ssl - nginx conf ssl sslabs B 评级

Question

我检查了很多手册，并为 nginx ssl setup ( How do you score A+ with 100 on all categories on SSL Labs test with Let's Encrypt and Nginx? ) 执行了推荐设置， 但 ssllab 的评级仍然是 B: https://www.ssllabs.com/ssltest/analyze.html?d=remo24.ru

Nginx:1.12.1 打开SSL:1.0.1t 我的 nginx 配置文件:

nginx.conf

http {
    include       /etc/nginx/mime.types;

## Start add by hoster support
    proxy_read_timeout 500;
    proxy_connect_timeout 500;
    client_max_body_size 100M;
    server_names_hash_bucket_size 64;
## End add by hoster support

#My ssl config
    ssl_session_tickets off;
 ...

ssl.conf

ssl_protocols TLSv1.2 TLSv1.1 TLSv1
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS; # Score=90 (recommended)

ssl_prefer_server_ciphers on;

启用站点/{主机名}.conf

服务器{ 听 {server_ip}:443 ssl;

server_name {hostname};

ssl on;

ssl_stapling on;
ssl_stapling_verify on;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_ecdh_curve secp384r1;

resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 10s;

add_header Strict-Transport-Security max-age=31536000;      

ssl_certificate     /etc/nginx/ssl/{hostname}/chain.crt;
ssl_certificate_key /etc/nginx/ssl/{hostname}/cert.key;
ssl_dhparam /etc/nginx/ssl/{hostname}/dhparam.pem;

怎么了？我应该检查什么？

Answer 1

我不敢相信，答案很简单:我忘记在我的域的/sites-enabled 配置中手动包含 nginx ssl 配置!

   server{
     ssl on;
     ...
        #Include global SSL settings
        include /etc/nginx/ssl.conf;
     ...