第十七章 Nginx常用HTTPS配置

#1.新建证书存放目录
[root@mjndev conf.d]# mkdir /etc/ssl/private/dm -p

#2.上传证书
[root@mjndev conf.d]# cd /etc/ssl/private/dm
[root@mjndev dm]# rz
[root@mjndev dm]# ll
total 24
-rw-r--r-- 1 root root 23922 Jul  5 10:09 rbcas.com.cn.zip

二、解压证书

[root@mjndev dm]# unzip rbcas.com.cn.zip
[root@mjndev dm]# ll
total 72
-rw-r--r-- 1 root root  4674 Mar 22 11:25 3972117__rbcas.com.cn_apache.zip
-rw-r--r-- 1 root root  5151 Mar 22 11:25 3972117__rbcas.com.cn_iis.zip
-rw-r--r-- 1 root root  3955 Mar 22 11:25 3972117__rbcas.com.cn_jks.zip
-rw-r--r-- 1 root root  4283 Mar 22 11:25 3972117__rbcas.com.cn_nginx.zip
-rw-r--r-- 1 root root  5151 Mar 22 11:25 3972117__rbcas.com.cn_tomcat.zip
-rw-r--r-- 1 root root 23922 Jul  5 10:09 rbcas.com.cn.zip

三、Nginx类型证书

1.解压Nginx证书

#1.解压nginx类型证书
[root@mjndev dm]# unzip 3972117__rbcas.com.cn_nginx.zip
Archive:  3972117__rbcas.com.cn_nginx.zip
Aliyun Certificate Download
  inflating: 3972117__rbcas.com.cn.pem  
  inflating: 3972117__rbcas.com.cn.key  

#2.查看证书
[root@mjndev dm]# ll
total 72
-rw-r--r-- 1 root root  4283 Mar 22 11:25 3972117__rbcas.com.cn_nginx.zip
-rw-r--r-- 1 root root  1679 Mar 22 11:25 3972117__rbcas.com.cn.key
-rw-r--r-- 1 root root  4103 Mar 22 11:25 3972117__rbcas.com.cn.pem  

2.配置Nginx前后端不分离

#1.进入nginx配置目录
[root@mjndev dm]# cd /etc/nginx/conf.d/

#2.编写nginx站点文件
[root@mjndev conf.d]# vim dmtest.rbcas.com.cn.conf
upstream dmtest.rbcas.com.cn {
        server localhost:18080;
}
server {
        listen 80;
        server_name dmtest.rbcas.com.cn;
        return 301 https://$http_host$request_uri;
}
server {
        listen 443 ssl;
        server_name dmtest.rbcas.com.cn;

        ssl_certificate      /etc/ssl/private/dm/3972117__rbcas.com.cn.pem;
        ssl_certificate_key  /etc/ssl/private/dm/3972117__rbcas.com.cn.key;

        ssl_session_timeout 5m;
        ssl_protocols TLSV1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_prefer_server_ciphers on;

        access_log /data/logs/dmtest.rbcas.com.cn_access.log;
        error_log  /data/logs/dmtest.rbcas.com.cn_error.log;

        location /api {
                proxy_headers_hash_max_size 51200;
                proxy_headers_hash_bucket_size 6400;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";

                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_redirect off;

                proxy_pass http://dmtest.rbcas.com.cn;
        }

        location / {
           root /data/webproject/dm/dist;
        }

        location /dm {
           alias /data/webproject/dm/dist;
        }

}

#3.配置站点日志文件
[root@mjndev conf.d]# mkdir /data/logs -p

#4.检查nginx配置
[root@mjndev conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

#5.重载nginx
[root@mjndev conf.d]# nginx -s reload

四、Tomcat类型证书

1.解压Tomcat证书

#1.解压tomcat类型证书
[root@mjndev ~]# cd /etc/ssl/private/dm
[root@mjndev dm]# unzip 3972117__rbcas.com.cn_tomcat.zip

#2.看证书
[root@mjndev dm]# ll
total 80
-rw-r--r-- 1 root root  4834 Mar 22 11:25 3972117__rbcas.com.cn.pfx
-rw-r--r-- 1 root root  5151 Mar 22 11:25 3972117__rbcas.com.cn_tomcat.zip
-rw-r--r-- 1 root root     8 Mar 22 11:25 pfx-password.txt

2.转化pfx证书

#1.生成证书crt和key
[root@mjndev dm]# openssl pkcs12 -in 3972117__rbcas.com.cn.pfx -clcerts -nokeys -out dmtest.rbcas.com.cn.crt
Enter Import Password: ******			#pfx-password.txt的密码
MAC verified OK

[root@mjndev dm]# openssl pkcs12 -in 3972117__rbcas.com.cn.pfx  -nocerts -nodes -out dmtest.rbcas.com.cn.rsa
Enter Import Password: ******			#pfx-password.txt的密码
MAC verified OK

#2.查看所在目录以生成证书
[root@mjndev dm]# ll
total 80
-rw-r--r-- 1 root root  4834 Mar 22 11:25 3972117__rbcas.com.cn.pfx
-rw-r--r-- 1 root root  5151 Mar 22 11:25 3972117__rbcas.com.cn_tomcat.zip
-rw-r--r-- 1 root root  2744 Jul  5 19:16 dmtest.rbcas.com.cn.crt
-rw-r--r-- 1 root root  1850 Jul  5 19:17 dmtest.rbcas.com.cn.rsa
-rw-r--r-- 1 root root     8 Mar 22 11:25 pfx-password.txt
-rw-r--r-- 1 root root 23922 Jul  5 10:09 rbcas.com.cn.zip

#3.验证证书准确性
[root@mjndev dm]# openssl s_server -www -accept 443 -cert ./dmtest.rbcas.com.cn.crt -key ./dmtest.rbcas.com.cn.rsa 

3.配置Nginx

[root@mjndev dm]# vim /etc/nginx/conf.d/dmtest.rbcas.com.cn.conf
upstream dmtest.rbcas.com.cn {
        server localhost:18080;
}
server {
        listen 80;
        server_name dmtest.rbcas.com.cn;
        return 301 https://$http_host$request_uri;
}
server {
        listen 443 ssl;
        server_name dmtest.rbcas.com.cn;

        ssl_certificate      /etc/ssl/private/dm/dmtest.rbcas.com.cn.crt;
        ssl_certificate_key  /etc/ssl/private/dm/dmtest.rbcas.com.cn.rsa;

        ssl_session_timeout 5m;
        ssl_protocols TLSV1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_prefer_server_ciphers on;

        access_log /data/logs/dmtest.rbcas.com.cn_access.log;
        error_log  /data/logs/dmtest.rbcas.com.cn_error.log;

        location /api {
                proxy_headers_hash_max_size 51200;
                proxy_headers_hash_bucket_size 6400;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";

                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_redirect off;

                proxy_pass http://dmtest.rbcas.com.cn;
        }

        location / {
           root /data/webproject/dm/dist;
        }

        location /dm {
           alias /data/webproject/dm/dist;
        }
}

#3.配置站点日志文件
[root@mjndev dm]# mkdir /data/logs -p

#4.检查nginx配置
[root@mjndev dm]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

#5.重载nginx
[root@mjndev dm]# nginx -s reload

五、访问测试

打开浏览器，输入配置nginx时的域名自动跳转到HTTPS，查看证书是否过期即可。