Intro
=====
This directory contains a few sets of files that are used for
configuration in diverse ways:
*.conf Target platform configurations, please read
'Configurations of OpenSSL target platforms' for more
information.
*.tmpl Build file templates, please read 'Build-file
programming with the "unified" build system' as well
as 'Build info files' for more information.
*.pm Helper scripts / modules for the main `Configure`
script. See 'Configure helper scripts for more
information.
Configurations of OpenSSL target platforms
==========================================
Configuration targets are a collection of facts that we know about
different platforms and their capabilities. We organise them in a
hash table, where each entry represent a specific target.
Note that configuration target names must be unique across all config
files. The Configure script does check that a config file doesn't
have config targets that shadow config targets from other files.
In each table entry, the following keys are significant:
inherit_from => Other targets to inherit values from.
Explained further below. [1]
template => Set to 1 if this isn't really a platform
target. Instead, this target is a template
upon which other targets can be built.
Explained further below. [1]
sys_id => System identity for systems where that
is difficult to determine automatically.
enable => Enable specific configuration features.
This MUST be an array of words.
disable => Disable specific configuration features.
This MUST be an array of words.
Note: if the same feature is both enabled
and disabled, disable wins.
as => The assembler command. This is not always
used (for example on Unix, where the C
compiler is used instead).
asflags => Default assembler command flags [4].
cpp => The C preprocessor command, normally not
given, as the build file defaults are
usually good enough.
cppflags => Default C preprocessor flags [4].
defines => As an alternative, macro definitions may be
given here instead of in 'cppflags' [4].
If given here, they MUST be as an array of
the string such as "MACRO=value", or just
"MACRO" for definitions without value.
includes => As an alternative, inclusion directories
may be given here instead of in 'cppflags'
[4]. If given here, the MUST be an array
of strings, one directory specification
each.
cc => The C compiler command, usually one of "cc",
"gcc" or "clang". This command is normally
also used to link object files and
libraries into the final program.
cxx => The C++ compiler command, usually one of
"c++", "g++" or "clang++". This command is
also used when linking a program where at
least one of the object file is made from
C++ source.
cflags => Defaults C compiler flags [4].
cxxflags => Default C++ compiler flags [4]. If unset,
it gets the same value as cflags.
(linking is a complex thing, see [3] below)
ld => Linker command, usually not defined
(meaning the compiler command is used
instead).
(NOTE: this is here for future use, it's
not implemented yet)
lflags => Default flags used when linking apps,
shared libraries or DSOs [4].
ex_libs => Extra libraries that are needed when
linking shared libraries, DSOs or programs.
The value is also assigned to Libs.private
in $(libdir)/pkgconfig/libcrypto.pc.
shared_cppflags => Extra C preprocessor flags used when
processing C files for shared libraries.
shared_cflag => Extra C compiler flags used when compiling
for shared libraries, typically something
like "-fPIC".
shared_ldflag => Extra linking flags used when linking
shared libraries.
module_cppflags
module_cflags
module_ldflags => Has the same function as the corresponding
'shared_' attributes, but for building DSOs.
When unset, they get the same values as the
corresponding 'shared_' attributes.
ar => The library archive command, the default is
"ar".
(NOTE: this is here for future use, it's
not implemented yet)
arflags => Flags to be used with the library archive
command. On Unix, this includes the
command letter, 'r' by default.
ranlib => The library archive indexing command, the
default is 'ranlib' it it exists.
unistd => An alternative header to the typical
'<unistd.h>'. This is very rarely needed.
shared_extension => File name extension used for shared
libraries.
obj_extension => File name extension used for object files.
On unix, this defaults to ".o" (NOTE: this
is here for future use, it's not
implemented yet)
exe_extension => File name extension used for executable
files. On unix, this defaults to "" (NOTE:
this is here for future use, it's not
implemented yet)
shlib_variant => A "variant" identifier inserted between the base
shared library name and the extension. On "unixy"
platforms (BSD, Linux, Solaris, MacOS/X, ...) this
supports installation of custom OpenSSL libraries
that don't conflict with other builds of OpenSSL
installed on the system. The variant identifier
becomes part of the SONAME of the library and also
any symbol versions (symbol versions are not used or
needed with MacOS/X). For example, on a system
where a default build would normally create the SSL
shared library as 'libssl.so -> libssl.so.1.1' with
the value of the symlink as the SONAME, a target
definition that sets 'shlib_variant => "-abc"' will
create 'libssl.so -> libssl-abc.so.1.1', again with
an SONAME equal to the value of the symlink. The
symbol versions associated with the variant library
would then be
openssl-3.0.1
需积分: 0 174 浏览量
更新于2024-03-05
收藏 14.32MB GZ 举报
《OpenSSL 3.0.1详解:在Nginx中的应用与安全强化》
OpenSSL,一个强大的安全套接字层密码库,包含了各种主要的密码算法、常用的密钥和证书封装管理功能以及SSL协议,并提供丰富的应用程序供测试或其他目的使用。其最新版本为3.0.1,带来了诸多改进和新特性,对网络安全有着重要的影响。
OpenSSL 3.0.1的发布标志着该库在安全性、性能和兼容性方面的进一步提升。这一版本引入了对TLS 1.3协议的全面支持,这是目前最安全的网络传输协议,旨在提供更快的数据传输速度和更强的加密保护。此外,它还修复了多个安全漏洞,提高了整体的安全性,这对于依赖OpenSSL的Web服务器,如Nginx来说,尤为重要。
Nginx,作为一款高性能的HTTP和反向代理服务器,广泛应用于互联网服务。集成OpenSSL 3.0.1,可以为Nginx提供最新的加密标准和安全更新。配置Nginx使用OpenSSL 3.0.1,首先需要下载并编译安装OpenSSL,然后在Nginx的配置过程中指定新版本的动态链接库路径。这样,Nginx就能利用OpenSSL提供的加密功能,确保用户数据在传输过程中的安全。
在Nginx中配置SSL/TLS时,有几点需要注意:
1. **证书与密钥**:确保正确地加载了服务器的SSL证书和私钥,这是建立安全连接的基础。可以使用OpenSSL工具生成自签名证书或从权威证书颁发机构获取。
2. **强制HTTPS**:通过配置Nginx服务器块,可以强制所有HTTP请求重定向到HTTPS,确保所有通信都是加密的。
3. **TLS配置优化**:遵循最佳实践,例如启用前向保密(Perfect Forward Secrecy,PFS),禁用弱加密套件,启用HTTP/2等,以提高安全性和性能。
4. **HSTS(HTTP Strict Transport Security)**:启用HSTS头,告知浏览器始终使用HTTPS访问网站,防止中间人攻击。
5. **OCSP Stapling**:通过服务器预加载客户端的证书状态查询结果,减少延迟并提高连接速度。
6. **TLS Session Resumption**:利用TLS会话恢复机制,降低握手开销,提高连接速度。
OpenSSL 3.0.1的更新还包括对异步加密的支持,这允许其他操作在加密操作进行时并行处理,从而提高效率。同时,新的API设计更加模块化,使得开发者更容易理解和维护代码。
总结来说,OpenSSL 3.0.1的升级对于Nginx用户意味着更安全、高效的网络服务。理解如何充分利用这些新特性,并在实际部署中正确配置,是每个关注网络安全的系统管理员和开发者必须掌握的关键技能。保持软件的最新状态,结合最佳实践,是保障网络服务安全的关键步骤。

qq_40679799
- 粉丝: 18
最新资源
- (源码)基于 XIAO ESPC3 微控制器的无线 Cyberpuck 鼠标.zip
- 基于COMSOL的单相变压器绕组及铁芯振动形变仿真模型研究与应用
- 基于非支配排序的多目标小龙虾优化算法求解柔性作业车间调度问题(FJSP)的MATLAB实现
- 基于博弈树和NMPC的无信号灯T型路口车辆冲突智能运动规划策略研究 NMPC 终极版
- 移动边缘计算中基于差分进化算法的任务卸载与资源调度研究及MATLAB实现
- 离网风电耦合PEM电解水制氢系统的建模与优化:非并网风电制氢技术的应用研究
- 基于五次多项式的快速自由换道轨迹规划(DLC方法)的MATLAB或Python实现:针对性设计评价成本函数与三车道场景仿真demo
- 基于西门子S7-300PLC与S7-1200PLC的污水处理控制系统全套资料:包含触摸屏仿真画面图纸文档,兼容博图V16及以上版本
- 永磁直驱风力发电系统(PMSG)的并网装置仿真与优化控制策略 2025版
- 燃料电池汽车Cruise-MATLABSimulink联合仿真的多点恒功率控制策略研究
- 基于Lyapunov方法的欠驱动无人船USV路径与轨迹跟踪控制策略实现——11-trans顶刊代码复现 - 非线性控制
- 双馈风力发电机变流器Simulink仿真模型及参数突变研究
- 非奇异快速终端滑模控制(NFTSMC)在三自由度水面艇轨迹跟踪中的应用研究及MatlabSimulink实现
- 基于PLC的S7-1200智能交通灯控制系统:博途编程与Wincc组态仿真及报告研究 WinCC 必备版
- 西门子S7-200PLC与组态王联合打造物料传送带四传送带智能控制系统 终极版
- 西门子S7-200PLC与组态王在三层电梯控制系统中的设计与实现