nginx开启https

生成自签名证书

如果是在运营商处获得的证书，则不用这一步

点击查看代码

mkdir /etc/nginx/ssl
cat > /etc/nginx/ssl/nginx.cnf <<EOF
[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_req
prompt             = no

[ req_distinguished_name ]
C  = CN    
ST = BeiJing(随便写个省份)
L = BeiJing (随便写个城市)
O = BlahBlah (随便写个公司)
OU = BlahBlah (随便写个区域)
CN = aaa.abc.com  # 这里一定是自己即将配置的域名

[ req_ext ]
subjectAltName = @alt_names

[ v3_req ]
subjectAltName = @alt_names

[ alt_names ]
IP.1 = xxx.xxx.xxx
DNS.1 = aaa.abc.com # 这里也是自己即将配置的域名
EOF

cd /etc/nginx/ssl

# 生成私钥
openssl genrsa -out server.key 2048

# 使用OpenSSL配置文件生成自签名证书
openssl req -x509 -new -nodes -key server.key -sha256 -days 3650 -out server.crt -config nginx.cnf

配置nginx

点击查看代码

vim /etc/nginx/sites-enabled/default
server {
	listen 80;
	listen [::]:80;
    listen 443 ssl;
	listen [::]:443 ssl;
    
    #判断，跳转 将所有http服务都跳转到https上
	if ( $scheme = 'http' ) {
		return 302 https://aaa.abc.com/;
	}

	server_name aaa.abc.com;
    #证书 证书的位置 /etc/nginx/ssl
    ssl_certificate ssl/server.crt;
    ssl_certificate_key ssl/server.key;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";

	root /var/www/example.com;
	index index.html;

	location / {
		try_files $uri $uri/ =404;
	}
}

这样就开启了https

但是，咱们这里是自签名证书，在浏览器上访问的时候会被是不被信任或者不安全的链接，所以还需要在浏览器中安装证书