VPS侦探论坛

 找回密码
 注册
查看: 4445|回复: 2

[Apache] 关于NGINX配置HTTP/2的问题

[复制链接]
发表于 2016-11-6 22:36:16 | 显示全部楼层 |阅读模式

因为使用TLS,决定升级一下H2,整了一个多点没什么头绪,访问仍然是HTTP/1.1配置文件
  1. server
  2.     {
  3.         listen 443 ssl http2;
  4.         listen [::]:443 ssl http2;
  5.         ssl on;
  6.         ssl_certificate ***;
  7.         ssl_certificate_key ***;
  8. ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_session_cache shared:SSL:10m;ssl_stapling on;ssl_stapling_verify on;resolver 114.114.114.114 114.114.115.115 valid=300s;resolver_timeout 10s;ssl_prefer_server_ciphers on;ssl_dhparam /etc/ssl/certs/dhparam.pem;        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
  9.         add_header X-Frame-Options SAMEORIGIN;
  10.         server_name ciel.pro;
  11.         index index.html index.htm index.php default.html default.htm default.php;
  12.         root  /home/wwwroot/ciel.pro;

  13.         include wordpress.conf;
  14.         #error_page   404   /404.html;
  15.         location ~ [^/]\.php(/|$)
  16.         {
  17.                 #comment try_files $uri =404; to enable pathinfo
  18.                 try_files $uri =404;
  19.                 fastcgi_pass  unix:/tmp/php-cgi.sock;
  20.                 fastcgi_index index.php;
  21.                 include fastcgi.conf;
  22.                 #include pathinfo.conf;
  23.         }
  24.         location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|woff)$
  25.         {
  26.                 expires      30d;
  27.         }

  28.         location ~ .*\.(js|css)?$
  29.         {
  30.                 expires      12h;
  31.         }

  32. location ~ /\.
  33.         {
  34.             deny all;
  35.         }

  36.         access_log  /home/wwwlogs/ciel.pro.log;
  37.     }
  38. server
  39.     {
  40.         listen 443 ssl http2;
  41.         listen [::]:443 ssl http2;
  42.         server_name www.ciel.pro;
  43.         ssl on;
  44.         ssl_certificate *****;
  45.         ssl_certificate_key *****;
  46. ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_session_cache shared:SSL:10m;ssl_stapling on;ssl_stapling_verify on;resolver 114.114.114.114 114.114.115.115 valid=300s;resolver_timeout 10s;ssl_prefer_server_ciphers on;ssl_dhparam /etc/ssl/certs/dhparam.pem;        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
  47.         add_header X-Frame-Options SAMEORIGIN;
  48.         return 301 https://ciel.pro$request_uri;
  49.     }
  50. server
  51.     {
  52.         listen 80;
  53.         listen [::]:80;
  54.         server_name ciel.pro www.ciel.pro;
  55.         return 301 https://ciel.pro$request_uri;
  56.     }
复制代码



不知道哪位成功配置H2的dalao能指点下?

[ 本帖最后由 Ciel 于 2016-11-7 12:44 编辑 ]
美国VPS推荐: 遨游主机LinodeLOCVPS主机云搬瓦工80VPSVultr美国VPS主机中国VPS推荐: 阿里云腾讯云。LNMP付费服务(代装/问题排查)QQ 503228080
发表于 2016-11-7 09:49:32 | 显示全部楼层


在一些高版本的chrome 50或其他浏览器上是必须要求alpn才能支持到http2的,要开alpn需要是openssl 1.0.2的版本

alpn的支持需要在nginx编译时指定上 --with-openssl=openssl源码目录全路径

具体可以参考:https://bbs.vpser.net/thread-14702-1-1.html
Linux下Nginx+MySQL+PHP自动安装工具:https://lnmp.org
发表于 2017-4-13 18:27:25 | 显示全部楼层

其实就是OpenSSL版本不对而已!
美国VPS推荐: 遨游主机LinodeLOCVPS主机云搬瓦工80VPSVultr美国VPS主机中国VPS推荐: 阿里云腾讯云。LNMP付费服务(代装/问题排查)QQ 503228080
您需要登录后才可以回帖 登录 | 注册

本版积分规则

小黑屋|手机版|Archiver|VPS侦探 ( 鲁ICP备16040043号-1 )

GMT+8, 2024-3-29 14:56 , Processed in 0.026727 second(s), 16 queries .

Powered by Discuz! X3.4

© 2001-2023 Discuz! Team.

快速回复 返回顶部 返回列表