nginx 支持http3

先下载 openssl安装和基本使用 （windows）

最后就是修改你的网站Nginx配置文件了，在ssl_protocols 后面添加TLSv1.3，在ssl_ciphers添加数个加密套件，重启Nginx完成。以下是我的Nginx的TLSv1.3配置，ssl_ciphers 的TLSv1.3部分是新增加的。


    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

    #ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

    ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;

 

# generated 2023-02-24, Mozilla Guideline v5.6, nginx 1.20.2, OpenSSL 1.1.1i, intermediate configuration, no HSTS, no OCSP
# https://ssl-config.mozilla.org/#server=nginx&version=1.20.2&config=intermediate&openssl=1.1.1i&hsts=false&ocsp=false&guideline=5.6
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate /path/to/signed_cert_plus_intermediates;
    ssl_certificate_key /path/to/private_key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
    ssl_dhparam /path/to/dhparam;

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
}

 

listen 443 ssl;
ssl on;
ssl_certificate /root/roov.org.crt;
ssl_certificate_key /root/roov.org.key;
ssl_ciphers “EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH”;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security “max-age=63072000; includeSubdomains; preload”; # HSTS
add_header X-Frame-Options DENY;
ssl_dhparam /root/dhparams.pem;
add_header X-Content-Type-Options nosniff;
ssl_session_tickets off; # nginx >= 1.5.9
ssl_stapling on; # nginx >= 1.3.7
ssl_stapling_verify on; # nginx => 1.3.7
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

 

开启TLS1.3 Only后CSS样式不能加载

之前并不是TLS1.3 Only的模式，开启后CSS样式加载不出来，在网上搜了半天，add header也不管用，最后发现，只需删除html文件第一行的**<!DOCTYPE html>**就好了，这么简单的，却花了我几个小时。

posted @ 2023-02-24 16:13  锐洋智能  阅读(349)  评论(0)  编辑  收藏  举报