Nginx SSL

June 6th, 2017

基本需求

你需要升级 Nginx 到 1.9.5 以上的版本，安装方法可以参考: install_nginx

安装http2

如果你是 Ubuntu Server 可以直接安装:

curl -O http://nginx.org/keys/nginx_signing.key
sudo apt-key add nginx_signing.key
sudo bash -c 'echo "deb http://nginx.org/packages/ubuntu/ $(lsb_release -cs) nginx
deb-src http://nginx.org/packages/ubuntu/ $(lsb_release -cs) nginx" > /etc/apt/sources.list.d/nginx-stable.list'
sudo apt-get update
sudo apt-get install -y nginx nginx-module-image-filter nginx-module-geoip
nginx -v

然后修改 Nginx 配置:

server {
  listen 443 ssl http2;
  ...
}

然后sudo service nginx reload 重启

用Let Encrypts 进行SSL加密

安装 acme.sh

curl https://get.acme.sh | sh

然后重新载入一下 .bashrc

source ~/.bashrc

申请签发 SSL 证书

acme.sh --issue --nginx -d www.your-app.com

你的证书文件已经申请成功了，并放到了 ~/.acme.sh/ 目录里面将 SSL 证书安装到网站的路径，并配置好 restart Nginx 的动作

acme.sh --installcert -d www.your-app.com \
               --keypath       /home/ubuntu/www/ssl/www.your-app.com.key  \
               --fullchainpath /home/ubuntu/www/ssl/www.your-app.com.key.pem \
               --reloadcmd     "sudo service nginx reload"

生成 dhparam.pem 文件

openssl dhparam -out /home/ubuntu/www/ssl/dhparam.pem 2048

修改 Nginx 启用 SSL nginx 的最终配置

upstream puma-appname-production {
  server unix:/var/apps/appname_production/shared/tmp/sockets/puma.sock fail_timeout=0;
}
server {
 listen 80;
  server_name yourdomain.com *.yourdomain.com;
  return 301 https://yourdomain.com$request_uri;
}
server {
  server_name  yourdomain.com;

  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  ssl_certificate         /var/apps/www/ssl/yourdomain.com.key.pem;
  ssl_certificate_key     /var/apps/www/ssl/yourdomain.com.key;
  ssl_dhparam             /var/apps/www/ssl/dhparam.pem;

  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
   ssl_prefer_server_ciphers on;
   add_header Strict-Transport-Security max-age=15768000;
   ssl_stapling on;
   ssl_stapling_verify on;

  access_log  /var/apps/appname_production/shared/log/nginx_access.log;
  error_log   /var/apps/appname_production/shared/log/nginx_error.log;

 root /var/apps/appname_production/current/public;

 client_max_body_size 20M;

 location / {
   proxy_set_header    Host              $host;
   proxy_set_header    X-Real-IP         $remote_addr;
   proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
   proxy_set_header    X-Forwarded-SSL on;
   proxy_set_header    X-Forwarded-Proto $scheme;

   proxy_pass http://puma-appname-production;

   proxy_connect_timeout       600;
   proxy_send_timeout          600;
   #  auth_basic "nginx basic auth";
 #  auth_basic_user_file /var/apps/basic_auth_file;
 }

 location ~* ^/(.well-known|assets|static|uploads)/(.+)$ {
   expires  365d;
 }

 location ~* ^/(favicon.ico|robots.txt|apple-touch-icon.png|logo.png)$ {
   expires 365d;
 }
}

到这里就完成了,不出意外评分可以获得A+

http2 (1)

colorfulberry

衣服不破不丢，奋斗不死不休！