vault backup: 2026-11-07 16:33:44

2026-11-07 16:33:55 +08:00
commit 7015312702
1208 changed files with 132432 additions and 0 deletions
@@ -0,0 +1,249 @@
+我来详细介绍一下如何将铜锁（Tongsuo）作为 OpenSSL 替代与 Nginx 进行编译的完整过程。
+
+## 1. 环境准备
+
+### 安装编译依赖
+```bash
+# Ubuntu/Debian
+sudo apt-get update
+sudo apt-get install -y build-essential libpcre3 libpcre3-dev zlib1g-dev
+
+# CentOS/RHEL
+sudo yum install -y gcc make pcre-devel zlib-devel
+```
+
+## 2. 编译铜锁（Tongsuo）
+
+### 下载铜锁源代码
+```bash
+# 从 GitHub 下载最新版本
+git clone https://github.com/Tongsuo-Project/Tongsuo.git
+cd Tongsuo
+
+# 或者下载特定版本（如 8.3.3）
+wget https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/8.3.3.tar.gz
+tar -xzf 8.3.3.tar.gz
+cd Tongsuo-8.3.3
+```
+
+### 编译安装铜锁
+```bash
+# 配置编译选项
+./config --prefix=/usr/local/tongsuo \
+         --openssldir=/usr/local/tongsuo/ssl \
+         enable-ntls \
+         enable-weak-ssl-ciphers
+
+# 编译并安装
+make -j$(nproc)
+sudo make install
+
+# 配置动态库路径
+echo "/usr/local/tongsuo/lib" | sudo tee /etc/ld.so.conf.d/tongsuo.conf
+sudo ldconfig
+
+# 验证安装
+/usr/local/tongsuo/bin/openssl version
+```
+
+## 3. 编译 Nginx 使用铜锁
+
+### 下载 Nginx 源代码
+```bash
+# 下载最新稳定版 Nginx
+wget http://nginx.org/download/nginx-1.24.0.tar.gz
+tar -xzf nginx-1.24.0.tar.gz
+cd nginx-1.24.0
+```
+
+### 配置 Nginx 编译参数
+```bash
+# 基本配置
+./configure \
+    --prefix=/usr/local/nginx \
+    --with-http_ssl_module \
+    --with-http_v2_module \
+    --with-http_stub_status_module \
+    --with-stream \
+    --with-stream_ssl_module \
+    --with-openssl=/usr/local/tongsuo \
+    --with-openssl-opt="enable-ntls enable-weak-ssl-ciphers" \
+    --with-cc-opt="-I/usr/local/tongsuo/include" \
+    --with-ld-opt="-L/usr/local/tongsuo/lib"
+```
+
+### 编译并安装
+```bash
+make -j$(nproc)
+sudo make install
+```
+
+## 4. NTLS（国密双证书）配置示例
+
+### Nginx 配置文件
+```nginx
+server {
+    listen 443 ssl;
+    server_name example.com;
+    
+    # 国际标准 TLS 证书（RSA/ECC）
+    ssl_certificate /path/to/rsa.crt;
+    ssl_certificate_key /path/to/rsa.key;
+    
+    # 国密证书
+    ssl_certificate /path/to/sm2_sign.crt;
+    ssl_certificate_key /path/to/sm2_sign.key;
+    ssl_enc_certificate /path/to/sm2_enc.crt;
+    ssl_enc_certificate_key /path/to/sm2_enc.key;
+    
+    # 启用 NTLS
+    ssl_enable_ntls on;
+    
+    # 密码套件配置
+    ssl_ciphers "ECC-SM2-WITH-SM4-SM3:ECDHE-SM2-WITH-SM4-SM3";
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+    
+    # 其他配置...
+}
+```
+
+## 5. 编译脚本示例
+
+### 完整的自动化脚本
+```bash
+#!/bin/bash
+# nginx-tongsuo-build.sh
+
+set -e
+
+# 版本配置
+TONGSUO_VERSION="8.3.3"
+NGINX_VERSION="1.24.0"
+INSTALL_DIR="/usr/local"
+
+# 下载并编译铜锁
+echo "正在下载铜锁 ${TONGSUO_VERSION}..."
+cd /tmp
+wget -q https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/${TONGSUO_VERSION}.tar.gz
+tar -xzf ${TONGSUO_VERSION}.tar.gz
+cd Tongsuo-${TONGSUO_VERSION}
+
+echo "编译铜锁..."
+./config --prefix=${INSTALL_DIR}/tongsuo \
+         --openssldir=${INSTALL_DIR}/tongsuo/ssl \
+         enable-ntls \
+         enable-weak-ssl-ciphers \
+         shared
+make -j$(nproc)
+sudo make install
+sudo ldconfig
+
+# 下载并编译 Nginx
+echo "正在下载 Nginx ${NGINX_VERSION}..."
+cd /tmp
+wget -q http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
+tar -xzf nginx-${NGINX_VERSION}.tar.gz
+cd nginx-${NGINX_VERSION}
+
+echo "配置 Nginx..."
+./configure \
+    --prefix=${INSTALL_DIR}/nginx \
+    --with-http_ssl_module \
+    --with-http_v2_module \
+    --with-http_stub_status_module \
+    --with-stream \
+    --with-stream_ssl_module \
+    --with-openssl=${INSTALL_DIR}/tongsuo \
+    --with-openssl-opt="enable-ntls" \
+    --with-cc-opt="-I${INSTALL_DIR}/tongsuo/include" \
+    --with-ld-opt="-L${INSTALL_DIR}/tongsuo/lib"
+
+echo "编译 Nginx..."
+make -j$(nproc)
+sudo make install
+
+# 创建服务文件
+echo "创建 systemd 服务..."
+cat << EOF | sudo tee /etc/systemd/system/nginx.service
+[Unit]
+Description=NGINX with Tongsuo
+After=network.target
+
+[Service]
+Type=forking
+PIDFile=/usr/local/nginx/logs/nginx.pid
+ExecStartPre=/usr/local/nginx/sbin/nginx -t
+ExecStart=/usr/local/nginx/sbin/nginx
+ExecReload=/usr/local/nginx/sbin/nginx -s reload
+ExecStop=/usr/local/nginx/sbin/nginx -s quit
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+echo "安装完成！"
+echo "Nginx 路径: ${INSTALL_DIR}/nginx/sbin/nginx"
+echo "铜锁路径: ${INSTALL_DIR}/tongsuo/bin/openssl"
+```
+
+## 6. Docker 编译示例
+
+```dockerfile
+# Dockerfile
+FROM ubuntu:20.04 AS builder
+
+# 安装依赖
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    build-essential libpcre3-dev zlib1g-dev wget git
+
+# 编译铜锁
+RUN git clone https://github.com/Tongsuo-Project/Tongsuo.git /tongsuo && \
+    cd /tongsuo && \
+    ./config --prefix=/opt/tongsuo enable-ntls && \
+    make -j$(nproc) && \
+    make install
+
+# 编译 Nginx
+RUN wget http://nginx.org/download/nginx-1.24.0.tar.gz && \
+    tar -xzf nginx-1.24.0.tar.gz && \
+    cd nginx-1.24.0 && \
+    ./configure \
+        --prefix=/opt/nginx \
+        --with-http_ssl_module \
+        --with-stream_ssl_module \
+        --with-openssl=/opt/tongsuo \
+        --with-openssl-opt="enable-ntls" && \
+    make -j$(nproc) && \
+    make install
+
+# 运行时镜像
+FROM ubuntu:20.04
+COPY --from=builder /opt /opt
+RUN ldconfig
+CMD ["/opt/nginx/sbin/nginx", "-g", "daemon off;"]
+```
+
+## 7. 验证和测试
+
+```bash
+# 验证 Nginx 版本
+/usr/local/nginx/sbin/nginx -V
+
+# 查看是否包含铜锁支持
+/usr/local/nginx/sbin/nginx -V 2>&1 | grep -i tongsuo
+
+# 测试 NTLS 连接
+openssl s_client -connect localhost:443 -enable_ntls -ntls
+```
+
+## 注意事项
+
+1. **版本兼容性**：确保铜锁和 Nginx 版本兼容
+2. **功能选择**：根据需求选择编译的模块
+3. **生产环境**：建议使用静态链接避免依赖问题
+4. **证书管理**：国密证书需要专门的 CA 机构签发
+5. **性能优化**：可以根据服务器硬件调整编译参数
+
+这样编译出来的 Nginx 就支持国密算法和 NTLS 协议了。