tls1.3 自定义加密顺序

› NGINX

› NGINX Trac

› 3rd Party Modules

› Security Advisories

› CHANGES

› OpenResty

› ngx_lua

› Tengine

在线学习资源

› NGINX 开发从入门到精通

NGINX Modules

› ngx_echo

This topic created in 1486 days ago, the information mentioned may be changed or developed.

nginx 1.20 版本配置

# 加密协议与套件
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers on;

用浏览器和 myssl.com 检测是 256 优先

TLS 1.3 (服务器顺序优先) TLS_AES_256_GCM_SHA384 (0x1302) 256 bits FS TLS_CHACHA20_POLY1305_SHA256 (0x1303) 256 bits FS TLS_AES_128_GCM_SHA256 (0x1301) 128 bits FS

怎么设置成 AES_128_GCM 优先呢？

6 replies • 2022-07-17 11:54:18 +08:00

codefever

Apr 19, 2022

楼主参考一下：

ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
#ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
error_page 497 http...s://$host$request_uri;