建立及套用新的密碼組合
密碼套件是認證、加密、訊息驗證碼 (MAC) 和金鑰交換演算法的組合，用來協商 SSL 和 TLS 通訊協定的安全性設定。
為了保證正確的驗證，您必須確保 Citrix Netscaler VPX 使用最佳的密碼組合。
若要進一步瞭解 SSL 密碼組合及其他最佳作法，請造訪下列鏈結：
若要建立優先使用 AEAD、ECDHE 和 ECDSA 密碼的新「密碼組合」，請執行下列程序：
-
在 Citrix VPX CLI 中同時輸入下列指令，並確保全部套用：
add ssl cipher SSLLABS bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256 bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384 bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-ECDSA-AES128-SHA256 bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-ECDSA-AES256-SHA384 bind ssl cipher SSLLABS -cipherName TLS1-ECDHE-ECDSA-AES128-SHA bind ssl cipher SSLLABS -cipherName TLS1-ECDHE-ECDSA-AES256-SHA bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256 bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256 bind ssl cipher SSLLABS -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384 bind ssl cipher SSLLABS -cipherName TLS1-ECDHE-RSA-AES128-SHA bind ssl cipher SSLLABS -cipherName TLS1-ECDHE-RSA-AES256-SHA bind ssl cipher SSLLABS -cipherName TLS1.2-DHE-RSA-AES128-GCM-SHA256 bind ssl cipher SSLLABS -cipherName TLS1.2-DHE-RSA-AES256-GCM-SHA384 bind ssl cipher SSLLABS -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA bind ssl cipher SSLLABS -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA bind ssl cipher SSLLABS -cipherName TLS1-AES-128-CBC-SHA bind ssl cipher SSLLABS -cipherName TLS1-AES-256-CBC-SHA上述指令的語法如下：
add ssl cipher <cipherGroupName> bind ssl cipher <cipherGroupName> -cipherName <string> -
確認密碼已新增至您的 Citrix Netscaler VPX：
> show ssl cipher SSLLABS 1) Cipher Name: TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256 Priority : 1 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES-GCM(128) Mac=AEAD HexCode=0xc02b 2) Cipher Name: TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384 Priority : 2 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES-GCM(256) Mac=AEAD HexCode=0xc02c 3) Cipher Name: TLS1.2-ECDHE-ECDSA-AES128-SHA256 Priority : 3 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES(128) Mac=SHA-256 HexCode=0xc023 4) Cipher Name: TLS1.2-ECDHE-ECDSA-AES256-SHA384 Priority : 4 Description: TLSv1.2 Kx=ECC-DHE Au=ECDSA Enc=AES(256) Mac=SHA-384 HexCode=0xc024 5) Cipher Name: TLS1-ECDHE-ECDSA-AES128-SHA Priority : 5 Description: SSLv3 Kx=ECC-DHE Au=ECDSA Enc=AES(128) Mac=SHA1 HexCode=0xc009 6) Cipher Name: TLS1-ECDHE-ECDSA-AES256-SHA Priority : 6 Description: SSLv3 Kx=ECC-DHE Au=ECDSA Enc=AES(256) Mac=SHA1 HexCode=0xc00a 7) Cipher Name: TLS1.2-ECDHE-RSA-AES128-GCM-SHA256 Priority : 7 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES-GCM(128) Mac=AEAD HexCode=0xc02f 8) Cipher Name: TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 Priority : 8 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES-GCM(256) Mac=AEAD HexCode=0xc030 9) Cipher Name: TLS1.2-ECDHE-RSA-AES-128-SHA256 Priority : 9 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES(128) Mac=SHA-256 HexCode=0xc027 10) Cipher Name: TLS1.2-ECDHE-RSA-AES-256-SHA384 Priority : 10 Description: TLSv1.2 Kx=ECC-DHE Au=RSA Enc=AES(256) Mac=SHA-384 HexCode=0xc028 11) Cipher Name: TLS1-ECDHE-RSA-AES128-SHA Priority : 11 Description: SSLv3 Kx=ECC-DHE Au=RSA Enc=AES(128) Mac=SHA1 HexCode=0xc013 12) Cipher Name: TLS1-ECDHE-RSA-AES256-SHA Priority : 12 Description: SSLv3 Kx=ECC-DHE Au=RSA Enc=AES(256) Mac=SHA1 HexCode=0xc014 13) Cipher Name: TLS1.2-DHE-RSA-AES128-GCM-SHA256 Priority : 13 Description: TLSv1.2 Kx=DH Au=RSA Enc=AES-GCM(128) Mac=AEAD HexCode=0x009e 14) Cipher Name: TLS1.2-DHE-RSA-AES256-GCM-SHA384 Priority : 14 Description: TLSv1.2 Kx=DH Au=RSA Enc=AES-GCM(256) Mac=AEAD HexCode=0x009f 15) Cipher Name: TLS1-DHE-RSA-AES-128-CBC-SHA Priority : 15 Description: SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 HexCode=0x0033 16) Cipher Name: TLS1-DHE-RSA-AES-256-CBC-SHA Priority : 16 Description: SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 HexCode=0x0039 17) Cipher Name: TLS1-AES-128-CBC-SHA Priority : 17 Description: SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 HexCode=0x002f 18) Cipher Name: TLS1-AES-256-CBC-SHA Priority : 18 Description: SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 HexCode=0x0035 Done -
解除虛擬伺服器上預設密碼套件的綁定，並綁定上一步中建立的自訂群組：
unbind ssl vserver https_vip2 -cipherName DEFAULT bind ssl vserver https_vip2 -cipherName SSLLABS bind ssl vserver https_vip2 -eccCurveName ALL上述指令的語法如下：
unbind ssl cipher <cipherGroupName> -cipherName <string> bind ssl vserver <vServerName> -cipherName <string> bind ssl vserver <vServerName> -eccCurveName <eccCurveName> -
確認虛擬伺服器中的變更：
> show ssl vserver https_vip2 [OUTPUT OMITTED] ECC Curve: P_256, P_384, P_224, P_521 1) CertKey Name: hsmclient7ns Server Certificate 1) Cipher Name: SSLLABS Description: User Created Cipher Group Done -
(OPTIONAL) HTTP Redirection 可以啟用，以便在使用者建立 HTTP 請求時，將他們重定向到安全的網站 (相對於 HTTPS )。
有關設定指示，請參閱 如何在 NetScaler 上設定 HTTP 至 HTTPS 重導。
-
開啟 Web 瀏覽器並輸入 FQDN 來測試 HTTPS 連線。 網站會載入由 Citrix VPX 後面的 HTTP 服務所渲染的內容。
您也可以在瀏覽器中點選 URL 旁邊的掛鎖圖示來顯示證書資訊，以檢視證書詳細資料。
如果在步驟五中設定了重定向，安全網站會在使用 HTTP 請求時載入。