阿东的笔记_  工具
## acme.sh免费给web站增加SSL #### 安装 ``` Bash # 安装 acme.sh curl https://get.acme.sh | sh # 配置生成证书 acme.sh --issue --debug -d www.demo.com --webroot /web_dir_url # 放入ssl文件到相关目录 mkdir /www.demo.com/ # 安装证书 acme.sh --install-cert -d www.demo.com \ --key-file /www.demo.com/www.demo.com.key \ --fullchain-file /www.demo.com/fullchain.cer \ --reloadcmd "service nginx force-reload" # 生成 ssl_dhparam openssl dhparam -out /dhparam.pem 2048 ``` #### Nginx配置 ``` nginx server { ... listen 443 ssl; ssl_session_cache shared:le_nginx_SSL:1m; ssl_session_timeout 1440m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA"; ssl_certificate /www.demo.com/fullchain.cer; ssl_certificate_key /www.demo.com/www.demo.com.key; ssl_dhparam /www.demo.com/dhparam.pem; ... } ```
adddge@sohu.com  | 桂ICP备2022009838号-2