1
2

# 只啟用 TLS 1.2 和 TLS 1.3
ssl_protocols TLSv1.2 TLSv1.3;

1
2
3
4
5
6

# TLS 1.3 加密套件（由 OpenSSL 自動管理）
# TLS 1.2 加密套件
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# 優先使用伺服器端的加密套件順序
ssl_prefer_server_ciphers off;

1
2
3
4
5

# 檢查憑證鏈是否完整
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text | grep -A 1 "Issuer:"

# 驗證憑證鏈
openssl verify -CAfile /path/to/ca-bundle.crt /path/to/certificate.crt

1
2
3
4
5
6

# 完整憑證鏈（包含伺服器憑證和中繼憑證）
ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;

# 用於 OCSP Stapling 的信任憑證
ssl_trusted_certificate /etc/nginx/ssl/chain.pem;

1
2
3
4
5
6
7
8

# 基本 HSTS 設定（有效期 1 年）
add_header Strict-Transport-Security "max-age=31536000" always;

# 包含子網域的 HSTS 設定
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# 準備加入 HSTS Preload 清單
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 啟用 OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;

# 信任的 CA 憑證鏈
ssl_trusted_certificate /etc/nginx/ssl/chain.pem;

# DNS 解析器
resolver 8.8.8.8 8.8.4.4 1.1.1.1 valid=300s;
resolver_timeout 5s;

1
2

# 檢查 OCSP Stapling 是否啟用
echo | openssl s_client -connect example.com:443 -status -servername example.com 2>/dev/null | grep -A 5 "OCSP Response"

1
2
3
4
5

# 使用強健的 DH 參數
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# 設定橢圓曲線
ssl_ecdh_curve X25519:secp384r1;

1
2
3
4
5

# 生成 4096 位元的 DH 參數（建議用於高安全性環境）
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096

# 生成 2048 位元的 DH 參數（一般用途）
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# /etc/nginx/conf.d/ssl.conf
# SSL/TLS 全域設定

# 協定版本
ssl_protocols TLSv1.2 TLSv1.3;

# 加密套件
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

# 橢圓曲線
ssl_ecdh_curve X25519:secp384r1;

# DH 參數
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

# SSL 工作階段快取
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 1.1.1.1 valid=300s;
resolver_timeout 5s;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# /etc/nginx/sites-available/example.com
server {
    listen 80;
    server_name example.com www.example.com;

    # 將所有 HTTP 請求重導向到 HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    # 憑證設定
    ssl_certificate /etc/nginx/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/example.com/privkey.pem;
    ssl_trusted_certificate /etc/nginx/ssl/example.com/chain.pem;

    # 安全標頭
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # 網站根目錄
    root /var/www/example.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

1
2
3
4
5
6
7
8
9

# 測試 TLS 版本支援
nmap --script ssl-enum-ciphers -p 443 example.com

# 檢查憑證資訊
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

# 測試特定 TLS 版本
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

#!/bin/bash
# ssl_check.sh - SSL 設定快速檢查腳本

DOMAIN=$1

if [ -z "$DOMAIN" ]; then
    echo "Usage: $0 <domain>"
    exit 1
fi

echo "=== SSL/TLS 檢查: $DOMAIN ==="
echo ""

echo "[1] 憑證有效期"
echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} 2>/dev/null | openssl x509 -noout -dates

echo ""
echo "[2] TLS 版本支援"
for version in tls1 tls1_1 tls1_2 tls1_3; do
    result=$(echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} -${version} 2>&1)
    if echo "$result" | grep -q "Protocol.*TLSv"; then
        echo "  ${version}: 支援"
    else
        echo "  ${version}: 不支援"
    fi
done

echo ""
echo "[3] HSTS 標頭"
curl -sI https://${DOMAIN} | grep -i "strict-transport"

echo ""
echo "[4] OCSP Stapling"
echo | openssl s_client -connect ${DOMAIN}:443 -status -servername ${DOMAIN} 2>/dev/null | grep "OCSP Response Status"

echo ""
echo "=== 檢查完成 ==="