Answer a question

SSLlabs still show the following message even after i added the ssl_session_cache

Session resumption (caching)    No (IDs assigned but not accepted)

Here is my full configuration

server {
    listen       443 spdy; #Change to 443 when SSL is on
    ssl on; 
    ssl_certificate    /etc/ssl/domain.com_bundle.crt; 
    ssl_certificate_key  /etc/ssl/domain.com.key.nopass;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    #ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_buffer_size 8k;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/trustchain.crt;
    resolver 8.8.8.8 8.8.4.4;
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    #rest config goes here
    }

Answers

SSL Labs doesn't assume that SNI is available to the client, so it only tests the default virtual server.

The problem could be that you don't have SSL session caching enabled on the default server. To enable it, you just need to add that ssl_session_cache line to your default_server. Alternatively, if you'd like that configuration the work across all of your nginx virtual servers (which I would recommend), you could move the ssl_session_cache line outside of the server declaration, so it applies to all of them.

Here's the configuration I use:

# All your server-wide SSL configuration

# Enable SSL session caching for improved performance
# http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
ssl_session_cache shared:ssl_session_cache:10m;

server {
    # All your normal virtual server configuration
}

Sources:

  1. I tested both options on my own server and SSL Labs loves it!
  2. This thread on the Nginx mailing list
Logo

开发云社区提供前沿行业资讯和优质的学习知识,同时提供优质稳定、价格优惠的云主机、数据库、网络、云储存等云服务产品

更多推荐