Nginx配置4-Https网站设置

Nginx配置4 Https网站设置

1 检查是否支持ssl模块

[root@nginx-node01 1.16.0]# ./nginx -V 2>&1 | sed 's/ /\n/g' |grep ssl
--with-http_ssl_module

如果nginx没有http_ssl_module支持，则需要在编译时加入ssl支持，具体参考：Shell编译安装nginx

2 配置Server

将公私钥、CA证书生成中制作好的nginx-node01.crt证书文件和nginx私钥文件放入ssl目录

# HTTPS server

 #增加HTTP强制跳转功能
 server{    
 	listen 80;    
 	server_name www.kov.com;   
    return  301 https://$server_name$request_uri;
}

server {
    listen       443 ssl;
    server_name  www.kov.com;

    ssl_certificate      ssl/nginx-node01.crt;
    ssl_certificate_key  ssl/nginx-node01.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        root   html;
        index  index.html index.htm;
    }
}

3 客户端设置域名

[root@ca CA]# echo 192.168.56.104 www.kov.com >> /etc/hosts

[root@ca CA]# cat /etc/hosts
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost
::1             localhost 
fe80::1%lo0	localhost
......
192.168.56.104 www.kov.com

4 客户端curl测试

客户端添加证书前

[root@ca CA]# curl https://www.kov.com           
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

客户端添加证书后

[root@ca CA]# curl --cacert cacert.pem https://www.kov.com
<!DOCTYPE html>
<html>
<head>
<title>Welcome to www.kov.com!</title>
</head>
<body>
<h1>Welcome to nginx ssl!</h1>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>