如何更新Passenger Enterprise与Nginx组合至1.13.2+以满足PCI合规？

Absolutely, there's a reliable way to upgrade your Nginx version (from 1.12.2 to 1.13.2+) while keeping Passenger Enterprise fully functional. Below are the most trusted approaches, tailored to different deployment setups:

1. First: Verify Passenger-Nginx Compatibility #

Before diving in, confirm your current Passenger Enterprise version supports Nginx 1.13.2+. Most modern Passenger releases (5.1 and newer) work with these newer Nginx versions. If you're on an older Passenger build, you'll need to upgrade Passenger first before updating Nginx—this avoids compatibility gaps.

2. Compile Custom Nginx with Passenger Integration (Recommended) #

Compiling Nginx from source with the Passenger module is the most flexible method, ensuring full control over versions and modules. Here's how:

• Stop your running Nginx service first:

  sudo systemctl stop nginx
  # Or for non-systemd systems: sudo service nginx stop
  

• Download your target Nginx version (pick a stable release that meets PCI, like 1.24.0—newer is better for security):

  wget http://nginx.org/download/nginx-1.24.0.tar.gz
  

• Unpack the source and navigate into the directory:

  tar -xzf nginx-1.24.0.tar.gz && cd nginx-1.24.0
  

• Get the Passenger Nginx add-on directory path (this links Passenger to your custom Nginx build):

  passenger-config --nginx-addon-dir
  

• Configure the Nginx build, making sure to include SSL support (required for PCI) and the Passenger module:

  ./configure --prefix=/usr/local/nginx \
  --with-http_ssl_module \
  --add-module=$(passenger-config --nginx-addon-dir)
  

  Adjust the --prefix to match your existing Nginx installation path if needed.
• Compile and install the new Nginx:

  make && sudo make install
  

• Replace your system's default Nginx executable with the new build (adjust paths as needed):

  sudo ln -sf /usr/local/nginx/sbin/nginx /usr/sbin/nginx
  

• Verify the upgrade and check Passenger status:

  nginx -v # Should show your new version
  passenger-status # Confirm Passenger is running correctly
  

• Start Nginx back up:

  sudo systemctl start nginx
  

3. Use Official Package Repositories (If Available) #

If you installed Passenger and Nginx via official package managers (APT/YUM), you can often upgrade directly:

• Update your package lists:

  # Debian/Ubuntu
  sudo apt update
  
  # RHEL/CentOS
  sudo yum update
  

• Install the specific Nginx version you need, ensuring it pairs with a compatible Passenger package:

  # Example for Ubuntu 18.04 (bionic)
  sudo apt install nginx=1.24.0-1~bionic passenger
  

• Restart Nginx and validate the setup:

  sudo systemctl restart nginx
  nginx -v && passenger-status
  

Critical Pre/Post-Upgrade Checks #

• Backup your configs: Always copy the /etc/nginx/ directory before making changes—this saves you if something breaks.
• Test config syntax: Run sudo nginx -t before restarting Nginx to catch any errors.
• Tweak SSL for PCI: Ensure your Nginx SSL config meets PCI standards (disable old protocols, use strong ciphers):

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers off;
  

• Monitor your apps: After upgrading, check that all your Passenger-hosted apps load correctly and there are no runtime errors.

内容的提问来源于stack exchange，提问作者Alex Levine