在NGINX 安裝與設定 TLS 1.3 以及所面對的無法運行 TLS 1.3 的問題解決辦法

這是因為我在每個virtualhost 都有設定SSL 相關設定 (根據每個virtualhost有不同的設定)...

因此這很重要, 所有的virtual hosts (包含 /etc/nginx/conf.d) 裡, 都必須設定 ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

只要有一個virtualhost 不是 TLS v1.3, 所有的virtualhost 都會受影響, 降級成只有運行 TLS v1.2 (假如你之前是設定 TLS v1.2)

我不曉得這是不是NGINX的問題, 但, 顯然的, 我將所有的virtualhost 增加 TLS v1.3 之後, 所有的問題都解決了.  為此, 我花費了好幾天的時間不斷編譯安裝與測試, 特此記錄下來.

測試是否有跑 TLS v1.3, 可以使用以下的指令:

openssl s_client -tls1_3 test.localhost:443

成功運行 TLS v1.3 的話, 就會顯示類似以下的資訊:

想要使用 TLS 1.3, 必須安裝 OpenSSL v1.1.1 開始的版本, 以及最低 NGINX v1.13

安裝步驟如下:

yum group install "Development Tools" -y
yum install gcc gcc-c++ gcc++ cmake pcre-devel -y

mkdir -p /usr/local/src/nginx/modules/
cd /usr/local/src/nginx/modules/
rm -rf *
git clone https://github.com/openresty/headers-more-nginx-module.git
git clone https://github.com/google/ngx_brotli.git

#可以選擇不安裝
git clone https://github.com/simplresty/ngx_devel_kit.git
git clone https://github.com/openresty/lua-nginx-module.git



cd /usr/local/src
wget https://www.openssl.org/source/openssl-1.1.1c.tar.gz
tar -zxf openssl-1.1.1c.tar.gz
cd openssl-1.1.1c
./config
make
make install
mv /usr/bin/openssl /usr/bin/openssl.original
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1




cd /usr/local/src
wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.43.tar.gz
tar -zxf pcre-8.43.tar.gz
cd pcre-8.43
#./configure
./configure --prefix=/usr --libdir=/usr/lib64 --enable-unicode-properties --enable-pcre16 --enable-pcre32 --enable-pcregrep-libz --disable-static --enable-utf8 --enable-shared
make
make install




cd /usr/local/src
wget http://zlib.net/zlib-1.2.11.tar.gz
tar -zxf zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure
make
make install




yum install geoip-devel -y
#yum install -y automake curl-devel httpd-devel libxml2 libxml2-devel
#yum install luajit luajit-devel -y




#可以選擇不安裝 LUA
cd /usr/local/src
git clone http://luajit.org/git/luajit-2.0.git
cd luajit-2.0
make
make install




openssl dhparam -out /etc/ssl/dhparam.pem 2048




cd /usr/local/src
wget http://nginx.org/download/nginx-1.17.0.tar.gz
tar xvfz nginx-1.17.0.tar.gz
cd nginx-1.17.0
ln -s /usr/lib64/nginx/modules /etc/nginx/


groupadd -r nginx
useradd -r -g nginx -s /sbin/nologin -M nginx

cd /usr/local/src/nginx/modules/ngx_brotli && git submodule update --init && cd /usr/local/src/nginx-1.17.0


# 如果不安裝 LUA, 就跳過以下的export
export LUAJIT_LIB=/usr/local/lib
export LUAJIT_INC=/usr/local/include/luajit-2.0


./configure \
--prefix=/etc/nginx \
--sbin-path=/usr/sbin/nginx \
--modules-path=/usr/lib64/nginx/modules \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/run/nginx.lock \
--http-client-body-temp-path=/var/cache/nginx/client_temp \
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
--user=nginx \
--group=nginx \
--with-pcre=/usr/local/src/pcre-8.43 \
--with-zlib=/usr/local/src/zlib-1.2.11 \
--with-openssl=/usr/local/src/openssl-1.1.1c \
--with-openssl-opt='enable-tls1_3 enable-weak-ssl-ciphers' \  #針對openssl 1.0.x 版本使用.  少了這個可不行.  openssl v1.1.1 開始預設支援TLS v1.3.  另外, enable-weak-ssl-ciphers 允許舊版的瀏覽器可以瀏覽
--with-compat \
--with-file-aio \
--with-threads \
--with-http_addition_module \
--with-http_auth_request_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_mp4_module \
--with-http_random_index_module \
--with-http_realip_module \
--with-http_secure_link_module \
--with-http_slice_module \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-http_sub_module \
--with-http_v2_module \
--with-http_geoip_module \
--with-mail \
--with-mail_ssl_module \
--with-stream \
--with-stream_realip_module \
--with-stream_ssl_module \
--with-stream_ssl_preread_module \
--with-ld-opt="-Wl,-rpath,/usr/local/lib" \  # 如果不安裝 LUA, 就刪掉這行
--add-module=/usr/local/src/nginx/modules/ngx_brotli \
--add-module=/usr/local/src/nginx/modules/ngx_devel_kit \  # 如果不安裝 LUA, 就刪掉這行
--add-module=/usr/local/src/nginx/modules/lua-nginx-module \  # 如果不安裝 LUA, 就刪掉這行
--add-dynamic-module=/usr/local/src/nginx/modules/headers-more-nginx-module


make

# or you can change the parallism number 2 below to fit the number of spare CPU cores in your machine.

make -j2


make install

最後, 只需要在 virtualhost 裡, 修改成以下, 就可以了:

ssl_protocols   TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

ssl_ciphers      TLS13-AES-256-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA256:DHE-RSA-AES256-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-GCM-SHA256:AES256-SHA256:AES256-SHA256:AES256-SHA:AES256-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4;


假如每個 virtualhost 都是相同的SSL 的設定的話, 只要在 /etc/nginx/nginx.conf 設定就行了, 就不需要在每個virtualhost 做相同的設定, 如此以來就不會有以上提到的無法運行TLS 1.3 的問題了.  將一下這段放在 /etc/nginx/nginx.conf 裡, "include /etc/nginx/conf.d/*.conf;" 上面就行了


    ssl_protocols                           TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers     on;
    ssl_ciphers                              TLS13-AES-256-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA256:DHE-RSA-AES256-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-GCM-SHA256:AES256-SHA256:AES256-SHA256:AES256-SHA:AES256-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4;
    ssl_dhparam                           /etc/ssl/dhparam.pem;
    ssl_ecdh_curve                       secp384r1;
    ssl_session_cache                   shared:TLS:10m;
    ssl_session_tickets                  off;
    ssl_stapling                             off;
    ssl_stapling_verify                 on;
    resolver                                   8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] valid=300s;
    resolver_timeout                    5s;
    # Disable preloading HSTS for now.  You can use the commented out header line that includes
    # the "preload" directive if you understand the implications.
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";  # 2年
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    #add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;