安全规范中有一条是要求尽量使用https而弃用http（新Chrome将标记非HTTPS网站为不安全）。
为了满足安全规范，从http改造成https，然而启用https后就可以高枕无忧了吗？
绿盟告诉你：当然不，TLS Client-initiated 重协商攻击(CVE-2011-1473)了解一下。
检测服务是否开启重协商功能（用于CVE-2011-1473漏洞检测）
https://www.cnblogs.com/yurang/p/11532462.html
Jetty9架构解析
https://blog.csdn.net/elinespace?t=1
Jetty9架构解析-Jetty配置及部署（一）
https://blog.csdn.net/elinespace/article/details/52879587
Jetty9架构解析-Jetty配置及部署（二）
https://blog.csdn.net/elinespace/article/details/72864550
安全客
https://www.anquanke.com
How to disable re-negotiate in Spring boot embedded jetty
https://stackoverflow.com/questions/44575917/how-to-disable-re-negotiate-in-spring-boot-embedded-jetty
SSL/TLS协议安全之:不安全的重协商
https://www.anquanke.com/post/id/82989
How to disable Client-Initiated SSL renegotiation in 8.5.1 ?
https://forums.zimbra.org/viewtopic.php?t=55892
Configuring SSL/TLS
https://portail.capsana.ca/doc/9.4.5.v20170502/configuring-ssl.html
Configuring Jetty SSL Ciphers
https://help.percussion.com/rhythmyx/implementation/jetty/configuring-jetty-ssl-ciphers.html
启用HTTPS
https://www.cnblogs.com/zqyx/p/9670636.html
netty的SSL renegotiation攻击漏洞
https://www.cnblogs.com/zqyx/p/10256077.html
配置文件的属性加密
https://www.cnblogs.com/zqyx/p/9687136.html
Tomcat SSL 漏洞加固
http://www.defvul.com/tomcat-ssl
