如何彻底移除HTTPS响应中的Nginx Server标识？

Hey there! Let's break down why you're still seeing the Nginx server identifier even after using headers_more_module, and how to fully remove it.

First off, the headers_more_module only handles HTTP response headers—which is why curl -Ik doesn't show the Server: nginx line anymore. The identifier you're seeing when checking HTTPS is likely coming from one of two places: the TLS handshake's Server Hello message (detected by tools like openssl s_client or security scanners) or a caching/CDN layer overriding your Nginx config.

Here's how to address both scenarios:

1. Double-Check Your Nginx HTTP Header Config #

Make sure you've got these settings in your nginx.conf (either in the global http block or your specific HTTPS server block) to cover all HTTP cases:

# Disable version strings in any remaining server-related headers
server_tokens off;

# Fully remove the Server header entirely
more_clear_headers Server;

After adding these, restart Nginx with sudo systemctl restart nginx to apply changes.

2. Obscure or Remove TLS Layer Server Fingerprinting #

Tools like nmap, sslscan, or some security checkers don't look at HTTP headers—they infer the server software from TLS handshake characteristics (like supported protocols, cipher suites, and session handling). To make this harder to detect:

Update SSL/TLS Configurations #

Add these settings to your HTTPS server block to standardize your TLS profile and avoid Nginx-specific fingerprints:

# Use only modern, widely-supported TLS versions
ssl_protocols TLSv1.2 TLSv1.3;

# Use a common set of secure cipher suites (avoid Nginx-specific ones)
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

# Let clients choose the best cipher suite (avoids server-specific ordering)
ssl_prefer_server_ciphers off;

# Disable session tickets to reduce unique fingerprinting
ssl_session_tickets off;

# Use a standard session cache configuration
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

Modify Nginx Source Code (For Full Removal) #

If you want to eliminate any possible reference to Nginx in the TLS layer, you'll need to recompile Nginx after modifying its source code:

1. Open the Nginx source directory, then navigate to src/event/ngx_event_openssl.c
2. Find the ngx_ssl_init function and add this line to disable server-specific TLS behaviors:

   SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SERVER_RENEGOTIATION | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
   

3. Recompile Nginx with your existing flags (including --with-http_ssl_module and --add-module=path/to/headers_more_module)
4. Install and restart Nginx.

3. Check for Caching/CDN Interference #

If your site uses a CDN (like Cloudflare, AWS CloudFront) or a reverse proxy in front of Nginx, those services might be adding their own Server header or preserving the original Nginx identifier. Log into your CDN dashboard and look for settings to remove or mask the server header—most providers have an option to disable this.

Finally, test again using openssl s_client -connect yourdomain.com:443 or a security scanner like Qualys SSL Labs to verify the server identifier is gone.

内容的提问来源于stack exchange，提问作者TrickyExplorer