獲取有效SSL證書（推薦Let’s Encrypt并用certbot自動配置）；2. 配置Nginx啟用TLSv1.2/1.3、強加密套件及安全頭（如HSTS）；3. 將HTTP流量重定向至HTTPS；4. 測試配置并確保證書自動續(xù)期，最終實現(xiàn)安全可信的HTTPS站點。

Securing Nginx with SSL/TLS isn’t just about checking a box—it’s about protecting your users, building trust, and improving SEO. If you're running an Nginx web server, setting up HTTPS properly is essential. Here's how to do it right without overcomplicating things.

? 1. Get a Valid SSL Certificate

You’ve got options:

• Let’s Encrypt (Free & Recommended): Use certbot to automate certificate issuance and renewal.
• Commercial CA (e.g., DigiCert, Sectigo): For enterprise needs or extended validation (EV).

For Let’s Encrypt:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

This automatically configures Nginx and renews certs (via cron/systemd timer). Easy win.

? 2. Configure Nginx for Strong TLS

Edit your Nginx site config (usually in /etc/nginx/sites-available/your-site):

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # Strong protocols & ciphers
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
}

Why this matters:

• http2 boosts performance over HTTPS.
• Disabling old TLS versions (like 1.0/1.1) blocks known vulnerabilities.
• HSTS (max-age=63072000) tells browsers to always use HTTPS—even if someone types http://.

? 3. Redirect HTTP → HTTPS Automatically

Add this block to redirect all insecure traffic:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

This ensures users never land on an unencrypted page—even if they forget to type "https://".

?? 4. Test & Monitor

• Run nginx -t before reloading config (systemctl reload nginx).
• Test your setup at:
  ? SSL Labs SSL Test
  Aim for an A or A rating.
• Enable auto-renewal for Let’s Encrypt:

  sudo certbot renew --dry-run

  If that passes, you’re golden—certs auto-renew every 60 days.

  ---

  Bottom line: With just a few well-placed config lines and a free cert from Let’s Encrypt, you can have a secure, fast, modern HTTPS site. No excuses—just do it.
  (And don’t forget to test!)

  以上是用SSL/TL固定NGINX的詳細內(nèi)容。更多信息請關(guān)注PHP中文網(wǎng)其他相關(guān)文章！