Question

我检查了很多手册，并对nginx ssl设置（How do you score A+ with 100 on all categories on SSL Labs test with Let's Encrypt and Nginx?）进行了推荐设置，但是ssllab的等级仍然是B： https://www.ssllabs.com/ssltest/analyze.html?d=remo24.ru

Nginx：1.12.1 的Openssl：1.0.1吨我的nginx conf文件：

nginx.conf

http {
    include       /etc/nginx/mime.types;

## Start add by hoster support
    proxy_read_timeout 500;
    proxy_connect_timeout 500;
    client_max_body_size 100M;
    server_names_hash_bucket_size 64;
## End add by hoster support

#My ssl config
    ssl_session_tickets off;
 ...

ssl.conf

ssl_protocols TLSv1.2 TLSv1.1 TLSv1
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS; # Score=90 (recommended)

ssl_prefer_server_ciphers on;

启用站点/{hostname}.conf

服务器{ 听{server_ip}：443 ssl;

server_name {hostname};

ssl on;

ssl_stapling on;
ssl_stapling_verify on;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_ecdh_curve secp384r1;

resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 10s;

add_header Strict-Transport-Security max-age=31536000;      

ssl_certificate     /etc/nginx/ssl/{hostname}/chain.crt;
ssl_certificate_key /etc/nginx/ssl/{hostname}/cert.key;
ssl_dhparam /etc/nginx/ssl/{hostname}/dhparam.pem;

怎么了？我应该检查什么？

Answer 1

我无法相信，答案很简单：我忘了在域的/ sites-enabled配置中手动包括nginx ssl配置！

   server{
     ssl on;
     ...
        #Include global SSL settings
        include /etc/nginx/ssl.conf;
     ...

Nginx conf ssl平板B评级

1 个答案: