HTTPS协议和套件优化
1、如何检测HTTPS配置
可以通过在线工具https://wosign.ssllabs.com进行检测
2、HTTPS配置建议
协议方面:开启TLSv1.2协议,禁用SSLv2、SSLv3协议,需要时可以禁用TLSv1.0协议
套件方面:开启ECDH和AEAD系列套件,禁用DH、RC4、MD5、DES系列套件
3、不同web服务器协议和套件配置示例
Nginx: openssl 1.0.1+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH:AESGCM:HIGH:!RC4:!MD5:!DH:!DES:!aNULL:!eNULL;
Apache: openssl 1.0.1+
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDH:AESGCM:HIGH:!RC4:!MD5:!DH:!DES:!aNULL:!eNULL
Tomcat: JDK 1.7+
ciphers=”TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA”
IIS: Windows 2008 R2 +
windows 2008 R2: http://www.wosign.com/download/IISCrypto.exe
windows 2012 +: https://www.nartac.com/Downloads/IISCrypto/IISCrypto.exe
下载对应版本工具,在目标服务器上运行,点击Best Practices, 再点击Apply,确定,抽时间重启操作系统即可生效。
![](https://bbs.wosign.com/wp-content/uploads/2023/10/IIS.png)