老话重提。2022年都快过完了还有人做假证书防止IP泄漏 - 全球主机交流论坛

2022年都快过完了还有人做假证书防止IP泄漏的？？？
Nginx从2020年发布的1.19.4版本开始就内置了更好的方式啊,
Syntax: ssl_reject_handshake on | off;
Default: ssl_reject_handshake off;
Context: http, server
This directive appeared in version 1.19.4.
If enabled, SSL handshakes in the server block will be rejected.
For example, in the following configuration, SSL handshakes with server names other than example.com are rejected:
server {
listen 443 ssl default_server;
ssl_reject_handshake on;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate example.com.crt;
ssl_certificate_key example.com.key;
}

复制代码

listen 443 ssl default_server;
ssl_reject_handshake on;
}

复制代码

server {
listen 443 ssl default_server;
ssl_reject_handshake on;
ssl_handshake_timeout 5s; # 设置为 5 秒钟
}

复制代码

user www www;
worker_processes auto;
worker_cpu_affinity auto;
error_log /home/wwwlogs/nginx_error.log crit;
pid /usr/local/nginx/logs/nginx.pid;
#Specifies the value for maximum file descriptors that can be opened by this process.
worker_rlimit_nofile 51200;
events
{
use epoll;
worker_connections 51200;
multi_accept off;
accept_mutex off;
}
http
{
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 50m;
sendfile on;
sendfile_max_chunk 512k;
tcp_nopush on;
keepalive_timeout 60;
tcp_nodelay on;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 256k;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss;
gzip_vary on;
gzip_proxied expired no-cache no-store private auth;
gzip_disable "MSIE [1-6]\.";
#limit_conn_zone $binary_remote_addr zone=perip:10m;
##If enable limit_conn_zone,add "limit_conn perip 10;" to server section.
server_tokens off;
access_log off;
server
{
listen 80 default_server reuseport;
#listen [::]:80 default_server ipv6only=on;
server_name _;
return 444;
access_log off;
}
server
{
listen 443 ssl http2;
server_name _;
ssl_reject_handshake on;
ssl_handshake_timeout 5s;
access_log off;
}
include vhost/*.conf;
}

复制代码

ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_reject_handshake on;

复制代码