Nginx的SSL/TLS协议优化与安全实践

1. 基础SSL/TLS配置

首先确保Nginx已正确配置SSL/TLS基础设置：

server {
    listen 443 ssl;
    server_name example.com;

    # 证书和私钥路径
    ssl_certificate /path/to/certificate.pem;
    ssl_certificate_key /path/to/private.key;

    # 启用会话恢复以减少握手开销
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # 启用OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
}

2. 协议与加密套件优化

禁用不安全协议和弱加密套件

ssl_protocols TLSv1.2 TLSv1.3;  # 禁用SSLv3, TLSv1.0和TLSv1.1
ssl_prefer_server_ciphers on;

# TLSv1.2加密套件
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

# 如果支持TLSv1.3
ssl_ciphers 'TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

3. 性能优化

启用HTTP/2

listen 443 ssl http2;

启用TLS会话票据

ssl_session_tickets on;

DH参数优化

# 生成强DH参数: openssl dhparam -out /etc/nginx/dhparam.pem 4096
ssl_dhparam /etc/nginx/dhparam.pem;

4. 安全增强

HSTS (HTTP Strict Transport Security)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

安全头部

add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none';";

证书透明度

add_header Expect-CT 'enforce, max-age=30, report-uri="https://example.com/report"';

5. 高级配置

0-RTT (TLS 1.3 Early Data)

谨慎使用，可能带来重放攻击风险：

ssl_early_data on;

证书链优化

确保证书链完整：

ssl_certificate /path/to/fullchain.pem;  # 包含中间证书

6. 测试与验证

配置完成后，使用以下工具测试：

1. Qualys SSL Labs: https://www.ssllabs.com/ssltest/
2. Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
3. OpenSSL命令测试: bash openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -tls1_3

7. 定期维护

1. 设置证书自动续期（如使用Certbot）
2. 定期更新Nginx版本以获取最新安全补丁
3. 监控SSL/TLS协议和加密套件的安全动态，及时调整配置

通过以上优化和安全实践，可以显著提升Nginx服务器的SSL/TLS安全性、性能和兼容性。