![为什么 GCM HTTPS 不能与 nginx 一起使用?](https://linux22.com/image/39177/%E4%B8%BA%E4%BB%80%E4%B9%88%20GCM%20HTTPS%20%E4%B8%8D%E8%83%BD%E4%B8%8E%20nginx%20%E4%B8%80%E8%B5%B7%E4%BD%BF%E7%94%A8%EF%BC%9F.png)
由于这两个使用的是 GCM (伽罗瓦/计数器模式):
www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384
www.google.com: ECDHE-RSA-AES128-GCM-SHA256
我们想让我们的网络服务器的 HTTPS 连接更加安全(不要看自签名证书,它现在不算数......)。
我们使用的是 OpenBSD 5.4 64 位操作系统,openssl ciphers
命令显示它支持该ECDHE-RSA-AES256-GCM-SHA384
密码。客户端至少有 Firefox 30。
下面是我们设置 HTTPS 服务器的方法:
# generate self signed certificate
openssl genrsa -aes256 -out /etc/ssl/private/server.key 4096
openssl req -new -key /etc/ssl/private/server.key -out /etc/ssl/private/server.csr
openssl x509 -sha512 -req -days 365 -in /etc/ssl/private/server.csr -signkey /etc/ssl/private/server.key -out /etc/ssl/server.crt
配置:
vi /etc/nginx/nginx.conf
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
但 Firefox 说(我用我的语言翻译了它..):
与 www.foo.hu 的连接中断
和ssll实验室说:
评估失败:无法与安全服务器通信
- 我们如何在nginx中设置GCM?
- 为什么新的 Firefox 无法通过 HTTPS 连接到
www.foo.hu
(ECDHE-RSA-AES256-GCM-SHA384
、TLSv1.2)?
www.ssllabs.com
它可以通过 HTTPS( TLSv1.2)连接ECDHE-RSA-AES256-GCM-SHA384
,所以也许这不是客户端问题?
[user@localhost ~] openssl s_client -connect www.foo.hu:443
CONNECTED(00000003)
depth=0 C = HU, CN = www.foo.hu
verify error:num=18:self signed certificate
verify return:1
depth=0 C = HU, CN = www.foo.hu
verify return:1
---
Certificate chain
0 s:/C=HU/CN=www.foo.hu
i:/C=HU/CN=www.foo.hu
---
Server certificate
-----BEGIN CERTIFICATE-----
.... here goes the cert..
-----END CERTIFICATE-----
subject=/C=HU/CN=www.foo.hu
issuer=/C=HU/CN=www.foo.hu
---
No client certificate CA names sent
---
SSL handshake has read 2137 bytes and written 389 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: ...bla-bla
Session-ID-ctx:
Master-Key: ...bla-bla
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
...bla-bla
Start Time: 1404296744
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
read:errno=0
[user@localhost ~]
答案1
更改密码套件是最终的解决方案。
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256;
问题是 Firefox 30 还不支持上述密码。