冷轩信 - ssl
type: channel
link: https://lengxx.com/tag/ssl/
items: 启用Let’s Encrypt SSL证书并做安全设置

启用Let’s Encrypt SSL证书并做安全设置
type: item
date: 2016-08-10T12:23:00+00:00
description: 由于要同时为多个域名申请ssl证书，为了方便所以要关闭占用80端口的程序git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt ./letsencrypt-auto --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory certonly 最后生成的证书在/etc/letsencrypt/live/yourdomain目录下使用 openssl 工具生成 dhparamsopenssl dhparam -out /etc/ssl/certs/dhparams.pem 2048 最后是nginx配置文件修改，ssl on; ssl_certificate /etc/letsencrypt/live/lengxx.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/lengxx.com/privkey.pem; ssl_dhparam /etc/ssl/certs/dhparams.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RC4-SHA:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!DSS:!PKS:!RC4; ssl_session_timeout 5m; ssl_session_cache builtin:1000 shared:SSL:10m; add_header Strict-Transport-Security "max-age=31536000;"; 这样在 https://www.ssllabs.com/ 测试成绩就应为A2个月后续期 ./letsencrypt-auto renew --email youremail@gmail.com --agree-tos