前言
HTTPS 即将在 2017 年获得广泛的普及和支持,这里介绍一下 Apache Httpd 设置 HTTPS 并开启 HTTP/2 (以下会简称 h2)的教程。
不过呢,在目前的条件下,个人还是建议一些强 Apache Httpd 的环境例如 LAMP 可以考虑前面加一层 Nginx,来更灵活的实现 HTTPS + HTTP/2 的新特性,例如目前 Apache Httpd 对 CHACHA20-POLY1305 的算法弄起来就灵活。
准备
apt-get install apache2 openssl
add-apt-repository ppa:ondrej/apache2apt-get updateapt-get install apache2 openssl
dnf install httpd openssl
a2enmod http2 # 启用 mod_http2 模块
service httpd restart # RHEL、CentOS、Fedora
service apache2 restart # Debian、Ubuntu
apt-get installl nghttp2 libnghttp2-dev openssl #Debian、Ubuntu
未来或许可以用
yum install nghttp2 libnghttp2-dev openssl #RHEL、CentOS
wget https://www.openssl.org/source/openssl-1.1.0c.tar.gz
tar xzf openssl-1.1.0c.tar.gz
cd openssl-1.1.0c
./config --prefix=/usr/local/openssl
make && make install
wget https://github.com/nghttp2/nghttp2/releases/download/v1.17.0/nghttp2-1.17.0.tar.gz
tar xzf nghttp2-1.17.0.tar.gz
cd nghttp2-1.17.0
./configure --prefix=/usr/local/nghttp2
make && make install
–enable-http2
--enable-ssl
–with-nghttp2=/usr/local/nghttp2
--with-ssl=/usr/local/openssl
ProtocolsHonorOrder On
Protocols h2 h2c http/1.1
<VirtualHost *:443>
...
SSLEngine on
SSLCertificateFile /path/to/crt
SSLCertificateKeyFile /path/to/key
SSLCACertificateFile /path/to/ca_certs_for_client_authentication
ProtocolsHonorOrder On
Protocols h2 h2c http/1.1
# HSTS
Header always set Strict-Transport-Security "max-age=15768000"
# modern configuration, tweak to your needs
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM- SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA- AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE- RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off
# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/var/run/ocsp(128000)
...
</VirtualHost>
版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。