nginx 修复TLS1.0，TLS1.1协议漏洞

首先通过检测命令：

nmap --script ssl-enum-ciphers -p 443 ip地址

开启的情况：

修复

# 原始配置 
# ssl_protocols TLSv1 TLSv1.1 TLSv1.2 ; 
# 修复配置 
ssl_protocols TLSv1.2 ;

完整配置

# HTTPS server
server {
    listen       443 ssl;
    server_name  192.168.1.100;
    keepalive_timeout  70;

    ssl_certificate      cert/mycert.pem;
    ssl_certificate_key  cert/privatekey.pem;
    
    #ssl_certificate      cert/server.crt;
    #ssl_certificate_key  cert/server_rsa_private.pem.unsecure;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

	#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 ;
	ssl_protocols TLSv1.2 ;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        root   html;
        index  index.html index.htm;
    }
    
	# 映射服务器集群
	location /test/{
		proxy_set_header  X-Real-IP        $remote_addr;
		proxy_pass http://test;
	}
    location /status{
        stub_status on;
    }
}

关闭的情况：