Nginx SSL 配置

最基础的配置：

开启 SSL 的基本配置

视频链接：https://www.laravist.com/series/deploy-a-website-from-scratch/episodes/6

listen 443 ssl default_server;

listen [::]:443 ssl default_server;


ssl on;

ssl_certificate /etc/nginx/ssl/phpjit.net.crt;

ssl_certificate_key /etc/nginx/ssl/phpjit.net.key;

http 跳转到 https：

多加一个 server block，监听 80 端口，返回 301 重定向。

视频链接：https://www.laravist.com/series/deploy-a-website-from-scratch/episodes/7

server {

    listen 80 default_server;

    listen [::]:80 default_server;

    server_name laravist.com www.laravist.com;

    return 301 https://$server_name$request_uri;

}

SSL A+ 的配置

视频链接：https://www.laravist.com/series/deploy-a-website-from-scratch/episodes/8

生成一个 DH group。

sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

再来就是针对 SSL 做一些自定义的设置：

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

ssl_ecdh_curve secp384r1;

ssl_session_cache shared:SSL:10m;

ssl_session_tickets off;

ssl_stapling on;

ssl_stapling_verify on;

resolver 8.8.8.8 8.8.4.4 valid=300s;

resolver_timeout 5s;

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

add_header X-Frame-Options DENY;

add_header X-Content-Type-Options nosniff;


ssl_dhparam /etc/nginx/ssl/dhparam.pem;