最后版本 |
您的文字 |
第1行: |
第1行: |
| <code>/etc/nginx/conf.d/ssl_security.conf</code><syntaxhighlight lang="nginx"> | | <code>/etc/nginx/conf.d/ssl_security.conf</code><syntaxhighlight lang="nginx"> |
| ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | | ssl_protocols TLSv1 TLSv1.1 TLSv1.2; |
− | ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
| |
| ssl_prefer_server_ciphers on; | | ssl_prefer_server_ciphers on; |
− | ssl_dhparam /etc/nginx/ssl/dhparams.pem; # Run `openssl dhparam -out /etc/nginx/ssl/dhparams.pem 2048` beforehead
| + | ssl_ciphers GCM:HIGH:!DH:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; |
| ssl_session_cache shared:SSL:10m; | | ssl_session_cache shared:SSL:10m; |
| | | |