nginx 인증서 및 보안 옵션

-키 및 인증서 생성 

 

sudo openssl req -x509 -nodes -days 365 \
 -newkey rsa:2048 \
 -keyout /etc/nginx/ssl/server.key \
 -out /etc/nginx/ssl/server.crt

-diffie-hellman 파라미터 생성 

 

sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048


-서버설정 예시 

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate           /etc/nginx/ssl/server.crt;
    ssl_certificate_key       /etc/nginx/ssl/server.key;
    ssl_dhparam               /etc/nginx/ssl/dhparam.pem;

    # TLS 버전 (TLS1.3만 사용도 가능)
    ssl_protocols TLSv1.2 TLSv1.3;

    # 강력한 Cipher 설정
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:
                  ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:
                  ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

    ssl_prefer_server_ciphers on;

    # HSTS = 브라우저가 HTTP를 절대 사용하지 않도록
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # 클릭재킹 방지
    add_header X-Frame-Options "DENY";

    # XSS 보호
    add_header X-XSS-Protection "1; mode=block";

    # MIME 스니핑 방지
    add_header X-Content-Type-Options "nosniff";

    # OCSP Stapling (권장)
    ssl_stapling on;
    ssl_stapling_verify on;

    # 로그
    access_log /var/log/nginx/ssl_access.log;
    error_log  /var/log/nginx/ssl_error.log;

    location / {
        proxy_pass http://localhost:8080;
    }
}


-인증서 파일 권한 보안 
sudo chmod 600 /etc/nginx/ssl/server.key
sudo chown root:root /etc/nginx/ssl/server.key


-nginx 설정 테스트 및 reload 
sudo nginx -t
sudo systemctl reload nginx