Kā iespējot TLS 1.3 Nginx operētājsistēmā Fedora 29

Ievads

TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors.

This guide will demonstrate how to enable TLS 1.3 using the Nginx web server on Fedora 29.

Requirements

• Nginx version 1.13.0 or greater.
• OpenSSL version 1.1.1 or greater.
• Vultr Cloud Compute (VC2) instance running Fedora 29.
• A valid domain name and properly configured A/AAAA/CNAME DNS records for your domain.
• A valid TLS certificate. We will get one from Let's Encrypt.

Before you begin

Check the Fedora version.

cat /etc/fedora-release
# Fedora release 29 (Twenty Nine)

Create a new non-root user account with sudo access and switch to it.

useradd -c "John Doe" johndoe && passwd johndoe
usermod -aG wheel johndoe
su - johndoe

NOTE: Replace johndoe with your username.

Set up the timezone.

timedatectl list-timezones
sudo timedatectl set-timezone 'Region/City'

Ensure that your system is up to date.

sudo dnf check-upgrade || sudo dnf upgrade -y

Install the needed packages.

sudo dnf install -y socat git

Disable SELinux and Firewall.

sudo setenforce 0 ; sudo systemctl stop firewalld ; sudo systemctl disable firewalld

Install Acme.sh client and obtain TLS certificate from Let's Encrypt

In this guide, we will use Acme.sh client to obtain SSL certificates from Let's Encrypt. You can use a client you are most familiar with.

Download and install Acme.sh.

sudo mkdir /etc/letsencrypt
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh 
sudo ./acme.sh --install --home /etc/letsencrypt --accountemail your_email@example.com
cd ~

Check the version.

/etc/letsencrypt/acme.sh --version
# v2.8.1

Obtain RSA and ECDSA certificates for your domain.

# RSA 2048
sudo /etc/letsencrypt/acme.sh --issue --standalone --home /etc/letsencrypt -d example.com --ocsp-must-staple --keylength 2048
# ECDSA
sudo /etc/letsencrypt/acme.sh --issue --standalone --home /etc/letsencrypt -d example.com --ocsp-must-staple --keylength ec-256

NOTE: Replace example.com in the commands with your domain name.

After running the previous commands, your certificates and keys will be accessible at:

• RSA: /etc/letsencrypt/example.com.
• ECC/ECDSA: /etc/letsencrypt/example.com_ecc.

Install Nginx

Nginx pievienoja atbalstu TLS 1.3 versijā 1.13.0. Fedora 29 ir aprīkots ar Nginx un OpenSSL, kas atbalsta TLS 1.3, tāpēc nav nepieciešams izveidot pielāgotu versiju.

Instalējiet Nginx.

sudo dnf install -y nginx

Pārbaudiet versiju.

nginx -v
# nginx version: nginx/1.14.2

Pārbaudiet OpenSSL versiju, pret kuru tika kompilēts Nginx.

nginx -V
# built with OpenSSL 1.1.1b FIPS  26 Feb 2019

Sāciet un iespējojiet Nginx.

sudo systemctl start nginx.service
sudo systemctl enable nginx.service

Konfigurējiet Nginx

Tagad, kad esam veiksmīgi instalējuši Nginx, esam gatavi to konfigurēt ar atbilstošu konfigurāciju, lai savā serverī sāktu lietot TLS 1.3.

Palaidiet sudo vim /etc/nginx/conf.d/example.com.confkomandu un aizpildiet failu ar šādu konfigurāciju.

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name example.com;

  # RSA
  ssl_certificate /etc/letsencrypt/example.com/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/example.com/example.com.key;
  # ECDSA
  ssl_certificate /etc/letsencrypt/example.com_ecc/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/example.com_ecc/example.com.key;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_prefer_server_ciphers on;
}

Saglabājiet failu un izeju ar :+ W+ Q.

Ievērojiet jauno direktīvas TLSv1.3parametru ssl_protocols. Šis parametrs ir nepieciešams tikai, lai Nginx iespējotu TLS 1.3.

Pārbaudiet konfigurāciju.

sudo nginx -t

Pārlādēt Nginx.

sudo systemctl reload nginx.service

Lai verificētu TLS 1.3, varat izmantot pārlūkprogrammas izstrādātāju rīkus vai SSL Labs pakalpojumu. Tālāk redzamajos ekrānuzņēmumos ir redzama Chrome drošības cilne.

Tas ir viss. Jūs esat veiksmīgi iespējojis TLS 1.3 programmā Nginx savā Fedora 29 serverī. TLS 1.3 galīgā versija tika noteikta 2018. gada augustā, tāpēc nav labāka laika, lai sāktu ieviest šo jauno tehnoloģiju.