1. 生成一个4096位的Diffie-Hellman参数文件，需要比较长的时间，看机器而定

[howard@localhost ssl]$ pwd

/home/howard/ssl

  [howard@localhost ssl]$ openssl dhparam -out dhparam.pem 4096

   2.在配置test.example.com.conf文件中增加以下内容：

listen 443 ssl;    

ssl_certificate /home/howard/ssl/ssl.cer;

    ssl_certificate_key /home/howard/ssl/ssl.key;

    ssl_dhparam /home/howard/ssl/dhparam.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_prefer_server_ciphers on;

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";

 

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

    add_header X-Frame-Options DENY;

    add_header X-Content-Type-Options nosniff;


[howard@localhost ~]/usr/local/nginx/sbin/nginx -t

没有报错即可

[root@localhost ~]/usr/local/nginx/sbin/nginx -s reload

3. 在安全测试网站验证

打开网站https://www.ssllabs.com/ssltest/index.html，输入要测试的域名进行测试，等一会之后就可以看到绿色的A+


注意:安装nginx之前一定要先升级openssl，否则容易存在安全漏洞


本文参考以下博客:

  https://www.howtoforge.com/ssl-perfect-forward-secrecy-in-nginx-webserver