<p>Sebelumnya saya telah menulis panduan untuk mendapatkan hasil nilai A+ pada Qualys SSL dengan menggunakan engine Apache2, bisa dilihat disini panduannya >;>;>; <a href="https://rizkypratama.id/blog/2018/06/13/tips-mendapatkan-nilai-a-pada-hasil-qualys-ssl-labs-apache/" target="_blank" rel="noopener noreferrer">Tips Mendapatkan Nilai A+ pada Hasil Qualys SSL Labs dengan Apache</a></p>
<p>Nahh untuk kali ini kita akan coba menggunakan Nginx sebagai web server nya, dan akan disetup sedemikian rupa agar ketika di cek pada Qualys SSL, akan mendapatkan nilai A+</p>
<p>Langsung saja berikut tahapannya, disini saya menggunakan Ubuntu 20.04 sebagai OS nya</p>
<p>1. Siapkan file SSL Certificate</p>
<p>Yang pertama dibutuhkan yaitu SSL Certificate, bagi yang belum memilikinya, Excellent provide untuk layanan SSL Certificate tersebut, monggo yang mau baca-baca dahulu kelebihannya, bisa klik disini <a href="https://www.excellent.co.id/ssl/" target="_blank" rel="noopener noreferrer">https://www.excellent.co.id/ssl/</a></p>
<p>2. Install SSL Certificate pada Virtual Host</p>
<p>Jika sudah memiliki file SSL, siapkan file SSL berformat .pem, kemudian Install SSL tersebut pada salah 1 file virtual host yang akan di setup, biasanya letaknya ada di directory /etc/nginx/sites-available. Di bagian section server untuk listen 443 ssl http2, tambahkan script berikut tepat dibawah server_name</p>
<pre>ssl_certificate /etc/nginx/ssl/commercial.pem; 
ssl_certificate_key /etc/nginx/ssl/commercial.pem; 
ssl_protocols TLSv1.2;</pre>
<p>3. Konfigurasi SSL Cipher</p>
<p>Untuk meningkatkan nilai SSL, diwajibkan untuk konfigurasi SSL Cipher ini, misal mendisable cipher yang sudah weak dll. Silakan tambahkan script berikut dibawah ssl_protocol</p>
<pre>ssl_prefer_server_ciphers on; 
ssl_ciphers TLS-CHACHA20-POLY1305-SHA256:TLS-AES-256-GCM-SHA384:TLS-AES-128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4; 
</pre>
<p>4. Aktivasi HSTS</p>
<p>HSTS merupakan mekanisme keamanan website yang memaksa web browser untuk mengakses website hanya via HTTPS. HSTS juga dapat mencegah dari protocol downgrade attacks dan cookie hijacking. Untuk aktivasinya, silakan tambahkan script berikut ini tepat dibawah ssl_ciphers</p>
<pre>add_header Strict-Transport-Security "max-age=63072000; preload";</pre>
<p>Berikut ini salah satu contoh file virtualhost yang saya set :</p>
<pre>server { 
access_log /var/log/nginx/nextcloud.rizkypratama.id-access.log; 
log_not_found off; 
error_log /var/log/nginx/nextcloud.rizkypratama.id-error_log; 
 
 listen 443 ssl http2; 
 server_name nextcloud.rizkypratama.id; 
 
 <span style="color: #ff0000;">ssl_certificate /etc/nginx/ssl/commercial.pem; 
 ssl_certificate_key /etc/nginx/ssl/commercial.pem; 
	ssl_protocols TLSv1.2; 
	ssl_prefer_server_ciphers on; 
	ssl_ciphers TLS-CHACHA20-POLY1305-SHA256:TLS-AES-256-GCM-SHA384:TLS-AES-128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4;</span> 
	<span style="color: #ff0000;">add_header Strict-Transport-Security "max-age=63072000; preload";</span> 
	add_header Referrer-Policy no-referrer always; 
	add_header X-Content-Type-Options nosniff; 
	add_header X-XSS-Protection "1; mode=block"; 
	add_header X-Robots-Tag none; 
	add_header X-Download-Options noopen; 
	add_header X-Permitted-Cross-Domain-Policies none; 
	add_header X-Frame-Options "SAMEORIGIN"; 
 
 
 location ~* .(gif|jpg|jpeg|png|ico|wmv|3gp|avi|mpg|mpeg|mp4|flv|mp3|mid|js|css|wml|swf)$ { 
 root /var/www/nextcloud; 
 expires max; 
 add_header Pragma public; 
 add_header Cache-Control "public, must-revalidate, proxy-revalidate"; 
 } 
 
 location / { 
 root /var/www/nextcloud; 
 index index.php index.html index.htm; 
 
 # WordPress permalinks configuration 
 try_files $uri $uri/ /index.php?$args; 
 } 
 
 
# php-parsing 
 location ~ .php$ { 
	root	/var/www/nextcloud; 
	try_files $uri =404; 
	fastcgi_pass	unix:/var/run/php/php7.4-fpm.sock; 
	fastcgi_index index.php; 
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; 
	include	fastcgi_params; 
	fastcgi_buffer_size 128k; 
	fastcgi_read_timeout 150; 
	fastcgi_buffers 256 4k; 
	fastcgi_busy_buffers_size 256k; 
	fastcgi_temp_file_write_size 256k; 
	} 
} 
</pre>
<p>Jika sudah, silakan save dan restart nginx nya</p>
<pre>service nginx restart</pre>
<p>Sekarang silakan di cek di Qualys SSL Labs Test untuk mengecek hasilnya dan mendapatkan nilai berapa</p>
<p><a href="https://www.ssllabs.com/ssltest/" target="_blank" rel="noopener noreferrer">https://www.ssllabs.com/ssltest/</a></p>
<p>Berikut hasil dari salah 1 web saya yang sudah mendapat nilai A+</p>
<p><a href="https://rizkypratama.id/wp-content/uploads/2018/12/Screen-Shot-2020-11-06-at-14.03.11.png"><img data-attachment-id="2135" data-permalink="https://rizkypratama.id/blog/2018/12/27/tips-mendapatkan-nilai-a-pada-hasil-qualys-ssl-labs-dengan-nginx/screen-shot-2020-11-06-at-14-03-11/" data-orig-file="https://i0.wp.com/rizkypratama.id/wp-content/uploads/2018/12/Screen-Shot-2020-11-06-at-14.03.11.png?fit=1063%2C551&;ssl=1" data-orig-size="1063,551" data-comments-opened="1" data-image-meta="{";aperture";:";0";,";credit";:";";,";camera";:";";,";caption";:";";,";created_timestamp";:";0";,";copyright";:";";,";focal_length";:";0";,";iso";:";0";,";shutter_speed";:";0";,";title";:";";,";orientation";:";0";}" data-image-title="Screen Shot 2020-11-06 at 14.03.11" data-image-description="" data-image-caption="" data-medium-file="https://i0.wp.com/rizkypratama.id/wp-content/uploads/2018/12/Screen-Shot-2020-11-06-at-14.03.11.png?fit=300%2C156&;ssl=1" data-large-file="https://i0.wp.com/rizkypratama.id/wp-content/uploads/2018/12/Screen-Shot-2020-11-06-at-14.03.11.png?fit=1024%2C531&;ssl=1" class="aligncenter wp-image-2135 size-full" src="https://rizkypratama.id/wp-content/uploads/2018/12/Screen-Shot-2020-11-06-at-14.03.11.png" alt="SSL Result" width="1063" height="551" /></a></p>
<p>Mungkin cukup sekian, semoga bermanfaat</p>
<div class="clearfix"></div><div class="saboxplugin-wrap" itemtype="http://schema.org/Person" itemscope itemprop="author"><div class="saboxplugin-tab"><div class="saboxplugin-gravatar"><img src="https://rizkypratama.id/wp-content/uploads/2020/09/My-Photos.jpg" width="100" height="100" alt="My Photos" itemprop="image"></div><div class="saboxplugin-authorname"><a href="https://rizkypratama.id/blog/author/rizky/" class="vcard author" rel="author"><span class="fn">Rizky Pratama</span></a></div><div class="saboxplugin-desc"><div itemprop="description"><p>Rizky Pratama. Tinggal di Bekasi, Jawa Barat. Seorang IT di salah satu perusahaan IT. Pengguna Mac, Linux dan Windows<br />
Selain sebagai penulis di blog ini, saya juga penulis di blog saya yang lain, yaitu <a href="https://pratama.biz.id" target="_blank" rel="noopener noreferrer">https://pratama.biz.id</a></p>
</div></div><div class="saboxplugin-web "><a href="https://rizkypratama.id" target="_blank" >rizkypratama.id</a></div><div class="clearfix"></div><div class="saboxplugin-socials sabox-colored"><a title="Facebook" target="_blank" href="https://web.facebook.com/rizkypratama04" rel="nofollow noopener" class="saboxplugin-icon-color"><svg class="sab-facebook" viewBox="0 0 500 500.7" xml:space="preserve" xmlns="http://www.w3.org/2000/svg"><path class="st0" d="m499.4 250.9c0 9.9-0.6 19.7-1.7 29.2-0.1 0.6-0.1 1.1-0.2 1.7-0.8 6.3-1.8 12.4-3 18.5-0.2 1.1-0.5 2.2-0.7 3.3-1.2 5.6-2.6 11-4.2 16.5-23.4 81.3-87.1 145.6-168.2 169.8-4.5 1.3-9.1 2.6-13.7 3.7-7.6 1.8-15.4 3.3-23.3 4.4-5.5 0.8-11.1 1.3-16.7 1.7-0.8 0.1-1.6 0.1-2.4 0.1-5 0.3-10.1 0.4-15.2 0.4-137.8 0-249.4-111.6-249.4-249.3s111.6-249.4 249.4-249.4 249.3 111.7 249.3 249.4z" fill="#3b5998" /><path class="st1" d="m493.8 303.6c-1.2 5.6-2.6 11-4.2 16.5-23.4 81.3-87.1 145.6-168.2 169.8-4.5 1.3-9.1 2.6-13.7 3.7l-100.9-101 1.8-3.5 2.1-76.7-45.3-43.7 41.3-31 30-95.3 71.4-24.7 185.7 185.9z" /><path class="st2" d="M206.8,392.6V268.8h-41.5v-49.2h41.5v-38.8c0-42.1,25.7-65,63.3-65c18,0,33.5,1.4,38,1.9v44H282 c-20.4,0-24.4,9.7-24.4,24v33.9h46.1l-6.3,49.2h-39.8v123.8" /></svg></span></a><a title="Instagram" target="_blank" href="https://www.instagram.com/rzkyprtmaaa01/" rel="nofollow noopener" class="saboxplugin-icon-color"><svg class="sab-instagram" viewBox="0 0 500 500.7" xml:space="preserve" xmlns="http://www.w3.org/2000/svg"><path class="st0" d="m499.8 250.7c0 7.6-0.4 15.2-1 22.6-0.2 2.2-0.4 4.4-0.7 6.6-0.1 0.6-0.1 1.1-0.2 1.7-0.3 2.6-0.7 5.2-1.1 7.7-0.4 2.3-0.8 4.7-1.2 7 0 0.3-0.1 0.6-0.2 0.9-0.2 1-0.4 1.9-0.5 2.9-0.2 0.8-0.4 1.6-0.5 2.5-0.1 0.3-0.1 0.5-0.2 0.8-0.7 3.3-1.5 6.5-2.3 9.7-0.6 2.3-1.2 4.5-1.9 6.8-23.4 81.3-87.1 145.6-168.2 169.8-3 0.9-6.1 1.8-9.2 2.6-1.5 0.4-3 0.8-4.5 1.1-3.6 0.9-7.2 1.6-10.9 2.3-0.2 0-0.5 0.1-0.7 0.1l-3 0.6c-1.8 0.3-3.6 0.6-5.4 0.9-0.2 0-0.3 0.1-0.5 0.1-0.9 0.1-1.9 0.3-2.8 0.4-5.5 0.8-11.1 1.3-16.7 1.7-0.8 0.1-1.6 0.1-2.4 0.1-5 0.3-10.1 0.4-15.2 0.4-137.7 0-249.3-111.6-249.3-249.3s111.6-249.4 249.3-249.4 249.3 111.7 249.3 249.4z" fill="#405de6" /><path class="st1" d="m495.4 297.2c-0.2 1-0.4 1.9-0.5 2.9-0.2 0.8-0.4 1.6-0.5 2.5-0.1 0.3-0.1 0.5-0.2 0.8-0.7 3.3-1.5 6.5-2.3 9.7-0.6 2.3-1.2 4.5-1.9 6.8-23.4 81.3-87.1 145.6-168.2 169.8-3 0.9-6.1 1.8-9.2 2.6-1.5 0.4-3 0.8-4.5 1.1-3.6 0.9-7.2 1.6-10.9 2.3-0.2 0-0.5 0.1-0.7 0.1l-151.5-152.7v-147l9.2-27 14.8-14 33-8 70-5 80.5 11.7 142.9 143.4z" /><path class="st2" d="m252.7 192.1c-34.1 0-61.6 27.5-61.6 61.6s27.5 61.6 61.6 61.6 61.6-27.5 61.6-61.6-27.5-61.6-61.6-61.6zm0 101.6c-22 0-40-17.9-40-40s17.9-40 40-40 40 17.9 40 40-17.9 40-40 40zm78.5-104.1c0 8-6.4 14.4-14.4 14.4s-14.4-6.4-14.4-14.4 6.4-14.4 14.4-14.4c7.9 0 14.4 6.4 14.4 14.4zm40.7 14.6c-0.9-19.2-5.3-36.3-19.4-50.3-14-14-31.1-18.4-50.3-19.4-19.8-1.1-79.2-1.1-99.1 0-19.2 0.9-36.2 5.3-50.3 19.3s-18.4 31.1-19.4 50.3c-1.1 19.8-1.1 79.2 0 99.1 0.9 19.2 5.3 36.3 19.4 50.3s31.1 18.4 50.3 19.4c19.8 1.1 79.2 1.1 99.1 0 19.2-0.9 36.3-5.3 50.3-19.4 14-14 18.4-31.1 19.4-50.3 1.2-19.9 1.2-79.2 0-99zm-25.6 120.2c-4.2 10.5-12.3 18.6-22.8 22.8-15.8 6.3-53.3 4.8-70.8 4.8s-55 1.4-70.8-4.8c-10.5-4.2-18.6-12.3-22.8-22.8-6.3-15.8-4.8-53.3-4.8-70.8s-1.4-55 4.8-70.8c4.2-10.5 12.3-18.6 22.8-22.8 15.8-6.3 53.3-4.8 70.8-4.8s55-1.4 70.8 4.8c10.5 4.2 18.6 12.3 22.8 22.8 6.3 15.8 4.8 53.3 4.8 70.8s1.5 55.1-4.8 70.8z" /></svg></span></a><a title="User email" target="_self" href="mailto:&#114;&#105;&#122;&#107;y&#064;&#114;&#105;&#122;ky&#112;ratama.id" rel="nofollow noopener" class="saboxplugin-icon-color"><svg class="sab-user_email" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 500 500.7"><path class="st0" d="M499.4 250.9c0 2.2 0 4.4-0.1 6.6v0.4c-0.1 1.8-0.2 3.6-0.2 5.3 0 0.4 0 0.8-0.1 1.2 -0.1 1.3-0.1 2.6-0.2 4 -0.1 1.7-0.2 3.3-0.4 5 0 0.2 0 0.4-0.1 0.6 -0.2 2-0.4 4.1-0.6 6.1 -0.1 0.6-0.1 1.1-0.2 1.7 -0.7 4.4-1.3 8.8-2 13.2 0 0.4-0.1 0.7-0.2 1v0.3c-0.2 1-0.4 2-0.5 3 0 0.1 0 0.2-0.1 0.3v0.1c0 0.2-0.1 0.4-0.1 0.6 -0.1 0.5-0.2 1-0.3 1.6 0 0.2-0.1 0.3-0.1 0.5 -0.6 2.6-1.2 5.2-1.8 7.8 -0.4 1.8-0.9 3.6-1.3 5.5 -0.2 0.9-0.5 1.9-0.8 2.8 -0.2 0.6-0.3 1.1-0.5 1.7 -0.8 2.7-1.6 5.3-2.5 8 -1.4 4.2-2.8 8.5-4.4 12.5 -0.1 0.4-0.3 0.7-0.4 1.1 -0.9 2.3-1.8 4.6-2.8 6.8 -28.1 66.2-84.2 117.8-153.5 140 -0.5 0.2-0.9 0.3-1.3 0.4 -1.1 0.4-2.2 0.7-3.3 1 -2.9 0.9-5.9 1.6-8.8 2.4 -0.1 0-0.2 0.1-0.3 0.1 -0.4 0.1-0.7 0.2-1.1 0.3 -1 0.3-2.1 0.6-3.1 0.8 -1 0.3-2 0.5-3.1 0.6 -0.1 0-0.2 0-0.3 0.1 -1 0.2-1.9 0.4-2.9 0.7 -0.3 0.1-0.7 0.2-1 0.2 -0.2 0.1-0.5 0.1-0.7 0.2 -1.5 0.3-2.9 0.5-4.3 0.8 -0.6 0.1-1.3 0.2-1.9 0.4 -0.2 0-0.3 0.1-0.5 0.1 -1.1 0.2-2.2 0.4-3.3 0.6 -1.2 0.2-2.4 0.4-3.5 0.5 -0.7 0.1-1.4 0.2-2.1 0.3 -0.3 0-0.5 0.1-0.8 0.1 -2.7 0.4-5.5 0.7-8.2 1 -0.3 0-0.7 0.1-1 0.1 -0.1 0-0.1 0-0.2 0 -1.1 0.1-2.1 0.2-3.2 0.3 -0.1 0-0.1 0-0.2 0 -1 0.1-2.1 0.2-3.2 0.2 -0.8 0.1-1.6 0.1-2.4 0.1 -1.4 0.1-2.9 0.2-4.4 0.2 -3.6 0.1-7.2 0.2-10.8 0.2 -4.3 0-8.7-0.1-13-0.3C105.4 493.1 0.7 384.3 0.7 250.9 0.7 113.2 112.3 1.5 250.1 1.5c129.3 0 235.3 98.2 248 223.9 0.5 4.4 0.8 8.9 1 13.3 0.1 1.5 0.1 3 0.2 4.6C499.4 245.8 499.4 248.4 499.4 250.9z" fill="#F97E2A" /><path class="st1" d="M499.1 263.2c0 0.4 0 0.8-0.1 1.2 -0.1 1.3-0.1 2.6-0.2 4 -0.1 1.7-0.2 3.3-0.4 5 0 0.2 0 0.4-0.1 0.6 -0.2 2-0.4 4.1-0.6 6.1 -0.1 0.6-0.1 1.1-0.2 1.7 -0.7 4.4-1.3 8.8-2 13.2 0 0.4-0.1 0.7-0.2 1v0.3c-0.2 1-0.4 2-0.5 3 0 0.1 0 0.2-0.1 0.3v0.1c0 0.2-0.1 0.4-0.1 0.6 -0.1 0.5-0.2 1-0.3 1.6 0 0.2-0.1 0.3-0.1 0.5 -0.6 2.6-1.2 5.2-1.8 7.8 -0.4 1.8-0.9 3.6-1.3 5.5 -0.2 0.9-0.5 1.9-0.8 2.8 -0.2 0.6-0.3 1.1-0.5 1.7 -0.8 2.7-1.6 5.3-2.5 8 -1.4 4.2-2.8 8.5-4.4 12.5 -0.1 0.4-0.3 0.7-0.4 1.1 -0.9 2.3-1.8 4.6-2.8 6.8 -28.1 66.2-84.2 117.8-153.5 140 -0.5 0.2-0.9 0.3-1.3 0.4 -1.1 0.4-2.2 0.7-3.3 1 -2.9 0.9-5.9 1.6-8.8 2.4 -0.1 0-0.2 0.1-0.3 0.1 -0.4 0.1-0.7 0.2-1.1 0.3 -1 0.3-2.1 0.6-3.1 0.8 -1 0.3-2 0.5-3.1 0.6 -0.1 0-0.2 0-0.3 0.1 -1 0.2-1.9 0.4-2.9 0.7 -0.3 0.1-0.7 0.2-1 0.2 -0.2 0.1-0.5 0.1-0.7 0.2 -1.5 0.3-2.9 0.5-4.3 0.8 -0.6 0.1-1.3 0.2-1.9 0.4 -0.2 0-0.3 0.1-0.5 0.1 -1.1 0.2-2.2 0.4-3.3 0.6 -1.2 0.2-2.4 0.4-3.5 0.5 -0.7 0.1-1.4 0.2-2.1 0.3 -0.3 0-0.5 0.1-0.8 0.1 -2.7 0.4-5.5 0.7-8.2 1 -0.3 0-0.7 0.1-1 0.1L119.9 344.1l105.3-46.7L119.9 191.6l265.6-41.2L499.1 263.2z" /><path class="st2" d="M390.1 214.1c2.1-1.7 5.3-0.1 5.3 2.6v112c0 14.5-11.8 26.3-26.3 26.3H141.2c-14.5 0-26.3-11.8-26.3-26.3v-112c0-2.7 3.1-4.3 5.3-2.6 12.3 9.5 28.5 21.6 84.4 62.2 11.6 8.4 31.1 26.2 50.5 26.1 19.6 0.2 39.4-18 50.6-26.1C361.6 235.7 377.8 223.6 390.1 214.1zM255.1 284.8c12.7 0.2 31-16 40.2-22.7 72.7-52.8 78.2-57.4 95-70.5 3.2-2.5 5-6.3 5-10.4v-10.4c0-14.5-11.8-26.3-26.3-26.3H141.2c-14.5 0-26.3 11.8-26.3 26.3v10.4c0 4.1 1.9 7.8 5 10.4 16.8 13.1 22.3 17.7 95 70.5C224.1 268.8 242.4 285 255.1 284.8L255.1 284.8z" /></svg></span></a></div></div></div>
Beberapa hari yang lalu saat saya sedang scroll timeline X (Twitter) saya menemukan sebuah postingan…
Beberapa waktu lalu saya ada migrasi dan upgrade beberapa server, salah satunya server postfix. Server…
Pada bulan April 2024 lalu, Ubuntu telah release versi terbaru yaitu Ubuntu 24.04 LTS, sehingga…
Ngga nyangka akhirnya saya bisa login kembali ke blog saya yang sudah berdebu ini, kali…
Beberapa waktu lalu, Excellent mendapatkan project migrasi Zimbra dari versi Open Source Ke Zimbra Network…
Bulan Oktober 2022 lalu, Apple resmi release MacOS terbaru mereka, yaitu MacOS Ventura. Beberapa fitur…