Nginx SSL在Debian上如何优化

HPKP可以防止中间人攻击，通过固定服务器的公钥来验证SSL证书的真实性。

配置示例

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    # HPKP
    add_header Public-Key-Pins "pinset=sha256; pin-sha256='base64hashvalue';" max-age=5184000; includeSubDomains;
    # 其他配置...
}

其他优化建议

通过上述配置和建议，可以显著提高Nginx在Debian上使用SSL时的安全性与性能。