HoRain云--HTTPS实战指南：原理详解与Nginx配置全解析

sequenceDiagram
    Client->>Server: ClientHello（支持算法列表+随机数）
    Server->>Client: ServerHello（选定算法+随机数）+证书
    Client->>Server: 验证证书，生成PreMasterSecret
    Server->>Client: 完成握手，启用加密通信

# 查看服务器支持的密码套件
openssl s_client -connect example.com:443 -tlsextdebug 2>&1 | grep "Cipher Suite"

# 安装certbot工具
sudo apt install certbot python3-certbot-nginx

# 申请证书（需提前配置好域名解析）
sudo certbot --nginx -d example.com -d www.example.com

server {
    listen 443 ssl;
    server_name example.com;
    
    # 证书路径
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # 协议优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    
    # 强制HTTPS跳转
    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }
    
    # 其他业务配置
    location / {
        root /var/www/html;
    }
}

# 检查配置语法
sudo nginx -t

# 重启服务
sudo systemctl reload nginx

# 在线检测安全性（A级为最优）
https://www.ssllabs.com/ssltest/analyze.html?d=example.com

# 测试续期命令
sudo certbot renew --dry-run

# 添加定时任务（每月1号凌晨3点更新）
0 3 1 * * /usr/bin/certbot renew --quiet

# PEM转PFX（用于Windows服务器）
openssl pkcs12 -export -out certificate.pfx -inkey privkey.pem -in cert.pem

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

# 查看SSL握手错误日志
grep "SSL_do_handshake" /var/log/nginx/error.log

# 抓包分析握手过程
tcpdump -nn -i eth0 port 443 -w https.pcap