全站启用https达到ssllabs的A+标准

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

server {
    listen 80;
    server_name blog.rool.me;
    return 301 https://$server_name$request_uri;
}
server {
    listen       443 ssl http2;
    server_name  blog.rool.me;

    ssl                     on;
    ssl_prefer_server_ciphers on;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_certificate     /usr/local/etc/letsencrypt/live/blog.rool.me/fullchain.pem;
    ssl_certificate_key  /usr/local/etc/letsencrypt/live/blog.rool.me/privkey.pem;
    # openssl dhparam -out dh4096.pem 4096 生成dh4096.pem
    ssl_dhparam         /usr/local/etc/letsencrypt/dh4096.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_session_cache shared:TLS:2m;
    ssl_session_timeout     10m;
    add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
    location / {
        root /usr/local/www/blog.rool.me;
        index index.html index.htm;
    }
}