终于调出 HTTPS 的 A+

imlonghao

2015-09-30 23:02:23 +08:00

@hiroya 我也是 HTTP2 不过似乎也是 A+
https://imlonghao.com/

402645707

2015-09-30 23:14:34 +08:00

A+了 Chrome 依然黄锁

feather12315

2015-09-30 23:34:23 +08:00

一直 A+…
禁用 ssl3 ，启用 D-H 协商就行了。
我外加了强制 https 。

skydiver

2015-09-30 23:42:26 +08:00

照着这个页面 https://weakdh.org/sysadmin.html 改一下 nginx 配置就 A+了

Andy1999

2015-09-30 23:46:52 +08:00

@a33004407
@aholic http://2079920136
将 IP 转换为 32 位即可

hiroya

2015-09-30 23:49:10 +08:00

@imlonghao 那是必须的， http2 强制了 ssl

DiffView

2015-10-01 00:47:08 +08:00

貌似挂的只有 ie6 和 Java 6u45
https://www.ssllabs.com/ssltest/analyze.html?d=fancycoding.com

觉得没意思啊，没意思啊没意思啊没意思

sparanoid

2015-10-01 00:58:12 +08:00

像我从来不在乎兼容性的。只开 TLSv1.2 就可以全部四个 100 分了 https://www.ssllabs.com/ssltest/analyze.html?d=experiments.sparanoid.com

xierch

2015-10-01 02:18:50 +08:00

CloudFlare 开 HSTS 也是 A+， 100 95 90 90
不兼容 XP/IE ，需要支持 SNI

seki

2015-10-01 02:23:42 +08:00

我也是 a+
参考的是这篇文章 https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

Arnaud

2015-10-01 03:06:25 +08:00

#SSL Begin
listen 443 ssl;
ssl on;
ssl_certificate /home/wwwroot/your/vhost/crt.crt;
ssl_certificate_key /home/wwwroot/your/vhost/key.key;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_dhparam /home/wwwroot/your/vhost/dhparams.pem;
add_header Strict-Transport-Security max-age=31536000;
ssl_stapling on;
ssl_stapling_verify on;
#SSL End

这样配置就 A+了，参考
https://www.ssllabs.com/ssltest/analyze.html?d=ssno.de
https://www.ssllabs.com/ssltest/analyze.html?d=gfw.si

lincanbin

2015-10-01 04:19:32 +08:00

fengyqf

2015-10-01 08:29:23 +08:00

感觉是强迫症，跟 360 体检 100 分类似

aivier

2015-10-01 09:17:39 +08:00

什么？还有人考虑 IE8 ？...我连 IE10 都扔了

loveminds

2015-10-01 09:30:53 +08:00

为啥不用 debian 7 or 8

pwinner

2015-10-01 09:31:36 +08:00

@Arnaud 没生成 dhparam 就给这个路径是不是不妥

zhicheng

2015-10-01 09:36:57 +08:00

@loveminds 因为没有 233333

loveminds

2015-10-01 09:40:30 +08:00

@hiroya 本身就是泛域名证书的路过
@holulu 由于签发时间太早，所以...还是 SHA1withRSA

loveminds

2015-10-01 09:45:57 +08:00

@ivmm add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

hiroya

2015-10-01 09:46:29 +08:00

@loveminds 有钱，但邮件服务用的是第三方