标签 nginx 下的文章

参考韩艺博的博客)) view English version

在nginx配置中插入

ssl on;
ssl_certificate       /path/to/your/certificate.crt;
ssl_certificate_key  /path/to/your/private.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers 'TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;';
ssl_session_cache    shared:SSL:1m;
ssl_session_timeout  5m;
ssl_session_tickets off;
ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1;
ssl_prefer_server_ciphers  on;

注意ssl_session_cache等配置不要和vhost中的配置有冲突!

1.最重要的,不能引http的资源,能放http的链接..(感谢纠正 @孙天骁),否则chrome不显示小绿锁

2.ssl for free

此为ssl证书来源

3.ubuntu 14.04

usr/local/nginx/conf

主站的nginx.conf

配置server中增加

location ^~ /.well-known/ {
access_log off;
log_not_found off;
root /var/www/html;
autoindex off;
index index.html; # "no-such-file.txt",if expected protos don't need it
try_files $uri $uri/ =404;
}

重启lnmp

这样ssl for free就可以读到well known目录下的东西了,root修改为网站root

ssl下来后

增加一段

server {

listen       443 ssl;

server_name  lanhaoo.club www.lanhaoo.club;
root /var/www/html;

ssl on;

ssl_certificate  /path/to/certificate.crt;   

ssl_certificate_key  /path/to/private.key; 

ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache    shared:SSL:1m;

ssl_session_timeout  5m;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";

ssl_prefer_server_ciphers  on;

include enable-php.conf;

location / {

try_files $uri $uri/ /index.php$is_args$args;

}

标红需自定义

80端口那里增加return 301 https://www.lanhaoo.club$request_uri;

强制跳转Https

wordpress加装一个插件really simple ssl即可

注:如果使用ssl for free, 会有certificate.crt和CA_bundle.crt。你需要把CA_bundle的内容复制到certificate中,这样就能补齐SSL中间链,手机浏览器就不会提示错误了