nginx配置https

nginx配置https

1、使用openssl生成csr、key两个文件

openssl req -new -newkey rsa:2048 -sha256 -nodes -out 域名点变下划线.csr -keyout webuser_dev2_xsyxsc_cn.key -subj "/C=CN/ST=HuNan/L=ChangSha/O=XingShengYouXuan Inc./OU=Web Security/CN=域名"

• 此命令会在当前目录生成csr、key两个文件
• ST：省或州
• L：市
• O：公司
• OU：公司部门...
• CN：你的域名

 

 

2、使用openssl再将csr文件解析为crt文件

openssl x509 -req -days 365 -in 域名点变下划线.csr -signkey 域名点变下划线.key -out 域名点变下划线.crt

 

 

3、在nginx中配置ssl映射关系

server{

        #ssl参数

        listen              443 ssl;

        server_name  域名;

        #证书文件

        ssl_certificate     /etc/nginx/域名点变下划线.crt;

        #私钥文件

        ssl_certificate_key /etc/nginx/域名点变下划线.key;

        charset utf-8;

        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;

        ssl_ciphers         HIGH:!aNULL:!MD5;

        access_log   /etc/nginx/logs/https-user-access.log  main;

        location /api/user/payment  {

            proxy_set_header        Host  $Http_host;

            proxy_set_header        X-Real-IP                       $remote_addr;

            proxy_set_header        X-Forwarded-For         $proxy_add_x_forwarded_for;

            proxy_set_header        X-Queue-Start           "t=${msec}000";

            proxy_pass  http://IP:PORT/XXXX/payment/;

        }

 

 

}

server {

        listen       80;

        server_name  域名;

        charset utf-8;

        access_log   /etc/nginx/logs/user-access.log  main;

.......

 

4、需要运维添加443端口，然后打开防火墙

 

相关技术细节参考链接：

1、 https://aotu.io/notes/2016/08/16/nginx-https/index.html

2、 https://www.cnblogs.com/hnxxcxg/p/7610582.html

 

 

 

 

 

 

 

 

 

 

 

 

====================================================================================================================

 

测试环境一个完整的例子（注意反向代理）

====================================================================================================================

 

#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;
#tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

#gzip on;

server {
listen 80;
server_name 172.16.8.19 localhost;
#charset koi8-r;

#access_log logs/host.access.log main;

location / {
root /home/html/armor-ui;
try_files $uri $uri/ /index.html;
index index.html index.htm;
}

location /prod-api/ {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header REMOTE_HOST $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# 反向代理配置
proxy_pass http://localhost:8888/;
}

location /ftas {
root /home/html/ftasFont;
try_files $uri $uri/ /index.html;
index index.html index.htm;
}

error_page 404 /404.html;

# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}

# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ .php$ {
# proxy_pass http://127.0.0.1;
#}

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ .php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}

# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /.ht {
# deny all;
#}
}

# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;

# location / {
# root html;
# index index.html index.htm;
# }
#}

# HTTPS server
#
#server {
# listen 443 ssl;
# server_name localhost;

# ssl_certificate cert.pem;
# ssl_certificate_key cert.key;

# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 5m;

# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;

# location / {
# root html;
# index index.html index.htm;
# }
#}

}