跟着社区步伐体验了一下Let's Encrypt

也是参考了 点击这里 这篇文章和置顶帖 正好自己最近新的博客上线,网站还没有挂HTTPS,就试着操作了一下

准备条件

• Nginx
• Git

我之前项目已经正常在跑,所以Nginx反代之类的设置就不需要了,直接开始配置

利用Git Clone
git clone https://github.com/letsencrypt/letsencrypt
然后进入文件夹,执行下列命令,即给当前服务器安装证书
./letsencrypt-auto certonly
会有一段时间的下载依赖,完成之后会弹出UI页面提示你进行输入

这里我选择Standalone

然后输入要绑定的域名,域名检测完毕之后同意他的协议即可,然后就会结束图形界面,提示成功啦! 到这里我们的Let's Encrypt证书就创建完成了.

为了提升安全性,我们需要建立Diffie-Hellman密钥,这里根据CPU性能不同要花不少时间

openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

完成后进入nginx.conf进行配置

server{
listen 443 ssl;

        server_name 域名;
		//引入证书,提示成功时会给你证书的位置
        ssl_certificate /etc/letsencrypt/live/使用的域名/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/使用的域名/privkey.p;
		
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;
		location / {
			反代信息
		}
}

同时将80端口重定向给443端口

server {
    listen 80;
    server_name 域名;
    return 301 https://$host$request_uri;
}

到这里就大功告成啦

SSL评分也A+了