TLS 1.3 & HTTP/2

支持 TLS1.3 的软件环境

• OpenSSL 1.1.1
• JDK 11
• Golang 1.12
• Python 3.6.7 + OpenSSL 1.1.1 + requests 2.20.0 (Ubuntu 18.10)
• curl 7.61.0 + OpenSSL 1.1.1
• PHP 7.4

操作系统

debian buster
Ubuntu 18.04
Ubuntu 18.10
Fedora 29
说明：
ubuntu 18.04 jdk11 FIXED https://bugs.launchpad.net/ubuntu/+source/saaj/+bug/1814133

客户端

Chrome 70
Firefox 63
Chrome Android 70
Firefox Android 63

服务端

Nginx 15.5
OpenResty 15.5.1rc0+
Apache httpd 2.4.37

nginx 配置，只支持 TLS 1.3

server {
  listen 80;
  listen 443 ssl http2;
  server_name tls13.1234ssl.com;
  server_tokens off;
  ssl_certificate      crt/1234ssl.com.crt;
  ssl_certificate_key  crt/1234ssl.com.key;
  ssl_dhparam dhparam.pem;
  ssl_session_timeout  5m;
  ssl_protocols TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+AES:EECDH+CHACHA20:!SHA;
  proxy_set_header   X-Forwarded-Proto $scheme;
  proxy_set_header   X-Forwarded-Port $server_port;
  default_type "text/html";

  add_header Strict-Transport-Security "max-age=31536000; preload";
  if ($scheme = http) { rewrite ^/(.*)  https://$host/$1 permanent; }
  set $ngx_ssl_protocol  $ssl_protocol;
  set $ngx_ssl_cipher    $ssl_cipher  ;
  set $ngx_http_protocol $server_protocol;
  location ~ / {
    content_by_lua_block {
    local useragent = ngx.req.get_headers().user_agent
        ngx.header['content-type'] = 'text/html'
    ngx.say("TLS Protocol: " .. ngx.var.ngx_http_protocol .. " " .. ngx.var.ngx_ssl_protocol .. "/" .. ngx.var.ngx_ssl_cipher)
        ngx.say("
User-Agent: " .. useragent )
     }
   }

}

nginx conf 只支持 HTTP/2

server {
  listen 80;
  listen 443 http2;
  server_name http2.1234ssl.com;
  server_tokens off;
  ssl_certificate      crt/1234ssl.com.crt;
  ssl_certificate_key  crt/1234ssl.com.key;
  ssl_dhparam dhparam.pem;
  ssl_session_timeout  5m;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+AES:EECDH+CHACHA20;
  proxy_set_header   X-Forwarded-Proto $scheme;
  proxy_set_header   X-Forwarded-Port $server_port;
  default_type "text/html";

  add_header Strict-Transport-Security "max-age=31536000; preload";
  if ($scheme = http) { rewrite ^/(.*)  https://$host/$1 permanent; }
  set $ngx_ssl_protocol  $ssl_protocol;
  set $ngx_ssl_cipher    $ssl_cipher  ;
  set $ngx_http_protocol $server_protocol;
  location ~ / {
    content_by_lua_block {
    local useragent = ngx.req.get_headers().user_agent
    ngx.say("TLS Protocol: " .. ngx.var.ngx_http_protocol .. " " .. ngx.var.ngx_ssl_protocol .. "/" .. ngx.var.ngx_ssl_cipher)
        ngx.say("
User-Agent: " .. useragent )
     }
   }

}

测试你的客户端

测试你的客户端是否支持TLSv1.3 HTTP/2 的网站： https://ssltest.1234ssl.com/

python 测试代码

Python 3.6.7 + OpenSSL 1.1.1 + requests 2.20.0
测试结果为 HTTP/1.1 TLSv1.3/TLS_AES_256_GCM_SHA384

import requests
print(requests.get("https://ssltest.1234ssl.com").text)