![Nginx 覆盖 ssl_protocols 指令](https://linux22.com/image/695829/Nginx%20%E8%A6%86%E7%9B%96%20ssl_protocols%20%E6%8C%87%E4%BB%A4.png)
我有一个全局 SSL 选项文件,它包含在每个服务器块中。
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_stapling on; # Requires nginx >= 1.3.7
ssl_stapling_verify on; # Requires nginx => 1.3.7
ssl_dhparam /etc/letsencrypt/dhparam4096.pem;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
gzip off;
因此,每个服务器都运行在 TLSv1.2 上,但有一台服务器我也想运行 TLSv1 和 TLSv1.1。
但是当我使用以下任一方式执行配置时:
ssl_protocols TLSv1 TLSv1.1;
include "above mentioned config file";
和
include "above mentioned config file";
ssl_protocols TLSv1 TLSv1.1;
但是运行命令时:
nmap --script ssl-enum-ciphers -p 443
然后它只显示 TLSv1.2,而不显示 TLSv1 或 TLSv1.1。有没有办法覆盖 ssl_protocols 指令?如果可以,我可以将包含移到 http 块中吗?