nginx配置https证书

一，配置流程

1，准备证书文件

本人以阿里云服务器下载的免费证书资源包为例(每个账号可申请一年的免费证书)：

5131387_www.goking.site.key

5131387_www.goking.site.pem

2，在nginx安装目录下创建证书文件夹cert，并把两个证书文件放到里面

cd /usr/local/nginx/conf

mkdir cert

如图把证书放到 /usr/local/nginx/conf/cert下

 3，修改nginx.conf文件，增加https配置项

server {
        listen 443 ssl;
        server_name www.goking.site;
        ssl_certificate cert/5131387_www.goking.site.pem;
        ssl_certificate_key cert/5131387_www.goking.site.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        location / {
           proxy_pass   http://127.0.0.1:80;
           # root   html;
           # index  index.html index.htm;
        }
    }

4，保存配置文件,重启nginx

/user/local/nginx/sbin/nginx -s reload

5，如果使用的是阿里云服务器，请打开对外端口443

6，https已配置成功！

二，问题总结

启动nginx时，报错如下：

nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:37

需要Nginx开启SSL模块，解决如下：

1，进入nginx源码包文件夹

cd /usr/local/nginx-1.16.1/

2, 查看nginx已开启的模块

/usr/local/nginx/sbin/nginx -V

下图是我已开启后的，未开启的没有 --with-http_ssl_module

 3，增加configure参数如下，确认目录并执行

./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

4，进行编译

make

5，拷贝源码编译后的nginx，并先进行备份

cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak

cp ./objs/nginx /usr/local/nginx/sbin/

6，查看是否添加成功

/usr/local/nginx/sbin/nginx -V

 7，重启nginx，ok

/user/local/nginx/sbin/nginx -s reload

三，贴出配置的nginx.conf

以下仅为简单配置，覆盖以下知识点：

1，log日志自定义格式化

2，PHP配置项

3，http、https域名配置

4，nginx代理转发

nginx.conf配置文件如下：

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';
    
    log_format json_combined escape=json '{"@timestamp":"$time_iso8601",'
                      '"@source":"$server_addr",'
                      '"@nginx_fields":{'
                      '"remote_addr":"$remote_addr",'
                      '"remote_user":"$remote_user",'
                      '"body_bytes_sent":"$body_bytes_sent",'
                      '"request_time":"$request_time",'
                      '"status":"$status",'
                      '"host":"$host",'
                      '"uri":"$uri",'
                      '"server":"$server_name",'
                      '"port":"$server_port",'
                      '"protocol":"$server_protocol",'
                      '"request_uri":"$request_uri",'
                      '"request_body":"$request_body",'
                      '"request_method":"$request_method",'
                      '"http_referrer":"$http_referer",'
                      '"body_bytes_sent":"$body_bytes_sent",'
                      '"http_x_forwarded_for":"$http_x_forwarded_for",'
                      '"http_user_agent":"$http_user_agent",'
                      '"upstream_response_time":"$upstream_response_time",'
                      '"upstream_addr":"$upstream_addr"}}';
    access_log  logs/access.log  json_combined;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   /var/www/html;
            index  index.html index.htm index.php;
            try_files $uri $uri/ /napir-cms/index.html;
        }
        location /crm {
            rewrite  ^.+crm/?(.*)$ /$1 break;
            proxy_pass  http://103.228.204.49:8089/ISV/CrmInsideService.svc;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ .php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location /forum {
        #    try_files $uri $uri/ /forum/index.php;
        #}
        location ~* .php$ {
            #root           html;
            root   /var/www/html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            include        fastcgi_params;
            fastcgi_param   SCRIPT_FILENAME    $document_root$fastcgi_script_name;
            fastcgi_param   SCRIPT_NAME        $fastcgi_script_name;
            #fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        }

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #    nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /usr/local/nginx/conf/nginx.conf:108    index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    server {
        #listen 80 default backlog=2048;
        listen 443 ssl;
        #ssl on;
        server_name www.goking.site;
        #root /var/www/html;

        ssl_certificate cert/5131387_www.goking.site.pem;
        ssl_certificate_key cert/5131387_www.goking.site.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        location / {
           proxy_pass   http://127.0.0.1:80;
           # root   html;
           # index  index.html index.htm;
        }
        location /forum {
            try_files $uri $uri /forum/index.php;
        }
        location ~* .php$ {
            root   /var/www/html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            include        fastcgi_params;
            fastcgi_param   SCRIPT_FILENAME    $document_root$fastcgi_script_name;
            fastcgi_param   SCRIPT_NAME        $fastcgi_script_name;
        }
    }
}