nginx 修复TLS1.0，TLS1.1协议漏洞

怼烎@ 2022-10-29 05:23 386阅读 0赞

### 首先通过检测命令： ###

nmap --script ssl-enum-ciphers -p 443 ip地址

开启的情况：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 1]

### 修复 ###

# 原始配置 
    # ssl_protocols TLSv1 TLSv1.1 TLSv1.2 ; 
    # 修复配置 
    ssl_protocols TLSv1.2 ;

### 完整配置 ###

# HTTPS server
    server {
        listen       443 ssl;
        server_name  192.168.1.100;
        keepalive_timeout  70;
    
        ssl_certificate      cert/mycert.pem;
        ssl_certificate_key  cert/privatekey.pem;
        
        #ssl_certificate      cert/server.crt;
        #ssl_certificate_key  cert/server_rsa_private.pem.unsecure;
    
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
    
    	#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 ;
    	ssl_protocols TLSv1.2 ;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
    
        location / {
            root   html;
            index  index.html index.htm;
        }
        
    	# 映射服务器集群
    	location /test/{
    		proxy_set_header  X-Real-IP        $remote_addr;
    		proxy_pass http://test;
    	}
        location /status{
            stub_status on;
        }
    }

关闭的情况：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 2]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70]: /images/20221024/03dbddb1ed6c4b24984316e5c4d411a2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 1]: /images/20221024/337f361817e241849a9bc72bbd740f34.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 2]: /images/20221024/448cb5aee04e429093631cfc7f382b5c.png