mirror of
https://github.com/eiblog/eiblog.git
synced 2026-03-01 00:34:58 +08:00
添加双证书配置
This commit is contained in:
deepzz0
+59
-59
@@ -1,91 +1,90 @@
|
|||||||
server {
|
server {
|
||||||
listen 443 ssl http2 fastopen=3 reuseport;
|
listen 443 ssl http2 fastopen=3 reuseport;
|
||||||
|
|
||||||
server_name www.deepzz.com deepzz.com;
|
server_name www.deepzz.com deepzz.com;
|
||||||
server_tokens off;
|
server_tokens off;
|
||||||
|
|
||||||
include /data/eiblog/conf/nginx/ip.blacklist;
|
access_log /data/eiblog/logdata/nginx.log;
|
||||||
|
|
||||||
# 现在一般证书是内置的。可以注释该项
|
# ip 黑名单
|
||||||
|
include /data/eiblog/conf/nginx/ip.blacklist;
|
||||||
|
|
||||||
|
# 现在一般证书是内置的。letsencrypt 暂未
|
||||||
# https://imququ.com/post/certificate-transparency.html#toc-2
|
# https://imququ.com/post/certificate-transparency.html#toc-2
|
||||||
# ssl_ct on;
|
ssl_ct on;
|
||||||
# ssl_ct_static_scts /data/eiblog/conf/scts;
|
|
||||||
|
|
||||||
# 中间证书 + 站点证书
|
# 中间证书 + 根证书
|
||||||
ssl_certificate /data/eiblog/conf/ssl/domain.pem;
|
# https://imququ.com/post/why-can-not-turn-on-ocsp-stapling.html
|
||||||
|
ssl_trusted_certificate /data/eiblog/conf/ssl/full_chained.pem;
|
||||||
|
|
||||||
# 创建 CSR 文件时用的密钥
|
# 站点证书 + 中间证书，私钥
|
||||||
ssl_certificate_key /data/eiblog/conf/ssl/domain.key;
|
ssl_certificate /data/eiblog/conf/ssl/domain.rsa.pem;
|
||||||
|
ssl_certificate_key /data/eiblog/conf/ssl/domain.rsa.key;
|
||||||
|
ssl_ct_static_scts /data/eiblog/conf/scts/rsa/;
|
||||||
|
# ssl_certificate /data/eiblog/conf/ssl/domain.ecc.pem;
|
||||||
|
# ssl_certificate_key /data/eiblog/conf/ssl/domain.ecc.key;
|
||||||
|
# ssl_ct_static_scts /data/eiblog/conf/scts/ecc/;
|
||||||
|
|
||||||
# openssl dhparam -out dhparams.pem 2048
|
# openssl dhparam -out dhparams.pem 2048
|
||||||
# https://weakdh.org/sysadmin.html
|
# https://weakdh.org/sysadmin.html
|
||||||
ssl_dhparam /data/eiblog/conf/ssl/dhparams.pem;
|
ssl_dhparam /data/eiblog/conf/ssl/dhparams.pem;
|
||||||
|
|
||||||
# https://github.com/cloudflare/sslconfig/blob/master/conf
|
|
||||||
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
|
||||||
|
|
||||||
# 如果启用了 RSA + ECDSA 双证书，Cipher Suite 可以参考以下配置：
|
|
||||||
# ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;
|
|
||||||
|
|
||||||
ssl_prefer_server_ciphers on;
|
|
||||||
|
|
||||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
|
||||||
|
|
||||||
ssl_session_cache shared:SSL:50m;
|
|
||||||
ssl_session_timeout 1d;
|
|
||||||
|
|
||||||
ssl_session_tickets on;
|
|
||||||
|
|
||||||
# openssl rand 48 > session_ticket.key
|
# openssl rand 48 > session_ticket.key
|
||||||
# 单机部署可以不指定 ssl_session_ticket_key
|
# 单机部署可以不指定 ssl_session_ticket_key
|
||||||
# ssl_session_ticket_key /data/eiblog/conf/ssl/session_ticket.key;
|
# ssl_session_ticket_key /data/eiblog/conf/ssl/session_ticket.key;
|
||||||
|
|
||||||
ssl_stapling on;
|
# https://github.com/cloudflare/sslconfig/blob/master/conf
|
||||||
ssl_stapling_verify on;
|
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
||||||
|
|
||||||
# 根证书 + 中间证书
|
# 如果启用了 RSA + ECDSA 双证书，Cipher Suite 可以参考以下配置：
|
||||||
# https://imququ.com/post/why-can-not-turn-on-ocsp-stapling.html
|
# ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;
|
||||||
ssl_trusted_certificate /data/eiblog/conf/ssl/full_chained.pem;
|
|
||||||
|
|
||||||
resolver 114.114.114.114 8.8.8.8 valid=300s;
|
ssl_prefer_server_ciphers on;
|
||||||
resolver_timeout 10s;
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||||
|
ssl_session_cache shared:SSL:50m;
|
||||||
|
ssl_session_timeout 1d;
|
||||||
|
ssl_session_tickets on;
|
||||||
|
|
||||||
access_log /data/eiblog/logdata/nginx.log;
|
# ssl stapling
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
resolver 114.114.114.114 8.8.8.8 valid=300s;
|
||||||
|
resolver_timeout 10s;
|
||||||
|
|
||||||
if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$ ) {
|
if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$ ) {
|
||||||
return 444;
|
return 444;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ($host != 'deepzz.com' ) {
|
if ($host != 'deepzz.com' ) {
|
||||||
rewrite ^/(.*)$ https://deepzz.com/$1 permanent;
|
rewrite ^/(.*)$ https://deepzz.com/$1 permanent;
|
||||||
}
|
}
|
||||||
|
|
||||||
# webmaster 站点验证相关
|
# webmaster 站点验证相关
|
||||||
location ~* (robots\.txt|favicon\.ico|crossdomain\.xml|google4c90d18e696bdcf8\.html|BingSiteAuth\.xml)$ {
|
location ~* (robots\.txt|favicon\.ico|crossdomain\.xml|google4c90d18e696bdcf8\.html|BingSiteAuth\.xml)$ {
|
||||||
root /data/eiblog/static;
|
root /data/eiblog/static;
|
||||||
expires 1d;
|
expires 1d;
|
||||||
}
|
}
|
||||||
|
|
||||||
# imququ 的上传文件相关，未用到
|
# imququ 的上传文件相关，未用到
|
||||||
location ^~ /static/uploads/ {
|
location ^~ /static/uploads/ {
|
||||||
root /home/jerry/www/imququ.com/www;
|
root /home/jerry/www/imququ.com/www;
|
||||||
add_header Access-Control-Allow-Origin *;
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
|
||||||
set $expires_time max;
|
set $expires_time max;
|
||||||
|
|
||||||
valid_referers blocked none server_names *.qgy18.com *.inoreader.com feedly.com *.feedly.com www.udpwork.com theoldreader.com digg.com *.feiworks.com *.newszeit.com r.mail.qq.com yuedu.163.com *.w3ctech.com;
|
valid_referers blocked none server_names *.qgy18.com *.inoreader.com feedly.com *.feedly.com www.udpwork.com theoldreader.com digg.com *.feiworks.com *.newszeit.com r.mail.qq.com yuedu.163.com *.w3ctech.com;
|
||||||
if ($invalid_referer) {
|
if ($invalid_referer) {
|
||||||
set $expires_time -1;
|
set $expires_time -1;
|
||||||
return 403;
|
return 403;
|
||||||
}
|
}
|
||||||
|
|
||||||
expires $expires_time;
|
expires $expires_time;
|
||||||
}
|
}
|
||||||
|
|
||||||
location ^~ /static/ {
|
location ^~ /static/ {
|
||||||
root /data/eiblog;
|
root /data/eiblog;
|
||||||
add_header Access-Control-Allow-Origin *;
|
add_header Access-Control-Allow-Origin *;
|
||||||
expires max;
|
expires max;
|
||||||
}
|
}
|
||||||
|
|
||||||
location ^~ /admin/ {
|
location ^~ /admin/ {
|
||||||
@@ -96,7 +95,7 @@ server {
|
|||||||
# deny 将完全不允许页面被嵌套，可能会导致一些异常。如果遇到这样的问题，建议改成 SAMEORIGIN
|
# deny 将完全不允许页面被嵌套，可能会导致一些异常。如果遇到这样的问题，建议改成 SAMEORIGIN
|
||||||
# https://imququ.com/post/web-security-and-response-header.html#toc-1
|
# https://imququ.com/post/web-security-and-response-header.html#toc-1
|
||||||
add_header X-Frame-Options deny;
|
add_header X-Frame-Options deny;
|
||||||
|
add_header X-Powered-By eiblog/1.2.1;
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
|
|
||||||
proxy_set_header Connection "";
|
proxy_set_header Connection "";
|
||||||
@@ -114,7 +113,7 @@ server {
|
|||||||
add_header X-Frame-Options deny;
|
add_header X-Frame-Options deny;
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
# 改deepzz相关的
|
# 改deepzz相关的
|
||||||
add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; img-src data: https: https://st.deepzz.com; style-src 'unsafe-inline' https:; child-src https:; connect-src 'self' https://translate.googleapis.com; frame-src https://disqus.com https://www.slideshare.net";
|
add_header Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' blob: https:; img-src data: https: https://st.deepzz.com; media-src https://st.deepzz.com; style-src 'unsafe-inline' https:; child-src https:; connect-src 'self' https://translate.googleapis.com; frame-src https://disqus.com https://www.slideshare.net";
|
||||||
# 中间证书证书指纹
|
# 中间证书证书指纹
|
||||||
# https://imququ.com/post/http-public-key-pinning.html
|
# https://imququ.com/post/http-public-key-pinning.html
|
||||||
add_header Public-Key-Pins 'pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000; includeSubDomains';
|
add_header Public-Key-Pins 'pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000; includeSubDomains';
|
||||||
@@ -137,21 +136,22 @@ server {
|
|||||||
}
|
}
|
||||||
|
|
||||||
server {
|
server {
|
||||||
server_name www.deepzz.com deepzz.com;
|
server_name www.deepzz.com deepzz.com;
|
||||||
server_tokens off;
|
server_tokens off;
|
||||||
|
|
||||||
access_log /dev/null;
|
access_log /dev/null;
|
||||||
|
|
||||||
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
|
if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$ ) {
|
||||||
return 444;
|
return 444;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# letsencrypt file verify
|
||||||
location ^~ /.well-known/acme-challenge/ {
|
location ^~ /.well-known/acme-challenge/ {
|
||||||
alias /data/letsencrypt/challenges/;
|
alias /data/letsencrypt/challenges/;
|
||||||
try_files $uri =404;
|
try_files $uri =404;
|
||||||
}
|
}
|
||||||
|
|
||||||
location / {
|
location / {
|
||||||
rewrite ^/(.*)$ https://deepzz.com/$1 permanent;
|
rewrite ^/(.*)$ https://deepzz.com/$1 permanent;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,2 @@
|
|||||||
|
# example black list
|
||||||
|
#deny 195.154.211.220;
|
||||||
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user