ssl - 即使我有 key 和证书，nginx 也不支持加密协议(protocol)

Question

这运行良好，但由于某种原因开始不起作用。我在 777 文件夹中有 ssl 文件。这是我的 nginx conf:

     keepalive_timeout 70;

     ssl_certificate     /path/to/crt;
     ssl_certificate_key /path/to/key;  #these are both correct
     #the rest of this file is shown as it is

     ssl_session_timeout 1d;
     ssl_session_cache shared:SSL:50m;

     #ssl_dhparam /path/to/dhparam.pem;

     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     #I had 'modern' (no TLSv1). Tried to add it to see if it would fix but it didn't
     ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256$
     ssl_prefer_server_ciphers on;

     add_header Strict-Transport-Security max-age=15768000;

     ssl_stapling on;
     ssl_stapling_verify on;

     ## verify chain of trust of OCSP response using Root CA and Intermedia$
     #ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

     #resolver <IP DNS resolver>;

下面是我网站上的 cipherscan 日志:

Certificate: untrusted,  bits,  signature
TLS ticket lifetime hint: 
OCSP stapling: not supported
Cipher ordering: server
Curves ordering: none - fallback: no
Renegotiation test error
Supported compression methods test error

TLS Tolerance: no
Fallbacks required:
big-SSLv3 config not supported, connection failed
big-TLSv1.0 config not supported, connection failed
big-TLSv1.1 config not supported, connection failed
big-TLSv1.2 config not supported, connection failed
small-SSLv3 config not supported, connection failed
small-TLSv1.0 config not supported, connection failed
small-TLSv1.0-notlsext config not supported, connection failed
small-TLSv1.1 config not supported, connection failed
small-TLSv1.2 config not supported, connection failed
v2-big-TLSv1.2 config not supported, connection failed
v2-small-SSLv3 config not supported, connection failed
v2-small-TLSv1.0 config not supported, connection failed
v2-small-TLSv1.1 config not supported, connection failed
v2-small-TLSv1.2 config not supported, connection failed

当我执行 sudo service nginx restart 时，没有出现任何错误，它会正常启动。有谁知道可能会发生什么？非常感谢您的帮助

当通过 firefox 访问时，我得到“安全连接失败”，当通过 chrome 访问时，我得到“SSL 连接错误:ERR_SSL_PROTOCOL_ERROR”。 这可能是域名服务器造成的吗？我最近尝试启用 cloudflare，所以我怀疑流量是否被严重操纵。

Answer 1

 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256$

这是您尝试在此处使用的一组非常严格的密码。这些都是仅受 TLS 1.2 支持的 GCM 密码——这意味着您接受 TLS 1.0 和 TLS 1.1 流量的选项是无用的。也可能不是所有浏览器都支持这些密码。参见 https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29推荐配置。

除此之外，您显示的语法是错误的，即该行不应以 $ 结尾，而应以 '; 结尾。但这可能只是您问题中的错字。