ssl - 我已按照所有说明进行操作，但无法在 NGINX 上显示 TLS 1.3

Question

我正在尝试在我的服务器上启用 TLS 1.3。我在 Google 上关注了大量文章，并在我自己的配置中使用了相同的配置设置，但我无法通过 TLS 1.2。

我在 Ubuntu 16 上。

我正在使用 NGINX 1.14 版，它是用 OpenSSL 1.1.1 构建的。

➜ nginx -V
nginx version: nginx/1.14.2
built with OpenSSL 1.1.1  11 Sep 2018 (running with OpenSSL 1.1.1a  20 Nov 2018)
TLS SNI support enabled

这些是我见过的支持 TLS 1.3 所需的所有软件版本。

我在测试证书时使用的是 Chrome 72 和 SSL Labs，但它总是说它在 1.2 上。

这是我的 NGINX 配置文件中与 SSL 选项相关的部分

ssl_protocols TLSv1.3 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_ecdh_curve X25519:secp256k1:secp384r1:prime256v1;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES25
ssl_session_timeout  10m;
ssl_session_cache shared:SSL:10m;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 216.146.35.35 216.146.36.36 valid=60s;
resolver_timeout 2s;

我从 https://cipherli.st 得到了密码.

使用这些配置选项，我无法通过 TLS 1.2 协议(protocol)。

我相信这就是我能想到的所有可能导致我出现问题的情况，但我可以告诉您任何您可能需要了解的更多信息以帮助我解决问题。

谢谢，

克里斯

Answer 1

在 Nginx 上启用 TLSv1.3 可能看起来非常简单，但没有记录在案。 现在切入正题。诀窍是在配置的每个服务器 block 中包含 SSL 设置。不这样做，将导致禁用 TLSv1.3。这是有意义的，因为 tls 协议(protocol)不会在第一次请求到达服务器时“升级”:

sudo vi ssl_config

add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy no-referrer;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
ssl_session_tickets on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_ecdh_curve auto;
keepalive_timeout   70;
ssl_buffer_size 1400;
ssl_dhparam ssl/dhparam.pem;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=86400;
resolver_timeout 10;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

和:

server {
    server_name xxx.xxx.xxx.xxx; #Your current server ip address. It will redirect to the domain name.
    listen 80;
    listen 443 ssl http2;
    include ssl_config;
    return 301 https://example.com$request_uri;
}
server {
    server_name www.example.com;
    listen 80;
    listen 443 ssl http2;
    listen [::]:80;
    listen [::]:443 ssl http2;
    include ssl_config;
    # Non-www redirect
    return 301 https://example.com$request_uri;
}
server {
    server_name example.com;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    root /var/www/html;
    charset UTF-8;
    include ssl_config;
location ~* \.(jpg|jpe?g|gif|png|ico|cur|gz|svgz|mp4|ogg|ogv|webm|htc|css|js|otf|eot|svg|ttf|woff|woff2)(\?ver=[0-9.]+)?$ {
    expires max;
    add_header Access-Control-Allow-Origin '*';
    add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    access_log off;
    }
    #access_log  logs/host.access.log  main;
    location ~ /.well-known/acme-challenge {
      allow all;
      root /var/www/html;
      default_type "text/plain";
    }
location / {
    index index.php;
    try_files $uri $uri/ /index.php?$args;
    #limit_conn num_conn 15;
    #limit_req zone=num_reqs;
    }
error_page  404    /404.php;
#pass the PHP scripts to FastCGI server listening on php-fpm unix socket
location ~ \.php$ {
    try_files       $uri =404;
    fastcgi_index   index.php;
    fastcgi_pass    php:9000; #for docker.
    #fastcgi_pass   unix:/var/run/php7-fpm.sock; #for non-docker.
    fastcgi_pass_request_headers on;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param   SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    fastcgi_intercept_errors on;
    fastcgi_ignore_client_abort off;
    fastcgi_connect_timeout 60;
    fastcgi_send_timeout 180;
    fastcgi_read_timeout 180;
    fastcgi_request_buffering on;
    fastcgi_buffer_size 128k;
    fastcgi_buffers 4 256k;
    fastcgi_busy_buffers_size 256k;
    fastcgi_temp_file_write_size 256k;
    include fastcgi_params;
}
location = /robots.txt {
    access_log off;
    log_not_found off;
    }
location ~ /\. {
    deny  all;
    access_log off;
    log_not_found off;
    }
}

现在它将使用可用的最强密码 100% 工作。 我不久前写了一篇关于 how to enable TLS 1.3 in Nginx 的博文. 作为额外的奖励，从 1.18.0、1.17.10 及更高版本开始，i maintain fresh tls1.3 enabled docker images