cru5ader

# yum install epel-release -y
# yum install file man mc p7zip tmux -y
# yum install cpp gcc gcc-c++ make libstdc++-devel pcre-devel zlib-devel -y

$ ./config \
enable-ec_nistp_64_gcc_128 \
no-deprecated \
no-filenames \
no-gost \
no-rc2 \
no-rc4 \
no-srp \
no-srtp \
no-ssl3 \
shared \
threads \
zlib-dynamic
$ make

# cp libcrypto.so.1.1 libssl.so.1.1 /usr/local/lib64
# cd /usr/local/lib64
# ln -s libcrypto.so.1.1 libcrypto.so
# ln -s libssl.so.1.1 libssl.so
# ldconfig /usr/local/lib64
# ldconfig -p

# yum install patch
$ curl -L https://install.perlbrew.pl | bash
$ . ~/perl5/perlbrew/etc/bashrc
$ perlbrew available
$ perlbrew install perl-5.27.6
$ perlbrew list
$ perlbrew use perl-5.27.6
$ perl -v
$ perlbrew install-cpanm
$ cd ~/openssl-1.1.0g/
$ grep -r "/usr/bin/perl" ./
$ sed -i 's/\/usr\/bin\/perl/\/usr\/bin\/env perl/g' ./{Makefile,configdata.pm,test/recipes/80-test_cipherlist.t,test/README,Configurations/{unix-checker.pm,windows-checker.pm}}
$ make test

./configure \
--prefix=/usr/local/share/nginx \
--sbin-path=/usr/local/sbin/nginx \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/lock/subsys/nginx \
--user=nginx \
--group=nginx \
--with-threads \
--with-file-aio \
--http-log-path=/var/log/nginx/access.log \
--http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
--http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
--without-http_ssi_module \
--without-http_scgi_module \
--without-http_uwsgi_module \
--without-http_geo_module \
--without-http_split_clients_module \
--without-http_memcached_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_sub_module \
--with-http_auth_request_module \
--with-http_stub_status_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_v2_module \
--with-cc-opt='-O2 -g -I ../openssl-OpenSSL_1_1_0g/include' \
--with-ld-opt="-L /usr/local/lib64" \

server {
    server_name domain.ru;

    listen 443 ssl http2;

    ssl_certificate            auth-acme/domain.ru.crt;
    ssl_certificate_key        auth-acme/domain.ru.key;
    ssl_session_cache          shared:SSLdsr:2m;
    ssl_session_timeout        15m;
    ssl_ciphers                HIGH:!aNULL:!CAMELLIA:!DSS:!MD5:!PSK:!RC4:+AES128:+AES256:RSA+3DES:+SSLv3;
    ssl_prefer_server_ciphers  on;
    ssl_ecdh_curve             secp384r1;
    add_header                 Strict-Transport-Security  "max-age=15552000";
    resolver                   1.1.1.1 8.8.8.8 ipv6=off;
    resolver_timeout           5s;
    ssl_stapling               on;
    ssl_stapling_verify        on;

    location /.well-known/acme-challenge/ {
        allow all;
        default_type plain/text;
        root /var/www/html/$server_name;
    }
   ...
}