nginx:如何记录TLS错误(如果不支持的密码/协议)
我正在切换到100%https.服务器正在运行nginx libressl.
在开始之前https:100%我有兴趣看到哪些客户端无法再连接到我的网站.例如.因为我不支持SSL3.
我检查了nginx错误和访问日志,但如果我尝试连接SSL3,则没有包含有价值的信息.
我希望看到的内容:例如:
Client [IP]: Connection failed due to protocol/cipher mismatch.
然后,我将能够访问该访问/错误日志,并查看有多少客户端无法再访问我的站点.
这可能吗?
目前的nginx.conf:
user www-data www-data;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 100000;
error_log /var/log/nginx/error.log;
events {
worker_connections 2048;
use epoll;
multi_accept on;
}
http {
server_tokens off;
autoindex off;
charset UTF-8;
include mime.types;
default_type application/octet-stream;
log_format main '$host - $remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
keepalive_timeout 10;
reset_timedout_connection on;
client_body_timeout 10;
send_timeout 10;
client_max_body_size 512k;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server {
listen 80;
server_name domain.com www.domain.com;
return 301 https://www.domain.com$request_uri;
}
server {
listen 443 ssl spdy;
server_name domain.com;
include conf.d/ssl.conf;
return 301 https://www.domain.com$request_uri;
}
server {
listen 443 ssl spdy;
server_name www.domain.com;
root /var/www/vhosts/domain.com/public_html;
include conf.d/ssl.conf;
default_type text/html;
location / {
return 200 'Hello World!';
}
}
}
conf.d / ssl.conf中:
ssl on;
ssl_dhparam ssl/dhparam4096.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_buffer_size 1400;
spdy_headers_comp 6;
add_header Alternate-Protocol 443:npn-spdy/3;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "AES256+EECDH:AES256+EDH";
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
ssl_certificate ssl/public.crt;
ssl_certificate_key ssl/private.key;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate ssl/ca-certs.pem;
resolver 8.8.8.8 valid=300s;
resolver_timeout 10s;