0%

2020-01-09 记一次解决nginx反向代理不兼容问题解决

2020-01-09 记一次解决nginx反向代理不兼容问题解决

经过简单的排查,确认了是ssl的配置问题,win7不支持tls1.2以上,因此需要做降级处理。

配置如下【完整配置参见nginxconfig.io即可】

1
2
3
4
5
6
7
   # Diffie-Hellman parameter for DHE ciphersuites 此处的秘钥为1024位
ssl_dhparam /etc/nginx/dhparam.pem;

# Mozilla Intermediate configuration
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;#注意这里需要写上TLSv1 TLSv1.1来兼容win7
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;#此处的加密算法要写全,也是出于兼容性问题
ssl_prefer_server_ciphers on;#同样的多了一项,兼容性问题

重启nginx服务器即可

1
nginx -s reload

本文作者:草梅友仁
本文地址: https://blog.cmyr.ltd/archives/b1ab73df.html
版权声明:转载请注明出处!

坚持原创技术分享,您的支持将鼓励我继续创作!