使用 NGINX 提供多個網站的 SSL 加密服務 – 2020 版

使用 NGINX 為 Odoo 提供 SSL 加密服務 中的設定在 2020 年已經有點過時了，因此追加更新修正後的內容在此篇

由於安全性的問題，所有瀏覽器在 2020 年三月移除支援 TLS v1.0、TLS v1.1 協定

在 ssl labs 的測試中，有支援 TLS v1.0、TLS v1.1 協定時只能拿到 B

因此需將此部份

        ssl_protocols TLSv1.0 TLSv1.1 TLSv1.2;

修正為

        ssl_protocols TLSv1.2;

而在多個網站同時架設在一台主機上時，因此 ssl_session_cache 會出現快取無法重複設定的問題

這時候可以通過修改 nginx.conf 讓全部網站共用此 ssl_session_cache

vim /etc/nginx/nginx.conf

將這段

    include /etc/nginx/conf.d/*.conf;

修改為

    include /etc/nginx/conf.d/*.conf;

    ## SSL Cache Setting
    ssl_session_cache   shared:SSL:50m;
    ssl_session_timeout 10m;

以下是以 Magento 2 作為範例寫出來的設定檔（仍需要修改）

/etc/nginx/nginx.conf

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    server_tokens       off;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    ## Magento 2 fastcgi_backend
    upstream fastcgi_backend {
        server  unix:/run/php-fpm/php-fpm.sock;
    }

    ## SSL Cache Setting
    ssl_session_cache   shared:SSL:50m;
    ssl_session_timeout 10m;
}

/etc/nginx/conf.d/m2.cewolf.com.tw.conf

    server {
        listen 80;
        server_name m2.cewolf.com.tw;
        #set $MAGE_ROOT /usr/share/nginx/magento_hanyu;
        #include /usr/share/nginx/magento_hanyu/nginx.conf.sample;
        return 301 https://m2.cewolf.com.tw$request_uri;

        #location ^~ /.well-known/acme-challenge/ {
        #default_type    "text/plain";
        #root /etc/letsencrypt/;
        #}
    }

    server {
        listen [::]:443 ssl http2;
        listen 443 ssl http2;

        server_name m2.cewolf.com.tw;
        set $MAGE_ROOT /usr/share/nginx/magento_hanyu;
        include /usr/share/nginx/magento_hanyu/nginx.conf.sample;

        ssl_certificate /etc/letsencrypt/live/m2.cewolf.com.tw/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/m2.cewolf.com.tw/privkey.pem;
        ssl_protocols TLSv1.2;
        ssl_dhparam /etc/dehydrated/dhparam.pem;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_prefer_server_ciphers on;

        # Enable OSCP Stapling for Nginx web server
        # If you're using the SSL from Letsencrypt,
        # use the 'chain.pem' certificate
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8 8.8.4.4;
        ssl_trusted_certificate /etc/letsencrypt/live/m2.cewolf.com.tw/chain.pem;

        # Enable HTTP Strict-Transport-Security
        # If you have a subdomain of your site,
        # be carefull to use the 'includeSubdomains' options
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    }