用SSL/TL固定NGINX

获取有效SSL证书（推荐Let’s Encrypt并用certbot自动配置）；2. 配置Nginx启用TLSv1.2/1.3、强加密套件及安全头（如HSTS）；3. 将HTTP流量重定向至HTTPS；4. 测试配置并确保证书自动续期，最终实现安全可信的HTTPS站点。

Securing Nginx with SSL/TLS isn’t just about checking a box—it’s about protecting your users, building trust, and improving SEO. If you're running an Nginx web server, setting up HTTPS properly is essential. Here's how to do it right without overcomplicating things.

✅ 1. Get a Valid SSL Certificate

You’ve got options:

• Let’s Encrypt (Free & Recommended): Use certbot to automate certificate issuance and renewal.
• Commercial CA (e.g., DigiCert, Sectigo): For enterprise needs or extended validation (EV).

For Let’s Encrypt:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

This automatically configures Nginx and renews certs (via cron/systemd timer). Easy win.

? 2. Configure Nginx for Strong TLS

Edit your Nginx site config (usually in /etc/nginx/sites-available/your-site):

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # Strong protocols & ciphers
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
}

Why this matters:

• http2 boosts performance over HTTPS.
• Disabling old TLS versions (like 1.0/1.1) blocks known vulnerabilities.
• HSTS (max-age=63072000) tells browsers to always use HTTPS—even if someone types http://.

? 3. Redirect HTTP → HTTPS Automatically

Add this block to redirect all insecure traffic:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

This ensures users never land on an unencrypted page—even if they forget to type "https://".

?️ 4. Test & Monitor

• Run nginx -t before reloading config (systemctl reload nginx).
• Test your setup at:
  ? SSL Labs SSL Test
  Aim for an A or A rating.
• Enable auto-renewal for Let’s Encrypt:

  sudo certbot renew --dry-run

  If that passes, you’re golden—certs auto-renew every 60 days.

  ---

  Bottom line: With just a few well-placed config lines and a free cert from Let’s Encrypt, you can have a secure, fast, modern HTTPS site. No excuses—just do it.
  (And don’t forget to test!)

  以上是用SSL/TL固定NGINX的详细内容。更多信息请关注PHP中文网其他相关文章！