From 35190b493ed448ae733ce1213f3ee351568c82cd Mon Sep 17 00:00:00 2001
From: gitadmin <aiyimickey@sina.com>
Date: Thu, 9 Jul 2026 15:59:20 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=B7=BB=E5=8A=A0=20SSL=20protocols/cip?=
 =?UTF-8?q?hers=20=E9=85=8D=E7=BD=AE=EF=BC=8C=E4=BF=AE=E5=A4=8D=E6=B5=8F?=
 =?UTF-8?q?=E8=A7=88=E5=99=A8=20SSL=20=E4=B8=8D=E5=AE=89=E5=85=A8=E6=8F=90?=
 =?UTF-8?q?=E7=A4=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 添加 ssl_protocols TLSv1.2 TLSv1.3（仅允许安全协议）
- 添加 ssl_ciphers 强加密套件（ECDHE+AESGCM/CHACHA20）
- 添加 ssl_prefer_server_ciphers on（服务端优先选择加密套件）
---
 nginx.conf | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nginx.conf b/nginx.conf
index 7a40a86..6ee5365 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -43,7 +43,10 @@ http {
     gzip_proxied any;
     gzip_vary on;
 
-    # --- SSL 会话缓存 ---
+    # --- SSL 安全配置 ---
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+    ssl_prefer_server_ciphers on;
     ssl_session_cache shared:SSL:10m;
     ssl_session_timeout 1d;
     ssl_session_tickets on;