Nginx安裝及支持https代理配置和禁用TSLv1.0、TSLv1.1配置

Linux安裝Nginx

Nginx安裝及支持https代理配置和禁用TSLv1.0、TSLv1.1配置。

下載安裝包

[root@localhost ~]# wget http://nginx.org/download/nginx-1.18.0.tar.gz

解壓下載的安裝包

[root@localhost ~]# tar -zxvf nginx-1.18.0.tar.gz # 解壓后會生成nginx-1.18.0目錄

進入解壓目錄

[root@localhost ~]# cd nginx-1.18.0

配置安裝

[root@localhost ~]# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

• --prefix=/usr/local/nginx為nginx的安裝路徑，路徑可以自定義
• --with-http_stub_status_module與--with-http_ssl_module 為https代理所必需的模塊

編譯並且安裝

[root@localhost ~]# make && make install

配置https代理設置

更換安裝路徑的下的nginx的啟動文件為nginx-1.18.0/objs下的nginx

[root@localhost ~]# cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak	# 安裝路徑為/usr/local/nginx
[root@localhost ~]# rm -f /usr/local/nginx/sbin/nginx
[root@localhost ~]# cp ./nginx-1.18.0/objs/nginx /usr/local/nginx/sbin/nginx # 基於解壓目錄

設置nginx的配置文件

    	listen ip:port ssl;
        #listen 8097;	1.18版本會有一個警告，提示改為 listen ip:port ssl
        server_name  cwdd.westaport.com;
        charset utf-8;
        index index.html;
        #ssl證書的pem文件路徑
        ssl_certificate  /root/card/server.pem;
        #ssl證書的key文件路徑
        ssl_certificate_key /root/card/server.key;

nginx默認會支持TSLv1.0與TSLv1.1,因此兩種方式存安全方面的漏洞，需屏蔽掉

配置nginx禁用TSLv1.0、TSLv1.1

	ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_prefer_server_ciphers on;
        ssl_protocols  TLSv1.2;

配置完成后啟動Nginx即可。

[root@localhost ~]#./nginx #啟動	
[root@localhost ~]#./nginx -s reload # 重啟
[root@localhost ~]#./nginx -s stop	# 停止
[root@localhost ~]#./nginx -v	# 查看版本

• 在安裝目錄的sbin目錄下執行以上命令。