测试地址：https://www.ssllabs.com/ssltest/
配置SSL先参考：http://blog.zephyrxt.net/post-125.html
—————— 禁用SSLv3 ——————
To disable SSLv3, your ssl_protocols directive should be set like this:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
—————— 使用HSTS ——————
HTTP Strict Transport Security (HSTS) instructs browsers to communicate with your website only over SSL.
# Enable HSTS
add_header Strict-Transport-Security max-age=63072000;
—————— 配置Forward Secrecy ——————
Configuring Forward Secrecy
Enabling forward secrecy can be done in two steps:
Configure your server to actively select the most desirable suite from the list offered by SSL clients.
Put ECDHE and DHE suites to the top of your list. (The order is important; because ECDHE suites are faster, you want to use them whenever clients supports them.)
Knowing which suites to enable and move to the top can be tricky, because not all browsers (devices) support all forward secrecy suites. At this point you may want to look for inspiration from those who are already supporting forward secrecy, for example Google.
In the nutshell, these are some of the suites you might want to enable3 and push (close) to the top:
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
—————— 配置 dhparam ——————
With Forward Secrecy, if an attacker gets a hold of the server's private key, it will not be able to decrypt past communications. The private key is only used to sign the DH handshake, which does not reveal the pre-master key. Diffie-Hellman ensures that the pre-master keys never leave the client and the server, and cannot be intercepted by a MITM.
All versions of nginx as of 1.4.4 rely on OpenSSL for input parameters to Diffie-Hellman (DH). Unfortunately, this means that Ephemeral Diffie-Hellman (DHE) will use OpenSSL's defaults, which include a 1024-bit key for the key-exchange. Since we're using a 2048-bit certificate, DHE clients will use a weaker key-exchange than non-ephemeral DH clients.
We need generate a stronger DHE parameter:
cd /etc/ssl/certsopenssl dhparam -out dhparam.pem 4096
And then tell nginx to use it for DHE key-exchange:
ssl_dhparam /etc/ssl/certs/dhparam.pem;
—————— 参考配置 ——————
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
ssl on;
keepalive_timeout 70;
ssl_certificate start.crt;
ssl_certificate_key zephyr.pem;
ssl_dhparam dhparam.pem;
ssl_ciphers "CHACHA20 ECDHE-RSA-AES256-SHA";
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols TLSv1.2;
参考：
Security Sidebar: Improving Your SSL Labs Test Grade
https://bbs.zephyrxt.com/thread-17796-1-1.html
Getting an A+ on Qualy's SSL Labs Tester
https://bbs.zephyrxt.com/thread-17797-1-1.html
Guide to Nginx + SSL + SPDY
https://bbs.zephyrxt.com/thread-17798-1-1.html
Setup your IIS for SSL Perfect Forward Secrecy and TLS 1.2
https://bbs.zephyrxt.com/thread-17799-1-1.html
SSL Labs: Deploying Forward Secrecy
https://bbs.zephyrxt.com/thread-17800-1-1.html
Get an A in SSL class! (How to score A+ in your ssllabs test)
https://bbs.zephyrxt.com/thread-17813-1-1.html
Configuring Apache, Nginx, and OpenSSL for Forward Secrecy
https://bbs.zephyrxt.com/thread-17801-1-1.html
libQtShadowsocks v1.4.0 发布，附所有加密方式的加密速度对比
https://bbs.zephyrxt.com/thread-17802-1-1.html
Implementing SSL Perfect Forward Secrecy in NGINX Web-Server
https://bbs.zephyrxt.com/thread-17803-1-1.html
Hardening Your Web Server’s SSL Ciphers
https://bbs.zephyrxt.com/thread-17804-1-1.html
Strong SSL/TLS Cryptography in Apache and Nginx
https://bbs.zephyrxt.com/thread-17805-1-1.html
How To Protect your Server Against the POODLE SSLv3 Vulnerability
https://bbs.zephyrxt.com/thread-17806-1-1.html
在HTTPS加密连接中使用CHACHA20-POLY1305加密方法
https://bbs.zephyrxt.com/thread-17807-1-1.html
OpenSSL with ChaCha20-Poly1305 support
https://bbs.zephyrxt.com/thread-17808-1-1.html
OpenSSL 1.0.2 – now with less whitespace!
https://bbs.zephyrxt.com/thread-17809-1-1.html
How to get ssllabs.com/ssltest "Cipher Strength" to 100 points?
https://bbs.zephyrxt.com/thread-17810-1-1.html
Strong SSL Security on nginx
https://bbs.zephyrxt.com/thread-17811-1-1.html
How to get an A+ on the Qualsys SSL Labs test
https://bbs.zephyrxt.com/thread-17812-1-1.html