koyoz 's blog天高云淡，让心情旅行菜单跳至正文首页旧blog解决nginx开启http2不生效问题发表评论先感受一下http2的优势https://http2.akamai.com/demonginx在1.9起就开始支持http2了, 如下配置即可开启listen 443 ssl http2;server_name www.koyoz.com koyoz.com;ssl on;ssl_certificate fullchain.pem;ssl_certificate_key privkey.pem;验证是否开启: Chrome 安装 HTTP/2 and SPDY indicator, 若变成蓝色闪电就表示http2开启了如果用以上配置后, 仍未开启 那说明编译时openssl的版本太低了. 下载最新openssl-1.0.2h并指定 –with-openssl 为刚刚下载的新版本, 重新编译nginx,  即可开启https效果如下:本条目发布于2016年8月22日。属于未分类分类。作者是koyoz。用curl测速发表评论命令curl -o /dev/null -s -w 'DNS:%{time_namelookup}\nConnect:%{time_connect}\nStart:%{time_starttransfer}\nTotal:%{time_total}\nSpeed:%{speed_download} byte/s' https://koyoz.com/blog/返回结果:DNS:0.030Connect:0.078Start:0.503Total:0.515Speed:60306.000 byte/s字段含义:time_connect建立到服务器的 TCP 连接所用的时间time_starttransfer在发出请求之后,Web 服务器返回数据的第一个字节所用的时间time_total完成请求所用的时间time_namelookupDNS解析时间,从请求开始到DNS解析完毕所用时间(记得关掉 Linux 的 nscd 的服务测试)speed_download下载速度，单位-字节每秒。本条目发布于2016年4月6日。属于未分类分类。作者是koyoz。使用letsencrypt完全免费的https (nginx)发表评论letsencrypt 已经开始公测了, 现在可以免费使用他提供的ssl证书了.以linux下nginx为例.git clone https://github.com/letsencrypt/letsencryptcd letsencrypt./letsencrypt-auto certonly --standalone --email webmaster@koyoz.com -d koyoz.com -d www.koyoz.com成功之后会提示如下信息IMPORTANT NOTES:- If you lose your account credentials, you can recover throughe-mails sent to webmaster@koyoz.com.- Congratulations! Your certificate and chain have been saved at/etc/letsencrypt/live/koyoz.com/fullchain.pem. Your cert willexpire on 2016-04-27. To obtain a new version of the certificate inthe future, simply run Let's Encrypt again.- Your account credentials have been saved in your Let's Encryptconfiguration directory at /etc/letsencrypt. You should make asecure backup of this folder now. This configuration directory willalso contain certificates and private keys obtained by Let'sEncrypt so making regular backups of this folder is ideal.- If like Let's Encrypt, please consider supporting our work by:Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donateDonating to EFF: https://eff.org/donate-le开始配置nginxlisten       443 ssl spdy;server_name   koyoz.com;ssl     on;ssl_certificate       /etc/letsencrypt/live/koyoz.com/fullchain.pem;ssl_certificate_key   /etc/letsencrypt/live/koyoz.com/privkey.pem;ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;其中ssl_ciphers可以通过 openssl ciphers 查看和选择ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-