HTTPS i SSL/TLS: nastroyka bezopasnogo soedineniya

HTTPS — obyazatelnoe trebovanie dlya sovremennyh veb-prilozheniy. Razberyom nastroyku SSL/TLS.

TLS 1.3 vs TLS 1.2

TLS 1.3 bystree i bezopasnee: handshake za 1-RTT vmesto 2-RTT, udaleny ustarevshie algoritmy.

Let's Encrypt: besplatnye sertifikaty

Certbot avtomatiziruet poluchenie i obnovlenie:

sudo certbot --nginx -d example.com -d www.example.com

Nastroyka Nginx

server {    listen 443 ssl http2;    server_name example.com;        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;        # TLS 1.3 only    ssl_protocols TLSv1.3;    ssl_prefer_server_ciphers off;        # HSTS    add_header Strict-Transport-Security "max-age=63072000" always;}

HTTP Strict Transport Security (HSTS)

Prinuditelnoe ispolzovanie HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Proverka konfiguratsii

Ispolzuyte SSL Labs Test dlya audita konfiguratsii.