左手亲情右手爱

给HTTPS上把锁：Nginx强密码套件配置_我的网站

无证之罪

一 | E-commerce giant Amazon is under investigation by the UK's competition watchdog over claims it favors its own warehouses over third-party sellers.,The Competition and Markets Authority (CMA) will look into whether customers are getting a "worse deal" due to the online retailer giving an unfair advantage to its retail arm or sellers who use its services in the Amazon UK Marketplace.,In particular, the probe will examine how Amazon uses third-party retailers' data and its criteria for access to the "Amazon Prime" service, which includes free deliveries. It will also look at how Amazon decides which company's product has the privilege of featuring in the instant "Buy Box" on the website's home page.,"Millions of people across the UK rely on Amazon's services for fast delivery of all types of products at the click of a button," said CMA general counsel Sarah Cardell. "This is an important area so it's right that we carefully investigate whether Amazon is using third-party data to give an unfair boost to its own retail business and whether it favours sellers who use its logistics and delivery services - both of which could weaken competition.",Bezos’ $500M Megayacht Stranded After Dutch Firm Abandons Bid to Dismantle Rotterdam Bridge3 July, 04:03 GMT,"Thousands of UK businesses use Amazon to sell their products and it is important they are able to operate in a competitive market," Cardell added. "Any loss of competition is a loss to consumers and could lead to them paying more for products, being offered lower quality items or having less choice.",Billionaire Amazon founder Jeff Bezos also owns the liberal US Washington Post newspaper. The company has been criticized for its treatment of warehouse staff and its resistance to recognizing trade unions.。

　一键部署OpenClaw

证书装了不等于站点安全。TLS版本太低、密码套件太弱，照样会被中间人攻击和协议降级攻击盯上。尤其是站长手里的小站，很多用的还是默认配置，老旧的TLS 1.0/1.1根本没关。

下面的配置直接屏蔽TLS 1.0/1.1，只保留TLS 1.2和1.3，同时启用HSTS和OCSP Stapling，让浏览器只走安全通道。 server { listen 443 ssl http2; ssl_certificate /etc/nginx/ssl/site.crt; ssl_certificate_key /etc/nginx/ssl/site.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1h; ssl_session_tickets off; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/ssl/chain.crt; }

配置完用openssl s_client -connect yourdomain.com:443 -tls1_1测试，正确结果是握手失败。

二 | 再用SSL Labs跑一下，A+就稳了。

Windows的IIS用户也能照这个思路：在注册表里关闭TLS 1.0/1.1的服务器端，并启用HSTS响应头。

三 | 原理一样，只是换了个配置入口。

四 |

申请创业报道，分享创业好点子。点击此处，共同探讨创业新机遇！。

五 |

Current article:http://wassj.gangzhengganfouanlou.pics/list_1g2y/nwk6lm.html

Published on:00:41:12