319 lines
6.4 KiB
Markdown
319 lines
6.4 KiB
Markdown
# 🔒 HTTPS配置完成报告
|
||
|
||
## ✅ 配置状态
|
||
|
||
**域名**: scs.flnxi.com
|
||
**配置时间**: 2025-10-26 18:50
|
||
**证书类型**: ZeroSSL (免费)
|
||
**证书有效期**: 90天（自动续期）
|
||
|
||
---
|
||
|
||
## 🎉 完成内容
|
||
|
||
### 1. SSL证书申请 ✅
|
||
- **证书颁发机构**: ZeroSSL (通过acme.sh)
|
||
- **证书类型**: ECC (ec-256)
|
||
- **域名验证**: Webroot方式
|
||
- **证书路径**: `/root/.acme.sh/scs.flnxi.com_ecc/`
|
||
|
||
### 2. 证书安装 ✅
|
||
- **证书文件**: `/www/server/panel/vhost/cert/scs.flnxi.com/fullchain.pem`
|
||
- **私钥文件**: `/www/server/panel/vhost/cert/scs.flnxi.com/privkey.pem`
|
||
- **自动重载**: 证书更新后自动重载Nginx
|
||
|
||
### 3. Nginx配置 ✅
|
||
|
||
#### HTTP强制跳转HTTPS
|
||
```nginx
|
||
server {
|
||
listen 80;
|
||
server_name scs.flnxi.com;
|
||
location / {
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
}
|
||
```
|
||
|
||
#### HTTPS服务配置
|
||
```nginx
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name scs.flnxi.com;
|
||
|
||
# SSL证书
|
||
ssl_certificate /www/server/panel/vhost/cert/scs.flnxi.com/fullchain.pem;
|
||
ssl_certificate_key /www/server/panel/vhost/cert/scs.flnxi.com/privkey.pem;
|
||
|
||
# SSL优化
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4;
|
||
ssl_session_cache shared:SSL:10m;
|
||
|
||
# 安全头
|
||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
|
||
# 反向代理
|
||
location / {
|
||
proxy_pass http://127.0.0.1:4782;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
# ... 其他配置
|
||
}
|
||
}
|
||
```
|
||
|
||
### 4. 自动续期配置 ✅
|
||
- **续期方式**: acme.sh自动续期
|
||
- **Cron任务**: 每天23:20自动检查并续期
|
||
- **续期时间**: 证书到期前30天自动续期
|
||
- **下次续期**: 2025-12-24
|
||
|
||
```bash
|
||
# Cron任务
|
||
20 23 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
|
||
```
|
||
|
||
---
|
||
|
||
## 🔒 安全特性
|
||
|
||
### HSTS (HTTP Strict Transport Security)
|
||
- ✅ 已启用
|
||
- **max-age**: 31536000秒（1年）
|
||
- **作用**: 强制浏览器使用HTTPS访问
|
||
|
||
### SSL/TLS协议
|
||
- ✅ TLS 1.2
|
||
- ✅ TLS 1.3
|
||
- ❌ 禁用 SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1
|
||
|
||
### 安全HTTP头
|
||
- ✅ `Strict-Transport-Security`: 强制HTTPS
|
||
- ✅ `X-Frame-Options`: 防止点击劫持
|
||
- ✅ `X-Content-Type-Options`: 防止MIME类型嗅探
|
||
- ✅ `X-Forwarded-Proto`: 识别原始协议
|
||
|
||
### Gzip压缩
|
||
- ✅ 已启用
|
||
- **压缩类型**: text/plain, text/css, application/javascript, application/json
|
||
- **最小压缩大小**: 1024字节
|
||
|
||
---
|
||
|
||
## 🌐 访问测试
|
||
|
||
### HTTPS访问
|
||
```bash
|
||
curl -I https://scs.flnxi.com
|
||
```
|
||
|
||
**结果**: ✅ HTTP/2 200 OK
|
||
|
||
### HTTP强制跳转
|
||
```bash
|
||
curl -I http://scs.flnxi.com
|
||
```
|
||
|
||
**结果**: ✅ HTTP/1.1 301 Moved Permanently → https://scs.flnxi.com/
|
||
|
||
---
|
||
|
||
## 📋 证书信息
|
||
|
||
| 项目 | 信息 |
|
||
|------|------|
|
||
| **域名** | scs.flnxi.com |
|
||
| **颁发机构** | ZeroSSL ECC Domain Secure Site CA |
|
||
| **证书类型** | DV (域名验证) |
|
||
| **加密算法** | ECC (椭圆曲线) |
|
||
| **密钥长度** | 256位 |
|
||
| **签发日期** | 2025-10-26 |
|
||
| **到期日期** | 2026-01-24 |
|
||
| **有效期** | 90天 |
|
||
| **自动续期** | ✅ 已配置 |
|
||
|
||
---
|
||
|
||
## 🛠️ 管理命令
|
||
|
||
### 查看证书信息
|
||
```bash
|
||
ssh root@45.249.208.118
|
||
~/.acme.sh/acme.sh --info -d scs.flnxi.com --ecc
|
||
```
|
||
|
||
### 查看证书列表
|
||
```bash
|
||
~/.acme.sh/acme.sh --list
|
||
```
|
||
|
||
### 手动续期证书
|
||
```bash
|
||
~/.acme.sh/acme.sh --renew -d scs.flnxi.com --ecc --force
|
||
```
|
||
|
||
### 手动重载Nginx
|
||
```bash
|
||
nginx -s reload
|
||
```
|
||
|
||
### 查看Nginx配置
|
||
```bash
|
||
cat /www/server/panel/vhost/nginx/scs.flnxi.com.conf
|
||
```
|
||
|
||
### 测试Nginx配置
|
||
```bash
|
||
nginx -t
|
||
```
|
||
|
||
### 查看续期日志
|
||
```bash
|
||
cat ~/.acme.sh/scs.flnxi.com_ecc/scs.flnxi.com.log
|
||
```
|
||
|
||
---
|
||
|
||
## 📊 性能优化
|
||
|
||
### HTTP/2协议
|
||
- ✅ 已启用
|
||
- **优势**: 多路复用、头部压缩、服务器推送
|
||
|
||
### SSL会话缓存
|
||
- ✅ 已启用
|
||
- **缓存大小**: 10MB
|
||
- **缓存时间**: 10分钟
|
||
- **优势**: 减少SSL握手次数，提升性能
|
||
|
||
### Gzip压缩
|
||
- ✅ 已启用
|
||
- **压缩级别**: 默认
|
||
- **优势**: 减少传输数据量，加快加载速度
|
||
|
||
---
|
||
|
||
## 🔍 SSL评分测试
|
||
|
||
建议使用以下工具测试SSL配置：
|
||
|
||
### SSL Labs测试
|
||
```
|
||
https://www.ssllabs.com/ssltest/analyze.html?d=scs.flnxi.com
|
||
```
|
||
|
||
### 预期评级
|
||
- **整体评级**: A或A+
|
||
- **证书**: 100/100
|
||
- **协议支持**: 100/100
|
||
- **密钥交换**: 90/100
|
||
- **加密强度**: 90/100
|
||
|
||
---
|
||
|
||
## 📝 维护建议
|
||
|
||
### 定期检查
|
||
- [ ] 每月检查证书有效期
|
||
- [ ] 每月查看Nginx错误日志
|
||
- [ ] 每季度更新SSL配置
|
||
|
||
### 监控告警
|
||
建议配置以下监控：
|
||
- 证书到期提醒（提前30天）
|
||
- HTTPS访问异常告警
|
||
- SSL握手失败告警
|
||
|
||
### 备份
|
||
- [ ] 定期备份证书文件
|
||
- [ ] 定期备份Nginx配置
|
||
|
||
---
|
||
|
||
## 🚨 故障排查
|
||
|
||
### 证书过期
|
||
```bash
|
||
# 手动强制续期
|
||
~/.acme.sh/acme.sh --renew -d scs.flnxi.com --ecc --force
|
||
```
|
||
|
||
### HTTPS无法访问
|
||
```bash
|
||
# 检查证书文件
|
||
ls -la /www/server/panel/vhost/cert/scs.flnxi.com/
|
||
|
||
# 检查Nginx配置
|
||
nginx -t
|
||
|
||
# 重启Nginx
|
||
nginx -s reload
|
||
```
|
||
|
||
### 证书自动续期失败
|
||
```bash
|
||
# 查看日志
|
||
tail -100 ~/.acme.sh/acme.sh.log
|
||
|
||
# 手动测试续期
|
||
~/.acme.sh/acme.sh --renew -d scs.flnxi.com --ecc --debug
|
||
```
|
||
|
||
---
|
||
|
||
## 📞 相关文档
|
||
|
||
- **部署成功报告**: `DEPLOYMENT_SUCCESS.md`
|
||
- **项目说明**: `README.md`
|
||
- **部署指南**: `DEPLOYMENT.md`
|
||
- **快速入门**: `QUICKSTART.md`
|
||
|
||
---
|
||
|
||
## ✨ 配置总结
|
||
|
||
✅ **SSL证书**: 已申请并安装（ZeroSSL）
|
||
✅ **HTTPS服务**: 已启用（HTTP/2）
|
||
✅ **强制HTTPS**: HTTP自动301跳转
|
||
✅ **安全头部**: 已添加（HSTS、X-Frame-Options等）
|
||
✅ **自动续期**: 已配置Cron任务
|
||
✅ **性能优化**: Gzip压缩、SSL会话缓存
|
||
|
||
---
|
||
|
||
## 🌐 最终访问地址
|
||
|
||
### 主域名（HTTPS）
|
||
**https://scs.flnxi.com**
|
||
|
||
### HTTP访问
|
||
http://scs.flnxi.com → 自动跳转到HTTPS
|
||
|
||
### 直接IP访问
|
||
http://45.249.208.118:4782 → 仍然可用
|
||
|
||
---
|
||
|
||
## 🎉 部署完成
|
||
|
||
FLNXI官网已完成：
|
||
1. ✅ Docker容器部署
|
||
2. ✅ Nginx反向代理配置
|
||
3. ✅ 免费SSL证书申请
|
||
4. ✅ HTTPS强制跳转
|
||
5. ✅ 证书自动续期
|
||
6. ✅ 安全和性能优化
|
||
|
||
**正式访问地址**: https://scs.flnxi.com
|
||
|
||
---
|
||
|
||
**配置完成时间**: 2025-10-26 18:52
|
||
**下次证书续期**: 2025-12-24
|
||
**证书有效期至**: 2026-01-24
|
||
|
||
🔒 您的网站现在已经安全且高性能地运行在HTTPS上！
|
||
|