6ce8\u610f: SSL Labs \u57282020\/1\/31\u5c07\u6240\u6709\u5141\u8a31TLS 1.0\u548cTLS 1.1\u7684\u7db2\u7ad9\u5206\u6578\u4e00\u5f8b\u8abf\u6210B<\/p>\n\n\n\n<p>\u6240\u4ee5\u6211\u5011\u53ef\u4ee5\u5148\u53bb\u8a2d\u5b9a\u6a94\u628aTLS 1.0\u548cTLS 1.1\u62ff\u6389<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/nginx\/nginx.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;\nssl_protocols TLSv1.2 TLSv1.3;<\/code><\/pre>\n\n\n\n<p>\u5982\u679c\u4f60\u6709\u4f7f\u7528Let\u2019s Encrypt SSL Certificate\uff0c\u8a18\u5f97\u8981\u53bb\u8a2d\u5b9a\u6a94\u628aCerbot\u7684\u8a2d\u5b9a\u8a3b\u89e3\uff0c\u4e0d\u8981\u76f4\u63a5\u66f4\u6539\u4ed6\u7684\u8a2d\u5b9a\u6a94\uff0c\u5426\u5247\u6191\u8b49\u53ef\u80fd\u5c31\u6c92\u8fa6\u6cd5\u81ea\u52d5\u66f4\u65b0\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/nginx\/sites-available\/default<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>#include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot<\/code><\/pre>\n\n\n\n<p>\u5230\u9019\u4e00\u6b65\u4f60\u53ef\u4ee5\u5230SSL Labs\u6e2c\u770b\u770b\uff0c\u61c9\u8a72\u80fd\u5230A\uff0c\u628a\u4e0b\u5217\u7db2\u5740\u6539\u6210\u4f60\u7684domain<\/p>\n\n\n\n<p>https:\/\/www.ssllabs.com\/ssltest\/analyze.html?d=yourdomain.com                <\/p>\n\n\n\n<h2>to A+<\/h2>\n\n\n\n<p>\u5176\u5be6\u5f88\u7c21\u55ae\uff0c\u5c31\u662f\u555f\u7528HSTS\uff0c\u96d6\u7136\u6211\u5011\u90fd\u6703\u8a2d\u5b9a\u8b93http request\u91cd\u65b0\u5c0e\u5411\u5230https\uff0c\u4f46\u5982\u679c\u555f\u7528\u4e86HSTS(HTTP Strict Transport Security)\u5c31\u53ef\u4ee5\u907f\u514d\u9019\u4e9b\u91cd\u5c0e\u5411\uff0c\u7576\u700f\u89bd\u5668\u767c\u73fe\u4f60\u7684\u7db2\u7ad9\u7684HSTS header\u6642\uff0c\u5c31\u4e0d\u6703\u5617\u8a66\u53bb\u9023HTTP(\u4e00\u6bb5\u6642\u9593\u5167\uff0c\u53ef\u8a2d\u5b9a)\uff0c\u800c\u662f\u76f4\u63a5\u9023HTTPS\uff0cHSTS\u9084\u80fd\u907f\u514d<a href=\"https:\/\/en.wikipedia.org\/wiki\/Downgrade_attack\">downgrade attacks<\/a>\u3002<\/p>\n\n\n\n<p>\u73fe\u5728\u958b\u59cb\u5427!<\/p>\n\n\n\n<p>\u5728\u8a2d\u5b9a\u6a94\u88e1\u52a0\u4e0ahttp2<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/nginx\/sites-available\/default<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>...\n    listen &#91;::]:443 ssl http2 ipv6only=on; \n    listen 443 ssl http2; \n...<\/code><\/pre>\n\n\n\n<p>\u9019\u6a23\u6709\u652f\u63f4http2\u7684\u700f\u89bd\u5668nginx\u5c31\u6703\u81ea\u52d5\u4f7f\u7528http2<\/p>\n\n\n\n<p>\u52a0\u5165\u9019\u884c:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;<\/code><\/pre>\n\n\n\n<p>\u6aa2\u67e5\u8a9e\u6cd5\u5f8c\u91cd\u65b0\u8f09\u5165\u8a2d\u5b9a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nginx -t \nsudo systemctl reload nginx<\/code><\/pre>\n\n\n\n<p>\u4f60\u53ef\u4ee5\u7528\u9019\u500b\u65b9\u6cd5\u4f86\u770bhttp2 header\u6709\u6c92\u6709\u9806\u5229\u52a0\u5165<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -I -L https:\/\/your_domain<\/code><\/pre>\n\n\n\n<p>\u770b\u662f\u5426\u51fa\u73feHTTP\/2 200<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\/2 200\nserver: nginx\/1.14.0 (Ubuntu)\ndate: Wed, 22 Apr 2020 20:57:26 GMT\ncontent-type: text\/html; charset=UTF-8<\/code><\/pre>\n\n\n\n<p>\u7de8\u8f2f\u8a2d\u5b9a\u6a94<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/nginx\/nginx.conf<\/code><\/pre>\n\n\n\n<p>\u555f\u52d5Http2\u4e26\u8a2d\u5b9a\u6548\u671f(6\u500b\u6708)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http {\n...\n    ##\n    # Virtual Host Configs\n    ##\n\n    include \/etc\/nginx\/conf.d\/*.conf;\n    include \/etc\/nginx\/sites-enabled\/*;\n    add_header Strict-Transport-Security \"max-age=15768000\" always;\n}\n...<\/code><\/pre>\n\n\n\n<p>\u5982\u679c\u4f60\u6709subdomains\u4e5f\u8981\u7528HSTS\uff0c\u53ef\u4ee5\u52a0\u4e0aincludeSubDomains<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains\" always;<\/code><\/pre>\n\n\n\n<p>\u6aa2\u67e5\u8a9e\u6cd5\u5f8c\u91cd\u65b0\u8f09\u5165\u8a2d\u5b9a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nginx -t\nsudo systemctl reload nginx<\/code><\/pre>\n\n\n\n<p>\u9019\u6642\u5019\u518d\u5230\u5230<a href=\"https:\/\/www.ssllabs.com\/ssltest\/\">SSL Labs<\/a>\u6e2c\u8a66\u770b\u5230\uff0c\u770b\u5206\u6578\u662f\u5426\u80fd\u5230A+!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6ce8\u610f: SSL Labs \u57282020\/1\/31\u5c07\u6240\u6709\u5141\u8a31TLS 1.0\u548cTLS 1.1\u7684\u7db2\u7ad9\u5206\u6578\u4e00\u5f8b\u8abf\u6210B \u6240\u4ee5\u6211\u5011\u53ef\u4ee5\u5148\u53bb\u8a2d\u5b9a\u6a94\u628aTLS 1.0\u548cTLS 1&#8230;.<\/p>\n<p class=\"read-more\"><a class=\"btn btn-default\" href=\"https:\/\/unama.website\/?p=388\"> Read More<span class=\"screen-reader-text\">  Read More<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[7,5],"tags":[],"_links":{"self":[{"href":"https:\/\/unama.website\/index.php?rest_route=\/wp\/v2\/posts\/388"}],"collection":[{"href":"https:\/\/unama.website\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unama.website\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unama.website\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/unama.website\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=388"}],"version-history":[{"count":1,"href":"https:\/\/unama.website\/index.php?rest_route=\/wp\/v2\/posts\/388\/revisions"}],"predecessor-version":[{"id":389,"href":"https:\/\/unama.website\/index.php?rest_route=\/wp\/v2\/posts\/388\/revisions\/389"}],"wp:attachment":[{"href":"https:\/\/unama.website\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unama.website\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unama.website\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}