LNMP升级开启TLSv1.3支持

Myth丶恋晨 2022-01-21 05:37 282阅读 0赞

## **LNMP升级开启TLSv1.3支持** ##

> TLSv1.3版本的优势：[https://baijiahao.baidu.com/s?id=1611365293186683991&wfr=spider&for=pc][https_baijiahao.baidu.com_s_id_1611365293186683991_wfr_spider_for_pc]

访问域名，点击F12查看安全性，可查看当前协议版本  
![在这里插入图片描述][20190608115025114.png]  
**当前 openssl 以及 nginx 版本信息：**  
![在这里插入图片描述][20190608121123398.png]

## 升级TLSv1.3 步骤 ##

\*\*  
**一、下载 openssl 1.1.1 版本**

cd /usr/local/src/lnmp1.5/src
    wget -c https://github.com/openssl/openssl/archive/OpenSSL_1_1_1-stable.zip
    unzip OpenSSL_1_1_1-stable.zip
    mv openssl-OpenSSL_1_1_1-stable/ openssl-1-1-1-stable/

**二、修改 include/version.sh**

vim /usr/local/src/lnmp1.5/include/version.sh

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hpYW5oZW55dWFu_size_16_color_FFFFFF_t_70]

**三、修改 /include/upgrade\_nginx.sh**

vim /usr/local/src/lnmp1.5/include/upgrade_nginx.sh

--with-openssl-opt="enable-tls1_3 enable-weak-ssl-ciphers"

![在这里插入图片描述][20190608125417894.png]

**四、执行升级nginx，./upgrade.sh nginx 输入想要升级的版本。如目前稳定的版本 1.16.0**

执行过程中，遇到如下错误

make -f objs/Makefile
    make[1]: Entering directory `/usr/local/src/lnmp1.5/src/nginx-1.16.0'
    cd /usr/local/src/lnmp1.5/src/openssl-1-1-1-stable \
    && if [ -f Makefile ]; then make clean; fi \
    && ./config --prefix=/usr/local/src/lnmp1.5/src/openssl-1-1-1-stable/.openssl no-shared no-threads enable-tls1_3 enable-weak-ssl-ciphers \
    && make \
    && make install_sw LIBDIR=lib
    /bin/sh: line 0: cd: /usr/local/src/lnmp1.5/src/openssl-1-1-1-stable: No such file or directory
    make[1]: *** [/usr/local/src/lnmp1.5/src/openssl-1-1-1-stable/.openssl/include/openssl/ssl.h] Error 1
    make[1]: Leaving directory `/usr/local/src/lnmp1.5/src/nginx-1.16.0'
    make: *** [build] Error 2
    make -f objs/Makefile
    make[1]: Entering directory `/usr/local/src/lnmp1.5/src/nginx-1.16.0'
    cd /usr/local/src/lnmp1.5/src/openssl-1-1-1-stable \
    && if [ -f Makefile ]; then make clean; fi \
    && ./config --prefix=/usr/local/src/lnmp1.5/src/openssl-1-1-1-stable/.openssl no-shared no-threads enable-tls1_3 enable-weak-ssl-ciphers \
    && make \
    && make install_sw LIBDIR=lib
    /bin/sh: line 0: cd: /usr/local/src/lnmp1.5/src/openssl-1-1-1-stable: No such file or directory
    make[1]: *** [/usr/local/src/lnmp1.5/src/openssl-1-1-1-stable/.openssl/include/openssl/ssl.h] Error 1
    make[1]: Leaving directory `/usr/local/src/lnmp1.5/src/nginx-1.16.0'
    make: *** [build] Error 2
    cp: cannot stat ‘objs/nginx’: No such file or directory
    Test nginx configure file...
    include/upgrade_nginx.sh: line 70: /usr/local/nginx/sbin/nginx: No such file or directory
    upgrade...
    /usr/local/nginx/sbin/nginx -t
    make: /usr/local/nginx/sbin/nginx: Command not found
    make: *** [upgrade] Error 127
    Checking ...
    Error: Nginx upgrade failed.

解决方案如下：

cd  /usr/local/src/lnmp1.5/src/
    unzip OpenSSL_1_1_1-stable.zip
    mv openssl-OpenSSL_1_1_1-stable/ openssl-1-1-1-stable
    tar -zcvf openssl-1-1-1-stable.tar.gz openssl-1-1-1-stable/

> 我认为是脚本要解压上面指定的openssl-1-1-1-stable 的 tar 包，发现不存在所以报错了。

然后重新执行升级nginx，执行命令 ./upgrade.sh nginx 输入想要升级的版本。如目前稳定的版本 1.16.0  
执行完毕显示如下：  
![在这里插入图片描述][20190608132300670.png]  
**五、修改域名配置文件**  
修改如下两行配置

#ssl on;
    ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5;

**六、重启 nginx**

nginx -t
    nginx -s reload

**验证，重新访问：**  
![在这里插入图片描述][20190608133016658.png]

**参考文档：**  
nginx配置文件示例：[domain.conf][]  
纯自嗨，LNMP下启用TLSv1.3支持过程全记录：[查看文章][Link 1]  
如何让Nginx快速支持TLS1.3协议详解：[查看文章][Link 2]  
本博客开始支持 TLS 1.3：[查看文章][Link 3]

[https_baijiahao.baidu.com_s_id_1611365293186683991_wfr_spider_for_pc]: https://baijiahao.baidu.com/s?id=1611365293186683991&wfr=spider&for=pc
[20190608115025114.png]: /images/20220121/8178f5c07cd14142adc9008be8c1c3c6.png
[20190608121123398.png]: /images/20220121/2639e67999924fcc8336e8e39c6c0c19.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hpYW5oZW55dWFu_size_16_color_FFFFFF_t_70]: /images/20220121/b9408dc4250c47b8944fe047d654dcb3.png
[20190608125417894.png]: /images/20220121/d3af43892e7346ea91dcb00c0aad06eb.png
[20190608132300670.png]: /images/20220121/f69e16eb997048bcb19d1d80d1569a71.png
[20190608133016658.png]: /images/20220121/007da16a71bd467a85c4ad7cda2c4e4d.png
[domain.conf]: https://blog.csdn.net/xianhenyuan/article/details/91312358https://blog.csdn.net/xianhenyuan/article/details/91312358
[Link 1]: https://www.imydl.tech/lnmp/245.html
[Link 2]: https://www.jb51.net/article/138665.htm
[Link 3]: https://imququ.com/post/enable-tls-1-3.html