给网站部署CHACHA20_POLY1305加密

首先下载需要的软件并解压

wget http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.3.tar.gz
tar xzf libressl-2.3.3.tar.gz
wget http://nginx.org/download/nginx-1.9.13.tar.gz
tar xzf nginx-1.9.13.tar.gz

由于 Openssl 的发行版并不支持 CHACHA20 加密算法，所以这里我们采用 LibreSSL 来编译

[root@centos soft]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.9.13
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC)
built with OpenSSL 1.0.2g  1 Mar 2016
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module --with-http_v2_module --with-openssl=/tmp/soft/openssl-1.0.2g --with-http_sub_module --with-http_stub_status_module --with-pcre --with-pcre=/tmp/soft/pcre-8.33 --with-zlib=/tmp/soft/zlib-1.2.8 --with-http_secure_link_module --with-ipv6 --with-http_gzip_static_module --with-http_realip_module --with-http_flv_module --with-ld-opt='-ljemalloc'

想查看一下当前编译的 nginx 的参数

然后开始重新编译 nginx

cd nginx-1.9.13
make clean
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_v2_module --with-http_sub_module --with-http_stub_status_module --with-pcre --with-pcre=/tmp/soft/pcre-8.33 --with-zlib=/tmp/soft/zlib-1.2.8 --with-http_secure_link_module --with-ipv6 --with-http_gzip_static_module --with-http_realip_module --with-http_flv_module --with-ld-opt='-ljemalloc' --with-openssl=/tmp/soft/libressl-2.3.3 --with-ld-opt="-lrt"
make
mv /usr/local/nginx/sbin/nginx{,_`date +%F`}
cp objs/nginx /usr/local/nginx/sbin

最后，修改ssl_ciphers部分

ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4;

重启一下 nginx 就可以了

这样导致的问题是不支持 nginx-ct,不能编译 nginx-ct 进去,V2XE上也有同学试验过

nginx-ct:
The following versions of OpenSSL are supported:
OpenSSL 1.0.2 or above.
BoringSSL 4fac72e or above.

LibreSSL is not supported as it doesn’t provide either of the functions used to add the signed_certificate_timestamp extension to the response (SSL_CTX_add_server_custom_ext and SSL_CTX_set_signed_cert_timestamp_list).

~~然而我 patch 后的 openssl 无法编译，所以暂时放弃 chacha20~~

由于 patch 过后的 openssl 需要 gcc4.7+和 binutils2.22+编译，而我用的 centos6 自带的版本是 gcc4.4 和 binutils2.20，所以更新一下，参考《CENTOS 6 通过 YUM 升级 GCC 到 4.7/4.8》

wget http://people.centos.org/tru/devtools-2/devtools-2.repo -O /etc/yum.repos.d/devtools-2.repo
yum install devtoolset-2-gcc devtoolset-2-binutils devtoolset-2-gcc-c++
mv /usr/bin/gcc /usr/bin/gcc-4.4.7
mv /usr/bin/g++ /usr/bin/g++-4.4.7
mv /usr/bin/c++ /usr/bin/c++-4.4.7
ln -s /opt/rh/devtoolset-2/root/usr/bin/gcc /usr/bin/gcc
ln -s /opt/rh/devtoolset-2/root/usr/bin/c++ /usr/bin/c++
ln -s /opt/rh/devtoolset-2/root/usr/bin/g++ /usr/bin/g++
gcc --version

升级之后，重新编译 nginx，然后就成了