[{"data":1,"prerenderedAt":328},["ShallowReactive",2],{"article-101":3,"site-data":58,"article-show-hot-101":172,"article-show-new-101":252},{"article":4,"breadcrumb":18,"category":27,"next":35,"prev":38,"second_categorys":41,"seo":57},{"id":5,"category_id":6,"title":7,"keywords":8,"description":9,"image_url":10,"content":11,"content_md":12,"url":13,"hits":14,"is_recommend":15,"is_top":15,"create_time":16,"update_time":17},101,17,"开启 HTTPS 并获得 ssllabs 满分的过程","开启,获得,满分,过程","准备工作确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。使用官网推荐的CertBot获取证书。在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。安装CertBot12345apt-get updateapt-get install software-properties-commonadd-apt-repository ppa:certbot/certbotapt-get updateapt-get","","\u003Cp style=\"text-align: justify;\">\u003Cb>一、准备工作\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。\u003C/p>\u003Cp style=\"text-align: justify;\">使用官网推荐的CertBot获取证书。\u003C/p>\u003Cp style=\"text-align: justify;\">在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。\u003C/p>\u003Cp style=\"text-align: justify;\">安装CertBot\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get update\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get install software-properties-common\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# add-apt-repository ppa:certbot/certbot\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get update\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# apt-get install python-certbot-nginx\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>二、获取证书\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">我是把几个域名都放到一张证书里的，这样可以支持一些比较旧的，不支持SNI的浏览器\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# certbot certonly --must-staple --rsa-key-size 4096 -d 域名1 -d 域名2...\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">这步的-rsa-key-size 4096是为了ssllabs满分，如果你不想弄这个可以不加，能略微提升网站访问速度。\u003C/p>\u003Cp style=\"text-align: justify;\">每个-d后面跟一个域名，有多少个域名跟多少个\u003C/p>\u003Cp style=\"text-align: justify;\">运行后它会让你选验证模式，我这里已经开启了nginx，因此选2，自己设置webroot\u003C/p>\u003Cp style=\"text-align: justify;\">选1然后输入你的网站静态文件所在的目录，如我的Nginx默认是/var/www/html\u003C/p>\u003Cp style=\"text-align: justify;\">之后每一个域名都需要设置，如果你所有域名都在一个目录，直接选2使用第一次输入的路径即可\u003C/p>\u003Cp style=\"text-align: justify;\">输入完最后一个域名后，它会提示你申请结果，如果失败请检查失败原因后重试，如果成功继续下一步\u003C/p>\u003Cp style=\"text-align: justify;\">我一开始因为用了国内的NS服务商，然后Let’s Encrypt访问不到就失败了，这货不会信任任何DNS服务器给出的服务器地址，必须要直接访问权威NS服务器查询的结果才可以，因此如果你因为这个失败了，建议更换一些国外的免费NS服务商。\u003C/p>\u003Cp style=\"text-align: justify;\">如果成功会告诉你申请成功，并给出你的证书路径，比如我的：/etc/letsencrypt/live/zhl123.cn/fullchain.pem\u003C/p>\u003Cp style=\"text-align: justify;\">记下这个路径(不包括fullchain.pem的部分，稍后用得着)\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>三、配置 DNS CAA\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">DNS CAA 可限制你的域名只有特定的证书签发机构可以签发证书，且无权签发的签发机构收到签发证书申请时会给你发邮件提醒\u003C/p>\u003Cp style=\"text-align: justify;\">这步不影响ssllabs评分，可不做\u003C/p>\u003Cp style=\"text-align: justify;\">你需要找一家支持CAA记录的NS服务商，国内似乎没有。。。\u003C/p>\u003Cp style=\"text-align: justify;\">我找了半天找到一家国外的：https://www.1984hosting.com/\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">通过修改域名的NS记录接入到你选择的NS服务商\u003C/p>\u003Cp style=\"text-align: justify;\">添加CAA记录，比如我的：\u003C/p>\u003Cp style=\"text-align: justify;\">issue \"letsencrypt.org\"\u003C/p>\u003Cp style=\"text-align: justify;\">iodef \"root@zhl123.cn\"\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">issue是允许哪家证书签发机构签发证书，iodef是你的邮箱地址\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">完成后可以通过dig caa 你的域名来验证是否添加成功\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>四、配置 nginx\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">编辑你每一个申请证书的域名的server配置，设置http直接跳到https\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">server {\u003C/p>\u003Cp style=\"text-align: justify;\">  listen 80;\u003C/p>\u003Cp style=\"text-align: justify;\">  server_name 域名;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  return 301 https://$host$request_uri;\u003C/p>\u003Cp style=\"text-align: justify;\">}\u003C/p>\u003Cp style=\"text-align: justify;\">配置每一个域名的 https\u003C/p>\u003Cp style=\"text-align: justify;\">server {\u003C/p>\u003Cp style=\"text-align: justify;\">  # 如果 http2 报错说明你的 nginx 版本比较低不支持，删掉即可\u003C/p>\u003Cp style=\"text-align: justify;\">  listen 443 ssl http2;\u003C/p>\u003Cp style=\"text-align: justify;\">  server_name 域名;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  ssl_certificate 证书路径/fullchain.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">  ssl_certificate_key 证书路径/privkey.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">  ssl_trusted_certificate 证书路径/chain.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  # 强制域名使用 HTTPS 打开，且在证书不被信任时不允许用户跳过，这里设置的时间是 182.5 天\u003C/p>\u003Cp style=\"text-align: justify;\">  # includeSubDomains 表示包含子域名\u003C/p>\u003Cp style=\"text-align: justify;\">  # preload 表示允许被加入浏览器内置的强制 HTTPS 列表中\u003C/p>\u003Cp style=\"text-align: justify;\">  add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains; preload\";\u003C/p>\u003Cp style=\"text-align: justify;\">  # 在检测到 XSS 时阻止网页加载\u003C/p>\u003Cp style=\"text-align: justify;\">  add_header X-XSS-Protection \"1; mode=block\";\u003C/p>\u003Cp style=\"text-align: justify;\">  # 禁止网页被嵌入 frame(算是避免运营商劫持的办法之一)\u003C/p>\u003Cp style=\"text-align: justify;\">  add_header X-Frame-Options DENY;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">  # 后面可以写你的网站之前的代码，如 root /var/www/html;\u003C/p>\u003Cp style=\"text-align: justify;\">}\u003C/p>\u003Cp style=\"text-align: justify;\">配置 nginx.conf，删掉自带的 SSL 配置，用下面的覆盖\u003C/p>\u003Cp style=\"text-align: justify;\"># 只支持 TLS1.2，如果`openssl`在`1.1.1`以上，且`nginx`在`1.13`以上，可再加入`TLSv1.3`\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_protocols TLSv1.2;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_prefer_server_ciphers on;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_timeout 1d;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_cache shared:SSL:10m;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_buffer_size 4k;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA';\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_ecdh_curve sect571r1:secp521r1:brainpoolP512r1:secp384r1:brainpoolP384r1:sect571k1;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_stapling on;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_stapling_verify on;\u003C/p>\u003Cp style=\"text-align: justify;\">开启session_ticket\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">在 nginx 配置目录下执行\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# mkdir ssl\u003C/p>\u003Cp style=\"text-align: justify;\">[root@zhl123.cn ~]# openssl rand 80 > ssl/ticket.key\u003C/p>\u003Cp style=\"text-align: justify;\">编辑nginx.conf，在SSL配置后面加入下面两行\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_ticket_key ssl/ticket.key;\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_session_tickets on;\u003C/p>\u003Cp style=\"text-align: justify;\">使用4096位加密\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">在 nginx 配置目录下执行\u003C/p>\u003Cp style=\"text-align: justify;\">openssl dhparam -out ssl/dhparam.pem 4096\u003C/p>\u003Cp style=\"text-align: justify;\">编辑nginx.conf，在SSL配置后面加入下面两行\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">ssl_dhparam ssl/dhparam.pem;\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>五、一些额外的配置\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">开启 HPKP\u003C/p>\u003Cp style=\"text-align: justify;\">HPKP可以检查你的证书是不是指定的证书签发机构签的，如果不是会阻止访问，也可配置出现问题时向指定地址报告等\u003C/p>\u003Cp style=\"text-align: justify;\">在你的浏览器访问https://www.ssllabs.com/ssltest/analyze.html?d=你的域名\u003C/p>\u003Cp style=\"text-align: justify;\">等测试结束后，在页面搜索Certification Paths\u003C/p>\u003Cp style=\"text-align: justify;\">点击下面的展开\u003C/p>\u003Cp style=\"text-align: justify;\">把第一行不是你的域名的Pin SHA256的值记录下来\u003C/p>\u003Cp style=\"text-align: justify;\">换一个免费证书，再来一次，比如腾讯云可以申请赛门特克的免费证书\u003C/p>\u003Cp style=\"text-align: justify;\">把你刚刚记下来的几个值(至少4个，无顺序要求)，按下面的格式写入你每一个域名的server配置中\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\"># 如果有更多按照格式加就行\u003C/p>\u003Cp style=\"text-align: justify;\">add_header Public-Key-Pins 'pin-sha256=\"第一个值\"; pin-sha256=\"第二个值\"; pin-sha256=\"第三个值\"; pin-sha256=\"第四个值\"; max-age=15768000; includeSubDomains';\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">申请浏览器内置HSTS\u003C/p>\u003Cp style=\"text-align: justify;\">HSTS可以要求用户访问你的网站必须用HTTPS协议，然而需要至少访问一次才会生效，这一次仍然有可能被劫持，而且有可能被一些更无良的运营商给HTTPS强转HTTP，用户永远不会把你加进HSTS名单\u003C/p>\u003Cp style=\"text-align: justify;\">为了解决这个尴尬的问题，浏览器商们推出了一个申请地址，符合要求的域名可以申请把自己加入浏览器的源代码中，这样用户首次访问的时候也会强制用HTTPS访问\u003C/p>\u003Cp style=\"text-align: justify;\">请一定注意，一旦申请成功，就没有回头路了，如果哪天你不想用HTTPS了，那就只能换个域名了。\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">确保你申请证书的时候包含你的主域名，如我的是zhl123.cn，不能带任何子域名，如www.zhl123.cn无效\u003C/p>\u003Cp style=\"text-align: justify;\">确保你照做了上面的4.2\u003C/p>\u003Cp style=\"text-align: justify;\">访问申请页面，输入你的主域名，提交即可，稍后的提示确认，打勾后再提交即可\u003C/p>\u003Cp style=\"text-align: justify;\">耐心等待审核，一般一个月内可审核完成，审核完成之前请不要修改网站配置。\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cb>六、自动重新签发证书\u003C/b>\u003C/p>\u003Cp style=\"text-align: justify;\">Let’s Encrypt申请的证书只有3个月有效期，每隔3个月都手动来重新签发一次。\u003C/p>\u003Cp style=\"text-align: justify;\">通过crontab在每月1号自动重新签发证书\u003C/p>\u003Cp style=\"text-align: justify;\">执行crontab -e,添加下面一行保存即可\u003C/p>\u003Cp style=\"text-align: justify;\">0 0 1 * * certbot renew --force-renew && /etc/init.d/nginx reload\u003C/p>\u003Col style=\"text-align: justify;\">\u003Cli>\u003Cfigure class=\"highlight plain\">\u003C/figure>\u003C/li>\u003C/ol>","**一、准备工作**\n\n确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。\n\n使用官网推荐的CertBot获取证书。\n\n在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。\n\n安装CertBot\n\n[root@zhl123.cn ~]# apt-get update\n\n[root@zhl123.cn ~]# apt-get install software-properties-common\n\n[root@zhl123.cn ~]# add-apt-repository ppa:certbot/certbot\n\n[root@zhl123.cn ~]# apt-get update\n\n[root@zhl123.cn ~]# apt-get install python-certbot-nginx\n\n**二、获取证书**\n\n我是把几个域名都放到一张证书里的，这样可以支持一些比较旧的，不支持SNI的浏览器\n\n[root@zhl123.cn ~]# certbot certonly --must-staple --rsa-key-size 4096 -d 域名1 -d 域名2...\n\n这步的-rsa-key-size 4096是为了ssllabs满分，如果你不想弄这个可以不加，能略微提升网站访问速度。\n\n每个-d后面跟一个域名，有多少个域名跟多少个\n\n运行后它会让你选验证模式，我这里已经开启了nginx，因此选2，自己设置webroot\n\n选1然后输入你的网站静态文件所在的目录，如我的Nginx默认是/var/www/html\n\n之后每一个域名都需要设置，如果你所有域名都在一个目录，直接选2使用第一次输入的路径即可\n\n输入完最后一个域名后，它会提示你申请结果，如果失败请检查失败原因后重试，如果成功继续下一步\n\n我一开始因为用了国内的NS服务商，然后Let’s Encrypt访问不到就失败了，这货不会信任任何DNS服务器给出的服务器地址，必须要直接访问权威NS服务器查询的结果才可以，因此如果你因为这个失败了，建议更换一些国外的免费NS服务商。\n\n如果成功会告诉你申请成功，并给出你的证书路径，比如我的：/etc/letsencrypt/live/zhl123.cn/fullchain.pem\n\n记下这个路径(不包括fullchain.pem的部分，稍后用得着)\n\n**三、配置 DNS CAA**\n\nDNS CAA 可限制你的域名只有特定的证书签发机构可以签发证书，且无权签发的签发机构收到签发证书申请时会给你发邮件提醒\n\n这步不影响ssllabs评分，可不做\n\n你需要找一家支持CAA记录的NS服务商，国内似乎没有。。。\n\n我找了半天找到一家国外的：https://www.1984hosting.com/\n\n通过修改域名的NS记录接入到你选择的NS服务商\n\n添加CAA记录，比如我的：\n\nissue \"letsencrypt.org\"\n\niodef \"root@zhl123.cn\"\n\nissue是允许哪家证书签发机构签发证书，iodef是你的邮箱地址\n\n完成后可以通过dig caa 你的域名来验证是否添加成功\n\n**四、配置 nginx**\n\n编辑你每一个申请证书的域名的server配置，设置http直接跳到https\n\nserver {\n\n  listen 80;\n\n  server_name 域名;\n\n  return 301 https://$host$request_uri;\n\n}\n\n配置每一个域名的 https\n\nserver {\n\n  # 如果 http2 报错说明你的 nginx 版本比较低不支持，删掉即可\n\n  listen 443 ssl http2;\n\n  server_name 域名;\n\n  ssl_certificate 证书路径/fullchain.pem;\n\n  ssl_certificate_key 证书路径/privkey.pem;\n\n  ssl_trusted_certificate 证书路径/chain.pem;\n\n  # 强制域名使用 HTTPS 打开，且在证书不被信任时不允许用户跳过，这里设置的时间是 182.5 天\n\n  # includeSubDomains 表示包含子域名\n\n  # preload 表示允许被加入浏览器内置的强制 HTTPS 列表中\n\n  add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains; preload\";\n\n  # 在检测到 XSS 时阻止网页加载\n\n  add_header X-XSS-Protection \"1; mode=block\";\n\n  # 禁止网页被嵌入 frame(算是避免运营商劫持的办法之一)\n\n  add_header X-Frame-Options DENY;\n\n  # 后面可以写你的网站之前的代码，如 root /var/www/html;\n\n}\n\n配置 nginx.conf，删掉自带的 SSL 配置，用下面的覆盖\n\n# 只支持 TLS1.2，如果`openssl`在`1.1.1`以上，且`nginx`在`1.13`以上，可再加入`TLSv1.3`\n\nssl_protocols TLSv1.2;\n\nssl_prefer_server_ciphers on;\n\nssl_session_timeout 1d;\n\nssl_session_cache shared:SSL:10m;\n\nssl_buffer_size 4k;\n\nssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA';\n\nssl_ecdh_curve sect571r1:secp521r1:brainpoolP512r1:secp384r1:brainpoolP384r1:sect571k1;\n\nssl_stapling on;\n\nssl_stapling_verify on;\n\n开启session_ticket\n\n在 nginx 配置目录下执行\n\n[root@zhl123.cn ~]# mkdir ssl\n\n[root@zhl123.cn ~]# openssl rand 80 > ssl/ticket.key\n\n编辑nginx.conf，在SSL配置后面加入下面两行\n\nssl_session_ticket_key ssl/ticket.key;\n\nssl_session_tickets on;\n\n使用4096位加密\n\n在 nginx 配置目录下执行\n\nopenssl dhparam -out ssl/dhparam.pem 4096\n\n编辑nginx.conf，在SSL配置后面加入下面两行\n\nssl_dhparam ssl/dhparam.pem;\n\n**五、一些额外的配置**\n\n开启 HPKP\n\nHPKP可以检查你的证书是不是指定的证书签发机构签的，如果不是会阻止访问，也可配置出现问题时向指定地址报告等\n\n在你的浏览器访问https://www.ssllabs.com/ssltest/analyze.html?d=你的域名\n\n等测试结束后，在页面搜索Certification Paths\n\n点击下面的展开\n\n把第一行不是你的域名的Pin SHA256的值记录下来\n\n换一个免费证书，再来一次，比如腾讯云可以申请赛门特克的免费证书\n\n把你刚刚记下来的几个值(至少4个，无顺序要求)，按下面的格式写入你每一个域名的server配置中\n\n# 如果有更多按照格式加就行\n\nadd_header Public-Key-Pins 'pin-sha256=\"第一个值\"; pin-sha256=\"第二个值\"; pin-sha256=\"第三个值\"; pin-sha256=\"第四个值\"; max-age=15768000; includeSubDomains';\n\n申请浏览器内置HSTS\n\nHSTS可以要求用户访问你的网站必须用HTTPS协议，然而需要至少访问一次才会生效，这一次仍然有可能被劫持，而且有可能被一些更无良的运营商给HTTPS强转HTTP，用户永远不会把你加进HSTS名单\n\n为了解决这个尴尬的问题，浏览器商们推出了一个申请地址，符合要求的域名可以申请把自己加入浏览器的源代码中，这样用户首次访问的时候也会强制用HTTPS访问\n\n请一定注意，一旦申请成功，就没有回头路了，如果哪天你不想用HTTPS了，那就只能换个域名了。\n\n确保你申请证书的时候包含你的主域名，如我的是zhl123.cn，不能带任何子域名，如www.zhl123.cn无效\n\n确保你照做了上面的4.2\n\n访问申请页面，输入你的主域名，提交即可，稍后的提示确认，打勾后再提交即可\n\n耐心等待审核，一般一个月内可审核完成，审核完成之前请不要修改网站配置。\n\n**六、自动重新签发证书**\n\nLet’s Encrypt申请的证书只有3个月有效期，每隔3个月都手动来重新签发一次。\n\n通过crontab在每月1号自动重新签发证书\n\n执行crontab -e,添加下面一行保存即可\n\n0 0 1 * * certbot renew --force-renew && /etc/init.d/nginx reload\n\n1.","/article/101",18546,0,"2019-11-26 16:12:11","2019-11-26 16:23:16",[19,23,26],{"id":20,"name":21,"url":22},25,"学无止境","/article/lists?category_id=25",{"id":6,"name":24,"url":25},"linux","/article/lists?category_id=17",{"id":5,"name":7,"url":13},{"create_time":10,"description":10,"id":6,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":24,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":29,"subtitle":10,"update_time":10,"url":25},"index",1,"list","article",2,"文章模型","show",{"title":36,"url":37},"如何在MySQL中筛选全表扫描的SQL查询","/article/102",{"title":39,"url":40},"用 Nginx 给 Cookie 增加 Secure 和 HttpOnly","/article/100",[42,43,47,52],{"create_time":10,"description":10,"id":6,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":24,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":29,"subtitle":10,"update_time":10,"url":25},{"create_time":10,"description":10,"id":44,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":45,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":32,"subtitle":10,"update_time":10,"url":46},18,"python","/article/lists?category_id=18",{"create_time":10,"description":10,"id":48,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":49,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":50,"subtitle":10,"update_time":10,"url":51},19,"容器技术",3,"/article/lists?category_id=19",{"create_time":10,"description":10,"id":53,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":54,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":55,"subtitle":10,"update_time":10,"url":56},20,"负载均衡",4,"/article/lists?category_id=20",{"description":9,"keywords":8,"title":7},{"settings":59,"categorys":88,"tree":126,"models":147,"search_model_select":157,"nav_list":159},{"changefreq":60,"changyan_app_id":10,"changyan_app_key":10,"copy":61,"description":62,"editor":63,"file":10,"guest_feedback":64,"head_html":10,"icp":65,"index_banner":66,"index_banner_bg":67,"is_excel":68,"is_watermark":64,"keywords":69,"links":70,"logo":71,"lzcms_banner":10,"lzcms_banner_link":72,"member_register_enabled":68,"qq_app_id":10,"qq_app_key":10,"qr_code":10,"search_model":73,"site_closedreason":10,"site_idea":10,"site_idea1":74,"site_idea2":75,"site_idea3":76,"site_name":24,"site_statistice":10,"site_status":68,"site_url":72,"sitemap_model":73,"stationmaster_motto":77,"stationmaster_name":78,"stationmaster_occupation":79,"stationmaster_qq":80,"stationmaster_qqnet":81,"stationmaster_qqnet_code":82,"threshold":68,"title_add":83,"watermark":10,"watermark_alpha":84,"watermark_height":85,"watermark_locate":86,"watermark_width":87},"weekly","版权所有 © \u003Ca class=\"site_url\" href=\"https://zhl123.com\">2026 zhl123.com\u003C/a>","linux、Python、mysql、docker、k8s技术交流","layedit","0","粤ICP备15054664号-1","/uploads/images/20181109/7a86191de8b8bb60e9c6b54d8b27c5cc.jpg","#xe604","1","linux、Python、mysql、docker、k8s","{\"1\":{\"id\":\"1\",\"link_url\":\"https://linux.org\",\"logo\":\"\",\"name\":\"linux\",\"sort\":\"0\",\"status\":\"1\"}}","/uploads/images/20181109/e7305012448aed257176dd591846f50a.png","https://zhl123.com","2","学无止境\n学习，探索，研究，从不了解到了解，从无知到掌握，到灵活运用，在不断的学习中加深认识。由浅入深，由表及里。","业精于勤\n“业精于勤荒于嬉”，精深的业技靠的是勤学、刻苦努力，靠的是争分夺秒的勤学苦练才会有精深的技术。得在认真，失在随便。","工匠精神\n精益求精，注重细节，追求完美和极致，不惜花费时间精力，孜孜不倦，反复改进产品，把99%提高到99.99%。","业精于勤、学无止境、工匠精神","廖地金","高级Linux运维工程师","1256636645","592958303","\u003Ca target=\"_blank\" href=\"//shang.qq.com/wpa/qunwpa?idkey=09be7d1a682073783fd636102e666393169b8a8aac8f3393da1de57bcaa821a0\">\u003Cimg border=\"0\" src=\"//pub.idqqimg.com/wpa/images/group.png\" alt=\"Linux技术\" title=\"Linux技术\">\u003C/a>"," | Python | mysql | docker | k8s 技术交流","100","300","9","500",{"0":89,"17":99,"18":100,"19":101,"20":102,"21":103,"22":107,"25":111,"26":112,"27":118,"29":123},{"children":90},{"0":91,"25":95,"26":96},[20,92,93,94],21,22,26,[6,44,48,53],[97,98],27,29,{"create_time":10,"description":10,"id":6,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":24,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":29,"subtitle":10,"update_time":10,"url":25},{"create_time":10,"description":10,"id":44,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":45,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":32,"subtitle":10,"update_time":10,"url":46},{"create_time":10,"description":10,"id":48,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":49,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":50,"subtitle":10,"update_time":10,"url":51},{"create_time":10,"description":10,"id":53,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":54,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":55,"subtitle":10,"update_time":10,"url":56},{"create_time":10,"description":10,"id":92,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":104,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":105,"subtitle":10,"update_time":10,"url":106},"分享无价",5,"/article/lists?category_id=21",{"create_time":10,"description":10,"id":93,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":108,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":109,"subtitle":10,"update_time":10,"url":110},"随笔",6,"/article/lists?category_id=22",{"create_time":10,"description":10,"id":20,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":21,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":15,"subtitle":10,"update_time":10,"url":22},{"create_time":10,"description":10,"id":94,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":113,"model_id":50,"model_name":114,"name":115,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":116,"subtitle":10,"update_time":10,"url":117},"picture","图集模型","关于",8,"/picture/lists?category_id=26",{"create_time":10,"description":10,"id":97,"image_url":10,"index_template":28,"is_cover":29,"is_menu":15,"keywords":10,"list_template":30,"model_code":119,"model_id":29,"model_name":120,"name":121,"parent_id":94,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":53,"subtitle":10,"update_time":10,"url":122},"page","单页模型","关于博主","/page/27",{"create_time":10,"description":10,"id":98,"image_url":10,"index_template":28,"is_cover":15,"is_menu":15,"keywords":10,"list_template":30,"model_id":15,"name":124,"parent_id":94,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":53,"subtitle":10,"update_time":10,"url":125},"留言","/feedback",[127,137,139,141],{"children":128,"create_time":10,"description":10,"id":20,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":21,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":15,"subtitle":10,"update_time":10,"url":22},[129,131,133,135],{"children":130,"create_time":10,"description":10,"id":6,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":24,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":29,"subtitle":10,"update_time":10,"url":25},[],{"children":132,"create_time":10,"description":10,"id":44,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":45,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":32,"subtitle":10,"update_time":10,"url":46},[],{"children":134,"create_time":10,"description":10,"id":48,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":49,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":50,"subtitle":10,"update_time":10,"url":51},[],{"children":136,"create_time":10,"description":10,"id":53,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":54,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":55,"subtitle":10,"update_time":10,"url":56},[],{"children":138,"create_time":10,"description":10,"id":92,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":104,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":105,"subtitle":10,"update_time":10,"url":106},[],{"children":140,"create_time":10,"description":10,"id":93,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":108,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":109,"subtitle":10,"update_time":10,"url":110},[],{"children":142,"create_time":10,"description":10,"id":94,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":113,"model_id":50,"model_name":114,"name":115,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":116,"subtitle":10,"update_time":10,"url":117},[143,145],{"children":144,"create_time":10,"description":10,"id":97,"image_url":10,"index_template":28,"is_cover":29,"is_menu":15,"keywords":10,"list_template":30,"model_code":119,"model_id":29,"model_name":120,"name":121,"parent_id":94,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":53,"subtitle":10,"update_time":10,"url":122},[],{"children":146,"create_time":10,"description":10,"id":98,"image_url":10,"index_template":28,"is_cover":15,"is_menu":15,"keywords":10,"list_template":30,"model_id":15,"name":124,"parent_id":94,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":53,"subtitle":10,"update_time":10,"url":125},[],{"1":148,"2":149,"3":150,"4":151,"5":154},{"id":29,"index_template":28,"list_template":30,"name":120,"show_template":34,"status":15,"tablename":119},{"id":32,"index_template":28,"list_template":30,"name":33,"show_template":34,"status":15,"tablename":31},{"id":50,"index_template":28,"list_template":30,"name":114,"show_template":34,"status":15,"tablename":113},{"id":55,"index_template":28,"list_template":30,"name":152,"show_template":34,"status":15,"tablename":153},"链接模型","link",{"id":105,"index_template":28,"list_template":30,"name":155,"show_template":34,"status":15,"tablename":156},"下载模型","download",[158],{"id":32,"name":33,"tablename":31},[160,166,168,170],{"children":161,"create_time":10,"description":10,"id":20,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":21,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":15,"subtitle":10,"update_time":10,"url":22},[162,163,164,165],{"create_time":10,"description":10,"id":6,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":24,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":29,"subtitle":10,"update_time":10,"url":25},{"create_time":10,"description":10,"id":44,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":45,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":32,"subtitle":10,"update_time":10,"url":46},{"create_time":10,"description":10,"id":48,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":49,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":50,"subtitle":10,"update_time":10,"url":51},{"create_time":10,"description":10,"id":53,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":54,"parent_id":20,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":55,"subtitle":10,"update_time":10,"url":56},{"children":167,"create_time":10,"description":10,"id":92,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":104,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":105,"subtitle":10,"update_time":10,"url":106},[],{"children":169,"create_time":10,"description":10,"id":93,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":31,"model_id":32,"model_name":33,"name":108,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":109,"subtitle":10,"update_time":10,"url":110},[],{"children":171,"create_time":10,"description":10,"id":94,"image_url":10,"index_template":28,"is_cover":29,"is_menu":29,"keywords":10,"list_template":30,"model_code":113,"model_id":50,"model_name":114,"name":115,"parent_id":15,"seo_description":10,"seo_keywords":10,"seo_title":10,"show_template":34,"sort":116,"subtitle":10,"update_time":10,"url":117},[],[173,174,183,192,201,210,219,228,237,243],{"id":5,"category_id":6,"title":7,"keywords":8,"description":9,"image_url":10,"url":13,"hits":14,"is_recommend":15,"is_top":15,"create_time":16,"update_time":17},{"id":175,"category_id":6,"title":176,"keywords":177,"description":178,"image_url":10,"url":179,"hits":180,"is_recommend":15,"is_top":15,"create_time":181,"update_time":182},113,"在CentOS 7中添加命令自动补全功能","命令自动补全,centos","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：```sudo yum install bash-completion```安装完成后，需要在/etc/profile配置文件中添加以下内容：```if [ -f /etc/bash_compl","/article/113",14948,"2023-05-16 10:54:01","2023-05-16 10:57:28",{"id":184,"category_id":6,"title":185,"keywords":186,"description":187,"image_url":10,"url":188,"hits":189,"is_recommend":29,"is_top":15,"create_time":190,"update_time":191},94,"Centos7 安装 openvas ","openvas,开放式漏洞评估系统，installing openvas centos-7","一、描述OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。但是它的最常用用途是检测目标网络或","/article/94",14690,"2019-01-14 17:43:42","2019-01-14 18:16:36",{"id":193,"category_id":6,"title":194,"keywords":195,"description":196,"image_url":10,"url":197,"hits":198,"is_recommend":15,"is_top":15,"create_time":199,"update_time":200},99,"Centos7 利用iptables防止nmap工具防端口扫描","iptables","一、Nmap介绍       Nmap（NetworkMapper）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用TCP/IP协议栈特征探测远程主机的操作系统类型。nmap支持很多扫描技术，例如：UDP、TCPconnect()、TCPSYN(半开扫描)、ftp代理(bounce攻击)、反向标志、ICMP、FIN、ACK扫描、圣诞树(XmasTree)、SYN扫描和null扫描。Nmap最初是用于Unix系统","/article/99",14415,"2019-07-09 21:27:00","2019-07-09 21:57:53",{"id":202,"category_id":48,"title":203,"keywords":204,"description":205,"image_url":10,"url":206,"hits":207,"is_recommend":15,"is_top":15,"create_time":208,"update_time":209},61,"Docker 推荐的启动方式","推荐,启动,方式","# cat DockerfileFROM openjdk:8-alpineWORKDIR /ADD ./target/*.jar app.jarEXPOSE 9999COPY docker-entrypoint.sh /RUN chmod +x /docker-entrypoint.shENTRYPOINT [“/docker-entrypoint.sh”]CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]# cat","/article/61",14347,"2018-10-22 13:55:47","2018-10-22 13:56:10",{"id":211,"category_id":6,"title":212,"keywords":213,"description":214,"image_url":10,"url":215,"hits":216,"is_recommend":15,"is_top":15,"create_time":217,"update_time":218},107,"Acme.sh 给 SSL 证书自动续期失败的解决方法","HTTP/1.1 200 OK,Server: Bayou Tech Web Srv 1.0,Content-Encoding: none,Content-Length: 5,Content-Type","一、Acme.sh 自动续期失败的症状问题描述如下，续期的时候，提示如下错误：root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com[Sun Nov 10 23:52:17 CST 2020] Please check log file","/article/107",12618,"2021-09-03 10:44:18","2021-09-03 10:46:23",{"id":220,"category_id":6,"title":221,"keywords":222,"description":223,"image_url":10,"url":224,"hits":225,"is_recommend":29,"is_top":15,"create_time":226,"update_time":227},93,"ELK+Filebeat+Kafka+ZooKeeper 构建海量日志分析平台","Filebeat,Kafka","一、说明1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景4.El","/article/93",12190,"2018-12-24 16:40:08","2018-12-26 11:53:38",{"id":229,"category_id":48,"title":230,"keywords":231,"description":232,"image_url":10,"url":233,"hits":234,"is_recommend":29,"is_top":15,"create_time":235,"update_time":236},81,"kubernetes 1.12.1 高可用安装之部署Dashboard","安装Dashboard","创建Dashboard需要CoreDNS部署成功之后再安装Dashboard。[root@master01 ~]# wget https://zhl123.com/download/k8s/Dashboard.tgz[root@master01 ~]# tar xf Dashboard.tgz[root@master01 ~]# kubectl create -f Dashboard/[root@master01 Dashboard]# kubectl get svc -n kube-syste","/article/81",12037,"2018-10-26 09:54:41","2018-10-26 16:59:19",{"id":238,"category_id":6,"title":39,"keywords":10,"description":239,"image_url":10,"url":40,"hits":240,"is_recommend":15,"is_top":15,"create_time":241,"update_time":242},100,"在 nginx 的 location 中配置12# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strictproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";示例1234567891011121314151617181920212223242526server {    listen 443 ssl http2;    server_name www.zhl123.cn",11848,"2019-11-26 16:10:57","2019-11-26 16:23:45",{"id":244,"category_id":6,"title":245,"keywords":246,"description":247,"image_url":10,"url":248,"hits":249,"is_recommend":15,"is_top":15,"create_time":250,"update_time":251},41,"Tomcat 安全配置与性能优化","tomcat，性能优化","1. JVM 1.1. 使用 Server JRE 替代JDK。 服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 1.2. JAVA_OPTS export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -","/article/41",11623,"2016-09-01 17:06:36","2018-10-18 17:06:58",[253,261,269,277,285,293,301,309,318,327],{"id":254,"category_id":92,"title":255,"keywords":10,"description":256,"image_url":10,"url":257,"hits":258,"is_recommend":15,"is_top":15,"create_time":259,"update_time":260},123,"Agent Skill 精选集：最值得收藏的 Agent Skills Top 10","如果你正在用 Claude Code 或 Codex，一定对 Agent Skills 不陌生。通过安装 Agent Skills，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 Top 10 榜单，加上使用场景和适合人群，帮你快速找到最有用的那几个。Top 10 最受欢迎的 Agent Skills1. Skil","/article/123",270,"2026-01-19 18:49:12","2026-01-19 18:52:01",{"id":262,"category_id":6,"title":263,"keywords":10,"description":264,"image_url":10,"url":265,"hits":266,"is_recommend":15,"is_top":15,"create_time":267,"update_time":268},122,"Nginx性能调优18条黄金法则：支撑10万并发的配置模板","一、概述1.1 背景介绍说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Ngi","/article/122",337,"2026-01-12 11:11:50","2026-01-12 11:12:28",{"id":270,"category_id":48,"title":271,"keywords":10,"description":272,"image_url":10,"url":273,"hits":274,"is_recommend":15,"is_top":15,"create_time":275,"update_time":276},121,"Docker 镜像优化与安全扫描：将镜像体积压缩 70%","1. 适用场景 & 前置条件项目要求适用场景容器化应用镜像体积过大（> 500MB），构建时间长（> 10分钟），存在安全漏洞（CVE高危）OSRHEL/CentOS 7.9+ 或 Ubuntu 20.04+内核Linux Kernel 3.10+软件版本Docker 20.10+ 或 Podman 3.0+，Trivy 0.40+（安全扫描工具）资源规格2C4G（最小）/ 4C8G（推荐），磁盘 50GB+（存储镜像与缓存）网络可访问 Docker Hub/阿里云镜像仓库（","/article/121",309,"2026-01-06 11:54:35","2026-01-06 12:01:59",{"id":278,"category_id":6,"title":279,"keywords":10,"description":280,"image_url":10,"url":281,"hits":282,"is_recommend":15,"is_top":15,"create_time":283,"update_time":284},120,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(二)","五、故障排查和监控5.1 故障排查◆ 5.1.1 日志查看# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernet","/article/120",282,"2026-01-06 11:53:50","2026-01-06 11:54:33",{"id":286,"category_id":6,"title":287,"keywords":10,"description":288,"image_url":10,"url":289,"hits":290,"is_recommend":15,"is_top":15,"create_time":291,"update_time":292},119,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(一)","一、概述1.1 背景介绍在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 Prom","/article/119",301,"2026-01-06 11:51:58","2026-01-06 11:53:45",{"id":294,"category_id":6,"title":295,"keywords":10,"description":296,"image_url":10,"url":297,"hits":298,"is_recommend":15,"is_top":15,"create_time":299,"update_time":300},118,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(二)","四、最佳实践和注意事项4.1 最佳实践4.1.1 性能优化优化点一：减少 Git 轮询频率# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180","/article/118",305,"2026-01-06 11:49:00","2026-01-06 11:49:34",{"id":302,"category_id":6,"title":303,"keywords":10,"description":304,"image_url":10,"url":305,"hits":306,"is_recommend":15,"is_top":15,"create_time":307,"update_time":308},117,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(一)","一、概述1.1 背景介绍GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubec","/article/117",310,"2026-01-06 11:45:03","2026-01-06 11:48:56",{"id":310,"category_id":92,"title":311,"keywords":312,"description":313,"image_url":10,"url":314,"hits":315,"is_recommend":15,"is_top":15,"create_time":316,"update_time":317},116,"运维部门年度2025工作总结与2026工作规划应该如何写？","运维部门年度2025工作总结,2026工作规划","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。现将全年工作及2026年规划汇报如下：2025年核心工作成果（数","/article/116",297,"2026-01-06 11:20:58","2026-01-06 11:44:04",{"id":319,"category_id":92,"title":320,"keywords":321,"description":322,"image_url":10,"url":323,"hits":324,"is_recommend":15,"is_top":15,"create_time":325,"update_time":326},115,"Kubernetes 100个常用命令","100 个 Kubectl 命令","这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩","/article/115",3642,"2023-11-02 14:09:30","2023-11-02 14:10:05",{"id":175,"category_id":6,"title":176,"keywords":177,"description":178,"image_url":10,"url":179,"hits":180,"is_recommend":15,"is_top":15,"create_time":181,"update_time":182},1784716028277]