使用 NGINX 為 Odoo 提供 SSL 加密服務 中的設定在 2020 年已經有點過時了,因此追加更新修正後的內容在此篇
由於安全性的問題,所有瀏覽器在 2020 年三月移除支援 TLS v1.0、TLS v1.1 協定
在 ssl labs 的測試中,有支援 TLS v1.0、TLS v1.1 協定時只能拿到 B
因此需將此部份
ssl_protocols TLSv1.0 TLSv1.1 TLSv1.2;
修正為
ssl_protocols TLSv1.2;
而在多個網站同時架設在一台主機上時,因此 ssl_session_cache 會出現快取無法重複設定的問題
這時候可以通過修改 nginx.conf 讓全部網站共用此 ssl_session_cache
vim /etc/nginx/nginx.conf
將這段
include /etc/nginx/conf.d/*.conf;
修改為
include /etc/nginx/conf.d/*.conf;
## SSL Cache Setting
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 10m;
以下是以 Magento 2 作為範例寫出來的設定檔(仍需要修改)
/etc/nginx/nginx.conf
# For more information on configuration, see: # * Official English Documentation: http://nginx.org/en/docs/ # * Official Russian Documentation: http://nginx.org/ru/docs/ user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; # Load dynamic modules. See /usr/share/nginx/README.dynamic. include /usr/share/nginx/modules/*.conf; events { worker_connections 1024; } http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; server_tokens off; include /etc/nginx/mime.types; default_type application/octet-stream; # Load modular configuration files from the /etc/nginx/conf.d directory. # See http://nginx.org/en/docs/ngx_core_module.html#include # for more information. include /etc/nginx/conf.d/*.conf; ## Magento 2 fastcgi_backend upstream fastcgi_backend { server unix:/run/php-fpm/php-fpm.sock; } ## SSL Cache Setting ssl_session_cache shared:SSL:50m; ssl_session_timeout 10m; }
/etc/nginx/conf.d/m2.cewolf.com.tw.conf
server {
listen 80;
server_name m2.cewolf.com.tw;
#set $MAGE_ROOT /usr/share/nginx/magento_hanyu;
#include /usr/share/nginx/magento_hanyu/nginx.conf.sample;
return 301 https://m2.cewolf.com.tw$request_uri;
#location ^~ /.well-known/acme-challenge/ {
#default_type "text/plain";
#root /etc/letsencrypt/;
#}
}
server {
listen [::]:443 ssl http2;
listen 443 ssl http2;
server_name m2.cewolf.com.tw;
set $MAGE_ROOT /usr/share/nginx/magento_hanyu;
include /usr/share/nginx/magento_hanyu/nginx.conf.sample;
ssl_certificate /etc/letsencrypt/live/m2.cewolf.com.tw/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/m2.cewolf.com.tw/privkey.pem;
ssl_protocols TLSv1.2;
ssl_dhparam /etc/dehydrated/dhparam.pem;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
# Enable OSCP Stapling for Nginx web server
# If you're using the SSL from Letsencrypt,
# use the 'chain.pem' certificate
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4;
ssl_trusted_certificate /etc/letsencrypt/live/m2.cewolf.com.tw/chain.pem;
# Enable HTTP Strict-Transport-Security
# If you have a subdomain of your site,
# be carefull to use the 'includeSubdomains' options
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
}