{"id":21445,"date":"2026-10-26T14:39:21","date_gmt":"2026-10-26T06:39:21","guid":{"rendered":"https:\/\/blog.ywdevops.cn\/?p=21445"},"modified":"2026-10-26T16:50:20","modified_gmt":"2026-10-26T08:50:20","slug":"tls","status":"publish","type":"post","link":"https:\/\/blog.ywdevops.cn\/index.php\/2026\/10\/26\/tls\/","title":{"rendered":"TLS \u6df1\u5165\uff1a\u63e1\u624b\u3001\u8bc1\u4e66\u94fe\u3001HTTPS \u6392\u969c\u95ed\u73af"},"content":{"rendered":"\n

\u4e00\u3001TLS \u5728\u534f\u8bae\u6808\u4e2d\u7684\u4f4d\u7f6e<\/mark><\/strong><\/p>\n\n\n\n

TLS \u4e0d\u662f\u66ff\u4ee3 TCP\uff0c\u800c\u662f\u63d2\u5728 TCP \u548c\u5e94\u7528\u5c42\u4e4b\u95f4<\/strong>\u7684\u52a0\u5bc6\u5c42\uff1a<\/p>\n\n\n\n

HTTP\n  \u2193\nTLS   \u2190 \u6211\u4eec\u5728\u8fd9\n  \u2193\nTCP\n  \u2193\nIP<\/code><\/pre>\n\n\n\n
HTTPS = HTTP over TLS\uff0c\u9ed8\u8ba4\u7aef\u53e3 443\u3002TLS \u5bf9\u4e0a\u5c42\u5e94\u7528\u5b8c\u5168\u900f\u660e\u2014\u2014\u5e94\u7528\u53ea\u7ba1\u8bfb\u5199\u52a0\u5bc6\u5b57\u8282\u6d41\uff0c\u63e1\u624b\u3001\u52a0\u5bc6\u3001\u5b8c\u6574\u6027\u6821\u9a8c\u5168\u7531 TLS \u5c42\u5904\u7406\u3002<\/p>\n\n\n\n
\u4e8c\u3001TLS \u63e1\u624b\u5b8c\u6574\u6d41\u7a0b\uff08\u4ee5 ECDHE \u4e3a\u4f8b\uff09<\/mark><\/strong><\/p>\n\n\n\n
\u73b0\u4ee3\u751f\u4ea7\u73af\u5883 99% \u4f7f\u7528 ECDHE<\/strong>\uff08\u692d\u5706\u66f2\u7ebf\u8fea\u83f2-\u8d6b\u5c14\u66fc\u4e34\u65f6\u5bc6\u94a5\u4ea4\u6362\uff09\uff0c\u6838\u5fc3\u4f18\u52bf\u662f\u524d\u5411\u5b89\u5168<\/strong>\u2014\u2014\u6bcf\u6b21\u4f1a\u8bdd\u7528\u4e34\u65f6\u5bc6\u94a5\u5bf9\uff0c\u5373\u4f7f\u670d\u52a1\u5668\u79c1\u94a5\u65e5\u540e\u6cc4\u9732\uff0c\u4e5f\u89e3\u5bc6\u4e0d\u4e86\u5386\u53f2\u6d41\u91cf<\/p>\n\n\n\n
\u5ba2\u6237\u7aef                                         \u670d\u52a1\u7aef\n  |------------- ClientHello ---------------->|\n  |  \u00b7 \u652f\u6301\u7684 TLS \u7248\u672c\uff081.2 \/ 1.3\uff09            |\n  |  \u00b7 \u968f\u673a\u6570 ClientRandom                    |\n  |  \u00b7 \u5bc6\u7801\u5957\u4ef6\u5217\u8868                            |\n  |  \u00b7 SNI\uff08Server Name Indication\uff09           |\n  |  \u00b7 \u652f\u6301\u7684\u7b7e\u540d\u7b97\u6cd5                          |\n  |                                           |\n  |<------------ ServerHello -----------------|\n  |  \u00b7 \u9009\u5b9a\u7684 TLS \u7248\u672c                         |\n  |  \u00b7 \u968f\u673a\u6570 ServerRandom                    |\n  |  \u00b7 \u9009\u5b9a\u7684\u5bc6\u7801\u5957\u4ef6                          |\n  |                                           |\n  |<------------ Certificate ----------------|\n  |  \u00b7 \u53f6\u5b50\u8bc1\u4e66\uff08\u4f60\u7684\u57df\u540d\u8bc1\u4e66\uff09                 |\n  |  \u00b7 \u4e2d\u95f4 CA \u8bc1\u4e66\uff08\u53ef\u80fd\u591a\u5f20\uff09                 |\n  |                                           |\n  |<------ ServerKeyExchange -----------------|\n  |  \u00b7 \u692d\u5706\u66f2\u7ebf\u53c2\u6570                            |\n  |  \u00b7 \u670d\u52a1\u7aef\u4e34\u65f6\u516c\u94a5                           |\n  |  \u00b7 \u670d\u52a1\u7aef\u7b7e\u540d\uff08\u7528\u8bc1\u4e66\u79c1\u94a5\u7b7e\uff0c\u9632\u7be1\u6539\uff09        |\n  |                                           |\n  |<------ ServerHelloDone -------------------|\n  |                                           |\n  |------ ClientKeyExchange ---------------->|\n  |  \u00b7 \u5ba2\u6237\u7aef\u4e34\u65f6\u516c\u94a5                           |\n  |                                           |\n  |------ ChangeCipherSpec ----------------->|  (TLS 1.2 \u53ca\u4e4b\u524d)\n  |------ Finished ------------------------->|\n  |  \u00b7 \u9a8c\u8bc1\u63e1\u624b\u5b8c\u6574\u6027\u7684 MAC                     |\n  |                                           |\n  |<----- ChangeCipherSpec ------------------|\n  |<----- Finished --------------------------|\n  |                                           |\n  |======== \u52a0\u5bc6\u901a\u4fe1\u5f00\u59cb =====================|<\/code><\/pre>\n\n\n\n
TLS 1.3 \u7684\u53d8\u5316\uff08\u7b80\u8981\uff09<\/h3>\n\n\n\n
    \n
  • \u63e1\u624b\u4ece 2-RTT \u7f29\u51cf\u5230 1-RTT<\/strong>\uff080-RTT \u53ef\u9009\uff09<\/li>\n\n\n\n
  • \u79fb\u9664 RSA \u5bc6\u94a5\u4ea4\u6362\u3001RC4\u3001CBC \u7b49\u4e0d\u5b89\u5168\u7b97\u6cd5<\/li>\n\n\n\n
  • \u52a0\u5bc6\u6269\u5c55\uff1aServerHello \u4e4b\u540e\u7684\u6240\u6709\u6d88\u606f\u90fd\u52a0\u5bc6<\/li>\n\n\n\n
  • \u7b7e\u540d\u7b97\u6cd5\u72ec\u7acb\u534f\u5546<\/li>\n<\/ul>\n\n\n\n
    \u4e09\u3001\u8bc1\u4e66\u94fe\uff1a\u6700\u5bb9\u6613\u88ab\u5751\u7684\u5730\u65b9<\/mark><\/strong><\/p>\n\n\n\n
    1\u3001\u4fe1\u4efb\u94fe\u7ed3\u6784<\/p>\n\n\n\n
    \u6839 CA\uff08Root CA\uff09\n  \u2502  \u81ea\u7b7e\u540d\uff0c\u9884\u7f6e\u5728\u64cd\u4f5c\u7cfb\u7edf\/\u6d4f\u89c8\u5668\u4fe1\u4efb\u5e93\n  \u2502\n  \u251c\u2500\u2500 \u4e2d\u95f4 CA 1\uff08\u7531\u6839 CA \u7b7e\u53d1\uff09\n  \u2502     \u2502\n  \u2502     \u251c\u2500\u2500 \u4e2d\u95f4 CA 2\uff08\u7531\u4e2d\u95f4 CA 1 \u7b7e\u53d1\uff09\n  \u2502     \u2502     \u2502\n  \u2502     \u2502     \u2514\u2500\u2500 \u53f6\u5b50\u8bc1\u4e66\uff08\u4f60\u7684\u57df\u540d\u8bc1\u4e66\uff0c\u7531\u4e2d\u95f4 CA 2 \u7b7e\u53d1\uff09\n  \u2502     \u2502\n  \u2502     \u2514\u2500\u2500 \u5176\u4ed6\u53f6\u5b50\u8bc1\u4e66...\n  \u2502\n  \u2514\u2500\u2500 \u5176\u4ed6\u4e2d\u95f4 CA...<\/code><\/pre>\n\n\n\n
    2\u3001\u9a8c\u8bc1\u6d41\u7a0b\uff08\u5ba2\u6237\u7aef\u4fa7\uff09<\/p>\n\n\n\n
    1. \u62ff\u5230\u53f6\u5b50\u8bc1\u4e66\n2. \u8bfb\u53d6 Issuer \u5b57\u6bb5 \u2192 \u627e\u5230\u7b7e\u53d1\u8005\n3. \u9010\u7ea7\u5411\u4e0a\u627e\uff0c\u76f4\u5230\u6839 CA\n4. \u6839 CA \u5728\u672c\u5730\u4fe1\u4efb\u5e93\u91cc\uff1f\u2192 \u4fe1\u4efb\u94fe\u5b8c\u6574 \u2713\n5. \u6bcf\u4e00\u6b65\u9a8c\u8bc1\u7b7e\u540d + \u6709\u6548\u671f + \u540a\u9500\u72b6\u6001<\/code><\/pre>\n\n\n\n
    \u6700\u5e38\u89c1\u6545\u969c\uff1a\u4e2d\u95f4\u8bc1\u4e66\u7f3a\u5931<\/p>\n\n\n\n
    \u670d\u52a1\u7aef\u53ea\u914d\u4e86\u53f6\u5b50\u8bc1\u4e66\uff08\u5fd8\u8bb0\u62fc\u63a5\u4e2d\u95f4 CA\uff09\n        \u2193\n\u5ba2\u6237\u7aef\u6536\u5230\u540e\u627e\u4e0d\u5230\u7b7e\u53d1\u8005\n        \u2193\n\"NET::ERR_CERT_AUTHORITY_INVALID\"\n\"\u8bc1\u4e66\u4e0d\u53d7\u4fe1\u4efb\"<\/code><\/pre>\n\n\n\n
    \u9a8c\u8bc1\u65b9\u6cd5\uff1a<\/p>\n\n\n\n
    # \u770b\u670d\u52a1\u7aef\u5b9e\u9645\u8fd4\u56de\u7684\u8bc1\u4e66\u94fe\nopenssl s_client -connect example.com:443 -showcerts 2>\/dev\/null | \\\n  openssl crl2pkcs7 -nocrl -certfile \/dev\/stdin | \\\n  openssl pkcs7 -print_certs -noout\n\n# \u5982\u679c\u53ea\u8f93\u51fa\u4e00\u5f20\u8bc1\u4e66 = \u7f3a\u4e2d\u95f4 CA<\/code><\/pre>\n\n\n\n
    \u56db\u3001\u8bc1\u4e66\u683c\u5f0f\u4e0e\u8fd0\u7ef4\u64cd\u4f5c<\/mark><\/strong><\/p>\n\n\n\n
    \u683c\u5f0f<\/strong><\/th>\u6269\u5c55\u540d<\/strong><\/th>\u7f16\u7801<\/strong><\/th>\u8bf4\u660e<\/strong><\/th><\/tr><\/thead>
    PEM<\/td>.pem, .crt, .key, .csr<\/td>Base64 \u6587\u672c<\/td>\u6700\u5e38\u7528<\/td><\/tr>
    DER<\/td>.der, .cer<\/td>\u4e8c\u8fdb\u5236<\/td>Windows\/Java<\/td><\/tr>
    PKCS#12<\/td>.p12, .pfx<\/td>\u4e8c\u8fdb\u5236<\/td>\u8bc1\u4e66+\u79c1\u94a5\u6253\u5305<\/td><\/tr>
    PKCS#7<\/td>.p7b, .p7c<\/td>Base64<\/td>\u8bc1\u4e66\u94fe\uff08\u4e0d\u542b\u79c1\u94a5\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \u65e5\u5e38\u8fd0\u7ef4\u547d\u4ee4<\/p>\n\n\n\n
    # \u67e5\u770b\u8bc1\u4e66\u8be6\u60c5\nopenssl x509 -in cert.pem -text -noout\n\n# \u67e5\u770b\u6709\u6548\u671f\nopenssl x509 -in cert.pem -dates -noout\n\n# \u67e5\u770b SAN\uff08Subject Alternative Name\uff09\nopenssl x509 -in cert.pem -ext subjectAltName -noout\n\n# \u9a8c\u8bc1\u79c1\u94a5\u548c\u8bc1\u4e66\u662f\u5426\u5339\u914d\nopenssl x509 -noout -modulus -in cert.pem | md5sum\nopenssl rsa -noout -modulus -in key.pem | md5sum\n# \u4e24\u4e2a md5 \u76f8\u540c = \u5339\u914d \u2713\n\n# \u67e5\u770b CSR \u5185\u5bb9\nopenssl req -in request.csr -text -noout\n\n# PEM \u2192 PKCS12\nopenssl pkcs12 -export -in fullchain.pem -inkey key.pem -out cert.p12\n\n# \u4ece PKCS12 \u63d0\u53d6\u8bc1\u4e66\nopenssl pkcs12 -in cert.p12 -nokeys -out cert.pem\n\n# \u4ece PKCS12 \u63d0\u53d6\u79c1\u94a5\nopenssl pkcs12 -in cert.p12 -nocerts -out key.pem -nodes<\/code><\/pre>\n\n\n\n
    \u4e94\u3001SNI\uff1a\u4e00\u4e2a IP \u591a\u5f20\u8bc1\u4e66\u7684\u5173\u952e<\/mark><\/strong><\/p>\n\n\n\n
    \u4e00\u4e2a\u516c\u7f51 IP \u7684 443 \u7aef\u53e3\u53ea\u80fd\u88ab\u4e00\u4e2a\u8fdb\u7a0b\u76d1\u542c\uff0c\u4f46\u4e0a\u9762\u8dd1\u4e86\u591a\u4e2a HTTPS \u7ad9\u70b9\uff08\u4e0d\u540c\u57df\u540d\uff09\u3002\u670d\u52a1\u7aef\u600e\u4e48\u77e5\u9053\u7528\u54ea\u5f20\u8bc1\u4e66\uff1f<\/p>\n\n\n\n
    \u89e3\u51b3\uff1aSNI\uff08Server Name Indication\uff09<\/p>\n\n\n\n
    ClientHello \u4e2d\u643a\u5e26 SNI \u6269\u5c55\u5b57\u6bb5\u53d1\u7ed9\u670d\u52a1\u7aef\uff1a\n  sni = \"api.example.com\"\n\u670d\u52a1\u7aef\u6839\u636e SNI \u9009\u62e9\u5bf9\u5e94\u7684\u8bc1\u4e66\u548c\u865a\u62df\u4e3b\u673a\u914d\u7f6e<\/code><\/pre>\n\n\n\n
    \u6392\u9519\uff1a<\/p>\n\n\n\n
    # \u4e0d\u5e26 SNI\uff08\u7528 IP \u76f4\u8fde\uff09\nopenssl s_client -connect 93.184.216.34:443\n# \u53ef\u80fd\u8fd4\u56de\u9ed8\u8ba4\u8bc1\u4e66\u6216\u63e1\u624b\u5931\u8d25\n\n# \u5e26 SNI\nopenssl s_client -connect 93.184.216.34:443 -servername api.example.com\n# \u8fd4\u56de\u6b63\u786e\u8bc1\u4e66\n\n# \u9a8c\u8bc1\u8fd4\u56de\u7684\u8bc1\u4e66\u57df\u540d\nopenssl s_client -connect example.com:443 -servername example.com 2>\/dev\/null | \\\n  openssl x509 -noout -subject -ext subjectAltName<\/code><\/pre>\n\n\n\n
    \u516d\u3001HTTPS \u6392\u969c\u95ed\u73af<\/mark><\/strong><\/p>\n\n\n\n
    \u7528\u6237\u62a5\"HTTPS \u8bbf\u95ee\u5f02\u5e38\"\n        \u2193\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 1. \u7aef\u53e3\u8fde\u901a\u6027                  \u2502\n\u2502    nc -zv example.com 443     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n        \u2193 \u4e0d\u901a\n   \u9632\u706b\u5899 \/ \u5b89\u5168\u7ec4 \/ \u670d\u52a1\u672a\u542f\u52a8\n\n        \u2193 \u901a\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 2. \u8bc1\u4e66\u6709\u6548\u6027                  \u2502\n\u2502    openssl s_client -connect  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n        \u2193 \u8bc1\u4e66\u62a5\u9519\n   \u251c\u2500 \u8fc7\u671f \u2192 \u7eed\u7b7e\u66ff\u6362\n   \u251c\u2500 \u57df\u540d\u4e0d\u5339\u914d \u2192 \u68c0\u67e5 SAN \/ SNI\n   \u251c\u2500 \u4e0d\u53d7\u4fe1\u4efb \u2192 \u7f3a\u4e2d\u95f4\u8bc1\u4e66\n   \u251c\u2500 \u81ea\u7b7e\u540d \u2192 \u5ba2\u6237\u7aef\u672a\u52a0\u4fe1\u4efb\n   \u2514\u2500 \u79c1\u94a5\u4e0d\u5339\u914d \u2192 \u91cd\u65b0\u914d\u5bf9\n\n        \u2193 \u8bc1\u4e66 OK\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 3. \u63e1\u624b\u80fd\u5426\u5b8c\u6210                \u2502\n\u2502    \u770b s_client \u8f93\u51fa\u672b\u5c3e        \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n        \u2193 \u5361\u5728 ClientHello\n   \u4e2d\u95f4\u8bbe\u5907\u62e6\u622a\uff08WAF\/IPS\/\u4ee3\u7406\uff09\n\n        \u2193 \u5361\u5728 ServerHello\n   \u670d\u52a1\u7aef TLS \u914d\u7f6e\u9519\u8bef \/ \u6027\u80fd\u95ee\u9898\n\n        \u2193 \u63e1\u624b\u5b8c\u6210\u4f46\u4e1a\u52a1\u5f02\u5e38\n   \u251c\u2500 HTTP\u2192HTTPS \u91cd\u5b9a\u5411\u5faa\u73af\n   \u251c\u2500 \u5e94\u7528\u5c42\u903b\u8f91\u9519\u8bef\n   \u2514\u2500 \u540e\u7aef\u670d\u52a1\u5f02\u5e38\n\n        \u2193 \u90e8\u5206\u5ba2\u6237\u7aef\u5f02\u5e38\n   \u251c\u2500 TLS \u7248\u672c\u4e0d\u517c\u5bb9\n   \u251c\u2500 \u5bc6\u7801\u5957\u4ef6\u65e0\u4ea4\u96c6\n   \u251c\u2500 \u4e2d\u95f4\u8bc1\u4e66\u8001\u5ba2\u6237\u7aef\u4e0d\u4fe1\u4efb\n   \u2514\u2500 SNI \u4e0d\u652f\u6301<\/code><\/pre>\n\n\n\n
      \n
    • nc -zv baidu.com 443  \u6d4b\u8bd5\u5230\u57df\u540d\u7684443\u7aef\u53e3\u901a\u4e0d\u901a<\/li>\n<\/ul>\n\n\n\n
      \u6392\u969c\u547d\u4ee4\u5927\u5168<\/p>\n\n\n\n
      # \u5b8c\u6574\u63e1\u624b\u6d4b\u8bd5\uff08\u6700\u5e38\u7528\uff09\nopenssl s_client -connect example.com:443 -servername example.com\n\n# \u663e\u793a\u5b8c\u6574\u8bc1\u4e66\u94fe\nopenssl s_client -connect example.com:443 -showcerts\n\n# \u6d4b\u8bd5\u7279\u5b9a TLS \u7248\u672c\nopenssl s_client -connect example.com:443 -tls1_2\nopenssl s_client -connect example.com:443 -tls1_3\n\n# \u6d4b\u8bd5\u7279\u5b9a\u5bc6\u7801\u5957\u4ef6\nopenssl s_client -connect example.com:443 -cipher 'ECDHE-RSA-AES128-GCM-SHA256'\n\n# \u53ea\u770b\u8bc1\u4e66\u6709\u6548\u671f\u548c\u57df\u540d\nopenssl s_client -connect example.com:443 2>\/dev\/null | \\\n  openssl x509 -dates -subject -ext subjectAltName -noout\n\n# curl \u8be6\u7ec6\u8f93\u51fa\ncurl -vI https:\/\/example.com\ncurl -vI --resolve example.com:443:93.184.216.34 https:\/\/example.com\n\n# \u6d4b\u8bd5 OCSP \u540a\u9500\u72b6\u6001\nopenssl ocsp -issuer intermediate.pem -cert cert.pem \\\n  -url http:\/\/ocsp.example.com -text\n\n# \u5728\u7ebf\u5168\u9762\u68c0\u6d4b\n# https:\/\/www.ssllabs.com\/ssltest\/ \uff08Qualys SSL Labs\uff09<\/code><\/pre>\n\n\n\n
      \u4e03\u3001\u9ad8\u9891\u6545\u969c\u573a\u666f\u8be6\u89e3<\/mark><\/strong><\/p>\n\n\n\n
      \u573a\u666f 1\uff1a\u8bc1\u4e66\u8fc7\u671f<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\u6d4f\u89c8\u5668\u7ea2\u9501\u3001\"\u8bc1\u4e66\u5df2\u8fc7\u671f\u6216\u5c1a\u672a\u751f\u6548\"\n\n\u6392\u67e5\uff1a\n  openssl x509 -in cert.pem -dates -noout\n  notBefore=Jan  1 00:00:00 2024 GMT\n  notAfter=Jan  1 00:00:00 2025 GMT  \u2190 \u5df2\u8fc7\u671f\n\n\u4fee\u590d\uff1a\n  \u00b7 Let's Encrypt \u2192 certbot renew && systemctl reload nginx\n  \u00b7 \u5546\u4e1a\u8bc1\u4e66 \u2192 \u91cd\u65b0\u7b7e\u53d1 \u2192 \u66ff\u6362\u6587\u4ef6 \u2192 \u91cd\u8f7d\u670d\u52a1\n  \u00b7 \u68c0\u67e5\u8bc1\u4e66\u81ea\u52a8\u7eed\u7b7e cron \u662f\u5426\u751f\u6548\n\n\u9884\u9632\uff1a\n  \u00b7 \u76d1\u63a7\u8bc1\u4e66\u5269\u4f59\u5929\u6570\uff08<30 \u5929\u544a\u8b66\uff09\n  \u00b7 \u81ea\u52a8\u5316\u7eed\u7b7e + \u91cd\u8f7d<\/code><\/pre>\n\n\n\n
      \u573a\u666f 2\uff1a\u8bc1\u4e66\u57df\u540d\u4e0d\u5339\u914d<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\"NET::ERR_CERT_COMMON_NAME_INVALID\"\n\n\u539f\u56e0\uff1a\n  \u00b7 \u8bc1\u4e66\u53ea\u7b7e\u4e86 example.com\uff0c\u7528\u6237\u8bbf\u95ee www.example.com\n  \u00b7 \u8bc1\u4e66 SAN \u5217\u8868\u91cc\u6ca1\u6709\u7528\u6237\u8bbf\u95ee\u7684\u57df\u540d\n\n\u9a8c\u8bc1\uff1a\n  openssl x509 -in cert.pem -ext subjectAltName -noout\n\n\u4fee\u590d\uff1a\n  \u00b7 \u91cd\u65b0\u7533\u8bf7\u5305\u542b\u6b63\u786e\u57df\u540d\u7684\u8bc1\u4e66\n  \u00b7 \u786e\u4fdd SAN \u8986\u76d6\u6240\u6709\u8bbf\u95ee\u5165\u53e3\uff08\u542b www\u3001api\u3001\u88f8\u57df\uff09<\/code><\/pre>\n\n\n\n
      \u573a\u666f 3\uff1a\u4e2d\u95f4\u8bc1\u4e66\u7f3a\u5931<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\u90e8\u5206\u5ba2\u6237\u7aef\u62a5\u4e0d\u4fe1\u4efb\uff0c\u90e8\u5206\u6b63\u5e38\n      \uff08\u8001 Android \/ iOS \/ Java \u5ba2\u6237\u7aef\uff09\n\n\u9a8c\u8bc1\uff1a\n  openssl s_client -connect example.com:443 -showcerts\n  # \u53ea\u770b\u5230\u4e00\u5f20\u8bc1\u4e66 = \u7f3a\u4e2d\u95f4 CA\n\n\u4fee\u590d\uff1a\n  cat leaf.crt intermediate.crt > fullchain.pem\n  \u91cd\u65b0\u52a0\u8f7d Web \u670d\u52a1<\/code><\/pre>\n\n\n\n
      \u573a\u666f 4\uff1aTLS \u7248\u672c \/ \u5bc6\u7801\u5957\u4ef6\u4e0d\u517c\u5bb9<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\u8001\u8bbe\u5907\/\u8001\u7cfb\u7edf\u62a5 \"ERR_SSL_VERSION_OR_CIPHER_MISMATCH\"\n\n\u6392\u67e5\uff1a\n  nmap --script ssl-enum-ciphers -p 443 example.com\n\n\u539f\u56e0\uff1a\n  \u670d\u52a1\u7aef\u53ea\u5f00 TLS 1.2+\uff0c\u5ba2\u6237\u7aef\u53ea\u652f\u6301 TLS 1.0\n  \u6216\u5bc6\u7801\u5957\u4ef6\u65e0\u4ea4\u96c6\n\n\u4fee\u590d\uff08\u5e73\u8861\u5b89\u5168\u4e0e\u517c\u5bb9\uff09\uff1a\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;\n  ssl_prefer_server_ciphers off;<\/code><\/pre>\n\n\n\n
      \u573a\u666f 5\uff1a\u6df7\u5408\u5185\u5bb9\uff08Mixed Content\uff09<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\u9875\u9762\u52a0\u8f7d\u4e86\u4f46\u6d4f\u89c8\u5668\u5730\u5740\u680f\u663e\u793a\"\u4e0d\u5b89\u5168\"\u6216\u9501\u56fe\u6807\u5e26\u8b66\u544a\n\n\u539f\u56e0\uff1aHTTPS \u9875\u9762\u91cc\u5f15\u7528\u4e86 HTTP \u8d44\u6e90\uff08\u56fe\u7247\u3001JS\u3001CSS\uff09\n\n\u6392\u67e5\uff1a\u6d4f\u89c8\u5668 F12 \u2192 Console \u2192 Mixed Content \u8b66\u544a\n\n\u4fee\u590d\uff1a\n  \u00b7 \u8d44\u6e90\u6539\u7528 HTTPS\n  \u00b7 \u6216\u52a0\u54cd\u5e94\u5934\uff1aContent-Security-Policy: upgrade-insecure-requests\n  \u00b7 \u6216 meta \u6807\u7b7e\uff1a<meta http-equiv=\"Content-Security-Policy\" content=\"upgrade-insecure-requests\"><\/code><\/pre>\n\n\n\n
      \u573a\u666f 6\uff1aHSTS \u5bfc\u81f4\u65e7 IP \u65e0\u6cd5\u8bbf\u95ee<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\u4e4b\u524d\u80fd\u8bbf\u95ee\uff0c\u540e\u6765\u6362\u4e86 IP\/\u670d\u52a1\u5668\uff0c\u6d4f\u89c8\u5668\u76f4\u63a5\u62d2\u7edd\u8fde\u63a5\n      \"ERR_CONNECTION_REFUSED\" \u4e14\u65e0\u6cd5\u8df3\u8fc7\n\n\u539f\u56e0\uff1a\u4e4b\u524d\u670d\u52a1\u7aef\u8bbe\u4e86 HSTS\uff0c\u6d4f\u89c8\u5668\u8bb0\u4f4f\u4e86\"\u8fd9\u4e2a\u57df\u540d\u53ea\u8d70 HTTPS\"\n      \u65b0\u670d\u52a1\u5668\u8bc1\u4e66\u8fd8\u6ca1\u914d\u597d\uff0c\u6d4f\u89c8\u5668\u62d2\u7edd\u964d\u7ea7\n\n\u6392\u67e5\uff1a\n  curl -I https:\/\/example.com \u770b Strict-Transport-Security \u5934\n\n\u4fee\u590d\uff1a\n  \u00b7 \u65b0\u670d\u52a1\u5668\u5148\u914d\u597d\u6709\u6548\u8bc1\u4e66\u518d\u5207\u6362 DNS\n  \u00b7 \u6216\u6e05\u9664\u6d4f\u89c8\u5668 HSTS \u7f13\u5b58\uff08chrome:\/\/net-internals\/#hsts\uff09<\/code><\/pre>\n\n\n\n
      \u573a\u666f 7\uff1aOCSP \u88c5\u8ba2\u5931\u8d25\u5bfc\u81f4\u9996\u6b21\u8bbf\u95ee\u6162<\/p>\n\n\n\n
      \u75c7\u72b6\uff1a\u9996\u6b21\u8bbf\u95ee\u6162\uff083-5 \u79d2\uff09\uff0c\u5237\u65b0\u540e\u6b63\u5e38\n\n\u539f\u56e0\uff1a\u5ba2\u6237\u7aef\u5728 TLS \u63e1\u624b\u65f6\u53bb CA \u9a8c\u8bc1\u8bc1\u4e66\u540a\u9500\u72b6\u6001\uff08OCSP\uff09\n      CA \u7684 OCSP \u54cd\u5e94\u6162\u6216\u4e0d\u53ef\u8fbe\n\n\u4fee\u590d\uff1a\n  ssl_stapling on;\n  ssl_stapling_verify on;\n  ssl_trusted_certificate \/path\/to\/fullchain.pem;\n  resolver 8.8.8.8 1.1.1.1 valid=300s;<\/code><\/pre>\n\n\n\n
      \u516b\u3001TLS \u6027\u80fd\u4f18\u5316<\/mark><\/strong><\/p>\n\n\n\n
      \u4f18\u5316\u9879<\/strong><\/th>\u4f5c\u7528<\/strong><\/th>\u914d\u7f6e\u793a\u4f8b\uff08Nginx\uff09<\/strong><\/th><\/tr><\/thead>
      TLS 1.3<\/strong>\u200b<\/td>1-RTT \u63e1\u624b\uff0c\u66f4\u5feb<\/td>ssl_protocols TLSv1.2 TLSv1.3;<\/code><\/td><\/tr>
      \u4f1a\u8bdd\u590d\u7528<\/strong>\u200b<\/td>\u907f\u514d\u91cd\u590d\u63e1\u624b<\/td>ssl_session_cache shared:SSL:10m;<\/code><\/td><\/tr>
      \u4f1a\u8bdd\u7968\u636e<\/strong>\u200b<\/td>\u65e0\u72b6\u6001\u4f1a\u8bdd\u6062\u590d<\/td>ssl_session_tickets on;<\/code><\/td><\/tr>
      OCSP Stapling<\/strong>\u200b<\/td>\u907f\u514d\u5ba2\u6237\u7aef\u53bb CA \u9a8c\u8bc1<\/td>ssl_stapling on;<\/code><\/td><\/tr>
      HSTS<\/strong>\u200b<\/td>\u5f3a\u5236 HTTPS\uff0c\u51cf\u5c11\u91cd\u5b9a\u5411<\/td>add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;<\/code><\/td><\/tr>
      \u8bc1\u4e66\u9009\u62e9<\/strong>\u200b<\/td>ECDSA \u6bd4 RSA \u8ba1\u7b97\u91cf\u5c0f<\/td>\u7528 ECDSA \u8bc1\u4e66\uff08P-256 \u6216 Ed25519\uff09<\/td><\/tr>
      \u786c\u4ef6\u52a0\u901f<\/strong>\u200b<\/td>\u5378\u8f7d\u52a0\u5bc6\u8ba1\u7b97<\/td>ssl_engine<\/code> + \u652f\u6301 AES-NI \u7684 CPU<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"
      \u4e00\u3001TLS \u5728\u534f\u8bae\u6808\u4e2d\u7684\u4f4d\u7f6e TLS \u4e0d\u662f\u66ff\u4ee3 TCP\uff0c\u800c\u662f\u63d2\u5728 TCP \u548c\u5e94\u7528\u5c42\u4e4b\u95f4\u7684\u52a0\u5bc6\u5c42\uff1a HTTPS  […]<\/p>\n","protected":false},"author":3,"featured_media":21450,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-21445","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/comments?post=21445"}],"version-history":[{"count":14,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21445\/revisions"}],"predecessor-version":[{"id":21467,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/21445\/revisions\/21467"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media\/21450"}],"wp:attachment":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media?parent=21445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/categories?post=21445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/tags?post=21445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}