582 lines
14 KiB
Markdown
582 lines
14 KiB
Markdown
# 当前SSL配置文档
|
||
|
||
**生成时间：** 2025年1月28日
|
||
**服务器IP：** 101.43.95.130
|
||
**域名：** www.ruilaizipj.com
|
||
|
||
---
|
||
|
||
## 一、配置完成状态
|
||
|
||
### ✅ 已完成的操作
|
||
|
||
1. ✅ **停止并禁用系统nginx**
|
||
- 系统nginx服务已停止
|
||
- 已禁用开机自启动
|
||
|
||
2. ✅ **生成宝塔面板SSL证书**
|
||
- 用于面板自身的HTTPS访问
|
||
- 证书已生成并配置
|
||
|
||
3. ✅ **启动宝塔nginx**
|
||
- 宝塔nginx服务正常运行
|
||
- 主进程：`/www/server/nginx/sbin/nginx`
|
||
|
||
4. ✅ **端口监听状态**
|
||
- 80端口：正常监听
|
||
- 443端口：正常监听
|
||
|
||
5. ✅ **HTTP和HTTPS访问**
|
||
- HTTP访问：正常（返回200 OK）
|
||
- HTTPS访问：正常（返回200 OK）
|
||
|
||
---
|
||
|
||
## 二、当前运行状态
|
||
|
||
### Web服务器状态
|
||
|
||
| 项目 | 状态 | 说明 |
|
||
|------|------|------|
|
||
| **系统nginx** | ❌ 已停止并禁用 | 不再使用 |
|
||
| **宝塔nginx** | ✅ 正在运行 | 主进程：`/www/server/nginx/sbin/nginx` |
|
||
| **80端口** | ✅ 正常监听 | HTTP访问 |
|
||
| **443端口** | ✅ 正常监听 | HTTPS访问 |
|
||
|
||
### Nginx版本信息
|
||
|
||
```
|
||
nginx version: nginx/1.20.2
|
||
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
|
||
built with OpenSSL 1.0.2k-fips 26 Jan 2017
|
||
```
|
||
|
||
---
|
||
|
||
## 三、网站SSL证书配置
|
||
|
||
### 证书基本信息
|
||
|
||
| 配置项 | 值 |
|
||
|--------|-----|
|
||
| **证书域名** | www.ruilaizipj.com |
|
||
| **颁发机构** | TrustAsia DV TLS RSA CA 2025 |
|
||
| **证书类型** | DV SSL证书（域名验证型） |
|
||
| **有效期开始** | 2026-01-28 00:00:00 GMT |
|
||
| **有效期结束** | 2026-04-27 23:59:59 GMT |
|
||
| **有效期** | 90天 |
|
||
| **SHA1指纹** | 0C:24:BC:99:DB:D2:94:13:C8:85:BD:CC:3E:DB:C8:B5:EA:F5:26:D6 |
|
||
|
||
### 证书文件位置
|
||
|
||
**证书文件路径：**
|
||
```
|
||
/www/server/panel/vhost/cert/101.43.95.130/fullchain.pem
|
||
```
|
||
|
||
**私钥文件路径：**
|
||
```
|
||
/www/server/panel/vhost/cert/101.43.95.130/privkey.pem
|
||
```
|
||
|
||
### 证书文件详情
|
||
|
||
| 文件 | 大小 | 权限 | 修改时间 |
|
||
|------|------|------|----------|
|
||
| `fullchain.pem` | 4.4KB | 600 (rw-------) | 2026-01-28 12:42 |
|
||
| `privkey.pem` | 1.7KB | 600 (rw-------) | 2026-01-28 12:42 |
|
||
| `www.ruilaizipj.com_bundle.crt` | 4.4KB | 600 (rw-------) | 2026-01-28 12:11 |
|
||
| `www.ruilaizipj.com.key` | 1.7KB | 600 (rw-------) | 2026-01-28 12:11 |
|
||
|
||
**说明：**
|
||
- `fullchain.pem` 和 `privkey.pem` 为当前使用的证书文件
|
||
- `www.ruilaizipj.com_bundle.crt` 和 `www.ruilaizipj.com.key` 为备份文件
|
||
|
||
### Nginx SSL配置
|
||
|
||
**配置文件位置：**
|
||
```
|
||
/www/server/panel/vhost/nginx/101.43.95.130.conf
|
||
```
|
||
|
||
**SSL配置内容：**
|
||
```nginx
|
||
listen 443 ssl http2 default_server;
|
||
server_name www.ruilaizipj.com 101.43.95.130;
|
||
|
||
ssl_certificate /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem;
|
||
ssl_certificate_key /www/server/panel/vhost/cert/101.43.95.130/privkey.pem;
|
||
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
||
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 10m;
|
||
add_header Strict-Transport-Security "max-age=31536000";
|
||
error_page 497 https://$host$request_uri;
|
||
```
|
||
|
||
**SSL配置说明：**
|
||
- **SSL协议版本：** TLSv1.1, TLSv1.2, TLSv1.3
|
||
- **SSL加密套件：** 支持多种加密算法
|
||
- **会话缓存：** 10MB共享缓存
|
||
- **会话超时：** 10分钟
|
||
- **HSTS：** 已启用，最大有效期31536000秒（1年）
|
||
- **HTTP到HTTPS重定向：** 已启用（497错误页）
|
||
|
||
---
|
||
|
||
## 四、宝塔面板SSL证书配置
|
||
|
||
### 面板证书基本信息
|
||
|
||
| 配置项 | 值 |
|
||
|--------|-----|
|
||
| **证书域名** | localhost |
|
||
| **颁发机构** | localhost（自签名证书） |
|
||
| **有效期开始** | 2026-01-28 04:54:31 GMT |
|
||
| **有效期结束** | 2027-01-28 04:54:31 GMT |
|
||
| **有效期** | 1年 |
|
||
|
||
### 面板证书文件位置
|
||
|
||
**证书文件路径：**
|
||
```
|
||
/www/server/panel/ssl/certificate.pem
|
||
```
|
||
|
||
**私钥文件路径：**
|
||
```
|
||
/www/server/panel/ssl/privateKey.pem
|
||
```
|
||
|
||
### 面板证书文件详情
|
||
|
||
| 文件 | 大小 | 权限 | 修改时间 |
|
||
|------|------|------|----------|
|
||
| `certificate.pem` | 1.1KB | 644 (rw-r--r--) | 2026-01-28 12:54 |
|
||
| `privateKey.pem` | 1.7KB | 644 (rw-r--r--) | 2026-01-28 12:54 |
|
||
|
||
### 面板配置信息
|
||
|
||
| 配置项 | 值 |
|
||
|--------|-----|
|
||
| **SSL启用状态** | True（已启用） |
|
||
| **面板端口** | 38193 |
|
||
| **面板路径** | /e626af3f |
|
||
| **访问地址** | https://101.43.95.130:38193/e626af3f |
|
||
|
||
---
|
||
|
||
## 五、访问测试结果
|
||
|
||
### HTTP访问测试
|
||
|
||
**测试地址：** `http://101.43.95.130`
|
||
|
||
**测试结果：**
|
||
```
|
||
HTTP/1.1 200 OK
|
||
Server: nginx
|
||
Content-Type: text/html; charset=utf-8
|
||
Connection: keep-alive
|
||
```
|
||
|
||
✅ **状态：正常**
|
||
|
||
### HTTPS访问测试
|
||
|
||
**测试地址1：** `https://101.43.95.130`
|
||
|
||
**测试结果：**
|
||
```
|
||
HTTP/1.1 200 OK
|
||
Server: nginx
|
||
Content-Type: text/html; charset=utf-8
|
||
Connection: keep-alive
|
||
Strict-Transport-Security: max-age=31536000
|
||
```
|
||
|
||
✅ **状态：正常**
|
||
|
||
**测试地址2：** `https://www.ruilaizipj.com`
|
||
|
||
**测试结果：**
|
||
```
|
||
HTTP/1.1 200 OK
|
||
Server: nginx
|
||
Content-Type: text/html; charset=utf-8
|
||
Connection: keep-alive
|
||
Strict-Transport-Security: max-age=31536000
|
||
```
|
||
|
||
✅ **状态：正常**
|
||
|
||
### 证书验证测试
|
||
|
||
**证书域名验证：**
|
||
- ✅ `www.ruilaizipj.com` - 证书匹配
|
||
- ✅ `ruilaizipj.com` - 证书包含（SAN扩展）
|
||
|
||
**证书链验证：**
|
||
- ✅ 证书链完整
|
||
- ✅ 颁发机构：TrustAsia DV TLS RSA CA 2025
|
||
|
||
---
|
||
|
||
## 六、端口监听状态
|
||
|
||
### 当前监听的端口
|
||
|
||
| 端口 | 协议 | 状态 | 进程 |
|
||
|------|------|------|------|
|
||
| **80** | TCP | ✅ 监听 | nginx: master |
|
||
| **443** | TCP | ✅ 监听 | nginx: master |
|
||
|
||
### 安全组配置
|
||
|
||
**已开放的端口：**
|
||
- ✅ 80端口（HTTP）
|
||
- ✅ 443端口（HTTPS）
|
||
|
||
**安全组规则：**
|
||
- 协议：TCP
|
||
- 端口：443
|
||
- 源：全部IPv4地址
|
||
- 动作：允许
|
||
|
||
---
|
||
|
||
## 七、SSL配置详细参数
|
||
|
||
### SSL协议配置
|
||
|
||
```nginx
|
||
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
||
```
|
||
|
||
**支持的协议版本：**
|
||
- TLS 1.1（已启用，但建议禁用）
|
||
- TLS 1.2（推荐）
|
||
- TLS 1.3（最新，推荐）
|
||
|
||
### SSL加密套件
|
||
|
||
```nginx
|
||
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
||
```
|
||
|
||
**支持的加密算法：**
|
||
- ECDH + CHACHA20
|
||
- ECDH + AES128
|
||
- RSA + AES128
|
||
- ECDH + AES256
|
||
- RSA + AES256
|
||
- ECDH + 3DES
|
||
- RSA + 3DES
|
||
- 禁用：MD5
|
||
|
||
### SSL会话配置
|
||
|
||
```nginx
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 10m;
|
||
```
|
||
|
||
- **会话缓存：** 10MB共享内存
|
||
- **会话超时：** 10分钟
|
||
|
||
### HSTS配置
|
||
|
||
```nginx
|
||
add_header Strict-Transport-Security "max-age=31536000";
|
||
```
|
||
|
||
- **HSTS：** 已启用
|
||
- **最大有效期：** 31536000秒（1年）
|
||
- **作用：** 强制浏览器使用HTTPS访问
|
||
|
||
---
|
||
|
||
## 八、证书续期提醒
|
||
|
||
### 网站SSL证书
|
||
|
||
- **当前有效期：** 2026-01-28 至 2026-04-27
|
||
- **剩余天数：** 约90天
|
||
- **续期建议：** 到期前30天续期
|
||
|
||
### 续期步骤
|
||
|
||
1. **在腾讯云重新申请证书**
|
||
- 访问：https://console.cloud.tencent.com/ssl
|
||
- 申请新的免费证书
|
||
|
||
2. **下载新证书**
|
||
- 选择"Nginx"格式
|
||
- 下载证书文件
|
||
|
||
3. **替换证书文件**
|
||
```bash
|
||
# 备份旧证书
|
||
cp /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem.bak
|
||
cp /www/server/panel/vhost/cert/101.43.95.130/privkey.pem /www/server/panel/vhost/cert/101.43.95.130/privkey.pem.bak
|
||
|
||
# 替换新证书
|
||
cp 新证书_bundle.crt /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem
|
||
cp 新证书.key /www/server/panel/vhost/cert/101.43.95.130/privkey.pem
|
||
|
||
# 重载nginx
|
||
nginx -s reload
|
||
```
|
||
|
||
---
|
||
|
||
## 九、配置文件位置汇总
|
||
|
||
### Nginx配置文件
|
||
|
||
| 文件 | 路径 |
|
||
|------|------|
|
||
| **主配置文件** | `/www/server/nginx/conf/nginx.conf` |
|
||
| **网站配置** | `/www/server/panel/vhost/nginx/101.43.95.130.conf` |
|
||
| **重写规则** | `/www/server/panel/vhost/rewrite/101.43.95.130.conf` |
|
||
|
||
### SSL证书文件
|
||
|
||
| 文件类型 | 路径 |
|
||
|---------|------|
|
||
| **网站证书** | `/www/server/panel/vhost/cert/101.43.95.130/fullchain.pem` |
|
||
| **网站私钥** | `/www/server/panel/vhost/cert/101.43.95.130/privkey.pem` |
|
||
| **面板证书** | `/www/server/panel/ssl/certificate.pem` |
|
||
| **面板私钥** | `/www/server/panel/ssl/privateKey.pem` |
|
||
|
||
### 日志文件
|
||
|
||
| 日志类型 | 路径 |
|
||
|---------|------|
|
||
| **访问日志** | `/www/wwwlogs/101.43.95.130.log` |
|
||
| **错误日志** | `/www/wwwlogs/101.43.95.130.error.log` |
|
||
| **Nginx错误日志** | `/var/log/nginx/error.log` |
|
||
|
||
---
|
||
|
||
## 十、常用命令
|
||
|
||
### 检查SSL证书
|
||
|
||
```bash
|
||
# 查看网站证书信息
|
||
openssl x509 -in /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem -noout -subject -issuer -dates
|
||
|
||
# 查看面板证书信息
|
||
openssl x509 -in /www/server/panel/ssl/certificate.pem -noout -subject -issuer -dates
|
||
|
||
# 验证证书和私钥是否匹配
|
||
openssl x509 -noout -modulus -in /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem | openssl md5
|
||
openssl rsa -noout -modulus -in /www/server/panel/vhost/cert/101.43.95.130/privkey.pem | openssl md5
|
||
```
|
||
|
||
### Nginx管理命令
|
||
|
||
```bash
|
||
# 测试nginx配置
|
||
nginx -t
|
||
|
||
# 重载nginx配置（不中断服务）
|
||
nginx -s reload
|
||
|
||
# 重启nginx
|
||
systemctl restart nginx
|
||
# 或
|
||
/etc/init.d/nginx restart
|
||
```
|
||
|
||
### 端口检查
|
||
|
||
```bash
|
||
# 检查端口监听状态
|
||
netstat -tlnp | grep -E ":80|:443"
|
||
|
||
# 检查SSL连接
|
||
openssl s_client -connect 101.43.95.130:443 -servername www.ruilaizipj.com
|
||
```
|
||
|
||
---
|
||
|
||
## 十一、安全建议
|
||
|
||
### 当前配置安全等级
|
||
|
||
| 安全项 | 状态 | 建议 |
|
||
|--------|------|------|
|
||
| **HTTPS启用** | ✅ 已启用 | 保持 |
|
||
| **HSTS** | ✅ 已启用 | 保持 |
|
||
| **TLS 1.3** | ✅ 已支持 | 保持 |
|
||
| **TLS 1.1** | ⚠️ 已启用 | 建议禁用（安全性较低） |
|
||
| **证书有效期** | ⚠️ 90天 | 建议到期前续期 |
|
||
|
||
### 安全优化建议
|
||
|
||
1. **禁用TLS 1.1**
|
||
```nginx
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
```
|
||
|
||
2. **启用OCSP Stapling**（可选）
|
||
```nginx
|
||
ssl_stapling on;
|
||
ssl_stapling_verify on;
|
||
ssl_trusted_certificate /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem;
|
||
```
|
||
|
||
3. **定期检查证书有效期**
|
||
- 设置提醒，到期前30天续期
|
||
|
||
---
|
||
|
||
## 十二、故障排查
|
||
|
||
### 常见问题
|
||
|
||
#### 1. HTTPS无法访问
|
||
|
||
**检查步骤：**
|
||
```bash
|
||
# 1. 检查443端口是否监听
|
||
netstat -tlnp | grep :443
|
||
|
||
# 2. 检查nginx是否运行
|
||
ps aux | grep nginx
|
||
|
||
# 3. 检查证书文件是否存在
|
||
ls -la /www/server/panel/vhost/cert/101.43.95.130/
|
||
|
||
# 4. 检查nginx配置
|
||
nginx -t
|
||
|
||
# 5. 检查安全组
|
||
# 登录腾讯云控制台，检查安全组443端口是否开放
|
||
```
|
||
|
||
#### 2. 证书过期
|
||
|
||
**解决方法：**
|
||
- 按照"证书续期步骤"重新申请并部署证书
|
||
|
||
#### 3. 证书不匹配
|
||
|
||
**检查方法：**
|
||
```bash
|
||
# 验证证书域名
|
||
openssl x509 -in /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem -noout -text | grep DNS
|
||
```
|
||
|
||
---
|
||
|
||
## 十三、配置总结
|
||
|
||
### ✅ 配置完成情况
|
||
|
||
| 配置项 | 状态 | 说明 |
|
||
|--------|------|------|
|
||
| **系统nginx** | ✅ 已停止 | 不再使用 |
|
||
| **宝塔nginx** | ✅ 正常运行 | 主进程运行中 |
|
||
| **网站SSL证书** | ✅ 已配置 | 有效期至2026-04-27 |
|
||
| **面板SSL证书** | ✅ 已生成 | 有效期至2027-01-28 |
|
||
| **80端口** | ✅ 正常监听 | HTTP访问正常 |
|
||
| **443端口** | ✅ 正常监听 | HTTPS访问正常 |
|
||
| **HTTP访问** | ✅ 正常 | 返回200 OK |
|
||
| **HTTPS访问** | ✅ 正常 | 返回200 OK |
|
||
| **HSTS** | ✅ 已启用 | 强制HTTPS |
|
||
| **安全组** | ✅ 已配置 | 443端口已开放 |
|
||
|
||
### 📋 访问地址
|
||
|
||
| 访问方式 | 地址 | 状态 |
|
||
|---------|------|------|
|
||
| **HTTP（IP）** | http://101.43.95.130 | ✅ 正常 |
|
||
| **HTTPS（IP）** | https://101.43.95.130 | ✅ 正常 |
|
||
| **HTTPS（域名）** | https://www.ruilaizipj.com | ✅ 正常 |
|
||
| **后台登录** | https://www.ruilaizipj.com/adminghd/login | ✅ 正常 |
|
||
|
||
---
|
||
|
||
## 十四、维护计划
|
||
|
||
### 定期检查项
|
||
|
||
1. **每周检查**
|
||
- 检查nginx服务状态
|
||
- 检查端口监听状态
|
||
|
||
2. **每月检查**
|
||
- 检查证书有效期
|
||
- 检查SSL配置
|
||
|
||
3. **到期前30天**
|
||
- 申请新证书
|
||
- 部署新证书
|
||
- 测试HTTPS访问
|
||
|
||
---
|
||
|
||
**文档生成时间：** 2025年1月28日
|
||
**服务器IP：** 101.43.95.130
|
||
**域名：** www.ruilaizipj.com
|
||
**配置人员：** AI助手
|
||
|
||
---
|
||
|
||
## 附录：完整Nginx SSL配置
|
||
|
||
```nginx
|
||
server
|
||
{
|
||
listen 80 default_server;
|
||
listen 443 ssl http2 default_server;
|
||
server_name www.ruilaizipj.com 101.43.95.130;
|
||
index index.php index.html index.htm default.php default.htm default.html;
|
||
root /www/wwwroot/code/public;
|
||
|
||
#SSL-START SSL相关配置
|
||
ssl_certificate /www/server/panel/vhost/cert/101.43.95.130/fullchain.pem;
|
||
ssl_certificate_key /www/server/panel/vhost/cert/101.43.95.130/privkey.pem;
|
||
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
||
ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 10m;
|
||
add_header Strict-Transport-Security "max-age=31536000";
|
||
error_page 497 https://$host$request_uri;
|
||
#SSL-END
|
||
|
||
#PHP配置
|
||
include enable-php-56.conf;
|
||
|
||
#URL重写规则
|
||
include /www/server/panel/vhost/rewrite/101.43.95.130.conf;
|
||
|
||
#静态资源缓存
|
||
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
|
||
{
|
||
expires 30d;
|
||
error_log /dev/null;
|
||
access_log /dev/null;
|
||
}
|
||
|
||
location ~ .*\.(js|css)?$
|
||
{
|
||
expires 12h;
|
||
error_log /dev/null;
|
||
access_log /dev/null;
|
||
}
|
||
|
||
access_log /www/wwwlogs/101.43.95.130.log;
|
||
error_log /www/wwwlogs/101.43.95.130.error.log;
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
**文档结束**
|