nginx TLSv1.3配置

nginx TLSv1.3配置参考网站

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    location / {
        return 301 https://$host$request_uri;
    }
}

  server {
      listen 443 ssl http2;
      listen [::]:443 ssl http2;

      ssl_certificate /path/to/signed_cert_plus_intermediates;
      ssl_certificate_key /path/to/private_key;
      ssl_session_timeout 1d;
      ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
      ssl_session_tickets off;

      # modern configuration
      ssl_protocols TLSv1.3;
      ssl_prefer_server_ciphers off;

      # HSTS (ngx_http_headers_module is required) (63072000 seconds)
      add_header Strict-Transport-Security "max-age=63072000" always;
  }
}

参考文档

1. nginx http 通用配置
2. 更多 web配置SSL参考网站
3. TLSv1.3实践