tls1.3 自定义加密顺序

[toyst]

nginx 1.20 版本 配置

# 加密协议与套件
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers on;

用浏览器和 myssl.com 检测是 256 优先

TLS 1.3 (服务器顺序优先) TLS_AES_256_GCM_SHA384 (0x1302) 256 bits FS TLS_CHACHA20_POLY1305_SHA256 (0x1303) 256 bits FS TLS_AES_128_GCM_SHA256 (0x1301) 128 bits FS

怎么设置成 AES_128_GCM 优先呢？

[codefever]

楼主参考一下：

ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
#ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
error_page 497 http...s://$host$request_uri;

[toyst]

@codefever 我就是想用服务器控制顺序，而不是客户端选择

[H0u5er]

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers

[cattyhouse]

nginx:

ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;

[toyst]

@cattyhouse 感谢，有效

[liyunlong5]

ssl_prefer_server_ciphers off 即可，on 的话，h2+tls1.3 默认不是按照服务端的顺序来的，nginx 还没修复这个问题，好像 cf 那里有个 hack 的方法，可以搜索一下