如果你想配置一个安全的 https 网站的话,你就可以需要下面这个了。
请根据您所使用的网站服务器程序,选择对应的配置文件,然后根据自己的需要修改自己现行的网站配置即可!
如果您使用下面的配置,您可以需要自己配置证书 CRT 和证书 KEY 才能正常使用
如果您只有一个网站是使用 https 的,而子域名其他并不使用 https ,请自行删除配置中的includeSubdomAIns
ssl_ciphers "AES128+EECDH:AES128+EDH"; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; ssl_session_tickets off; ssl_stapling on; # Requires nginx >= 1.3.7 ssl_stapling_verify on; # Requires nginx => 1.3.7 resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s;
Apache
SSLCipherSuite AES128+EECDH:AES128+EDH SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On SSLSessionTickets Off Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" Header always set X-Frame-Options DENY Header always set X-Content-Type-Options nosniff # Requires Apache >= 2.4 SSLCompression off SSLUseStapling on SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
Lighttpd
ssl.honor-cipher-order = "enable" ssl.cipher-list = "AES128+EECDH:AES128+EDH" ssl.use-compression = "disable" setenv.add-response-header = ( "Strict-Transport-Security" => "max-age=63072000; includeSubdomains; preload", "X-Frame-Options" => "DENY", "X-Content-Type-Options" => "nosniff" ) ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable"