海运的博客

nginx下ssl_ciphers配置对tls1.3无效，当开启ssl_prefer_server_ciphers选项时以openssl默认的顺序选择ciphers。
查看openssl支持的ciphers:

openssl ciphers -s -tls1_3
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256

修改openssl tls1.3 ciphers顺序
centos8下修改配置文件/etc/crypto-policies/back-ends/opensslcnf.config

Ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256

其它版本，修改/etc/pki/tls/openssl.cnf配置文件：

openssl_conf = default_conf

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
Ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256

然后重启nginx即可。

https://trac.nginx.org/nginx/ticket/1529
https://trac.nginx.org/nginx/ticket/1445
https://wiki.openssl.org/index.php/TLS1.3#Ciphersuites
https://github.com/ssllabs/ssllabs-scan/issues/636

生成自签名证书：

#生成私钥
openssl genrsa -out server.key 4096
#生成证书请求
openssl req -new -nodes -out server.csr -key server.key -subj "/C=CN/O=Haiyun/CN=haiyun.me/CN=www.haiyun.me"
#作用同上面2个步骤
openssl req -new -newkey rsa:4096 -nodes -out server.csr -keyout server.key -subj "/C=CN/O=Haiyun/CN=haiyun.me/CN=www.haiyun.me"
#签发证书
openssl x509 -req -days 7300 -in server.csr -signkey server.key -out server.crt
#下面这个命令加上前2个步骤效果同最下面命令
openssl req -x509 -key server.key -in server.csr -out server.crt -days 36500
#一条命令生成自签名证书
openssl req -new -x509 -newkey rsa:4096 -days 7300 -nodes -out server.crt -keyout server.key -subj "/C=CN/L=City/O=Haiyun/CN=haiyun.me/CN=www.haiyun.me"

使用CA签发证书：

openssl req -new -x509 -newkey rsa:4096 -days 7300 -nodes -out ca.crt -keyout ca.key -subj "/C=CN/O=Haiyun/CN=My CA"
openssl req -new -newkey rsa:4096 -nodes -out server.csr -keyout server.key -subj "/C=CN/O=Haiyun/CN=haiyun.me/CN=www.haiyun.me"
openssl x509 -req -CA ca.crt -CAkey ca.key -in server.csr -out server.crt -days 7300 -CAcreateserial

查看证书信息：

openssl x509 -noout -text -in server.crt 
openssl rsa -noout -text -in server.key
openssl req -noout -text -in server.csr

生成ecc证书：

openssl ecparam -genkey -name prime256v1 -out server.key
# -name secp384r1
openssl req -new -x509 -days 7300 -key server.key -out server.crt

caddy使用上面自签名ssl的证书错误：
loading tls app module: provision tls: caching unmanaged certificate: certificate has no names
在签名时指定DNS名称为当前IP解决：

-addext 'subjectAltName=DNS:192.168.1.1,DNS:127.0.0.1'

参考：
https://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-the-command-line
https://blog.csdn.net/qq_41827547/article/details/105682770