godaddy之ssl申请
第一步 执行下面命令生成csr和key文件
openssl req -new -newkey rsa:2048 -nodes -keyout trips.com.key -out trips.com.csr
填写下面信息
Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:Beijing trips International Travel Co.,Ltd Organizational Unit Name (eg, section) []:IT Common Name (e.g. server FQDN or YOUR name) []:*.trips.com Email Address []:ops@trips.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:BJbc201712061438
第二步 使用生成的 csr文件去申请公钥
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
root@BC-BJ-ZW-:/mnt/godaddy-ssl-for-haproxy/# cat trips.com.csr -----BEGIN CERTIFICATE REQUEST----- MIIDHjCCAgYCAQAwgbcxCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdCZWlqaW5nMRAw DgYDVQQHDAdCZWlqaW5nMTcwNQYDVQQKDC5CZWlqaW5nIEJhaWNoZW5nICBJbnRl cm5hdGlvbmFsIFRyYXZlbCBDby4sTHRkMQswCQYDVQQLDAJJVDEdMBsGA1UEAwwU c2VydmljZS5iYWljaGVuZy5jb20xHzAdBgkqhkiG9w0BCQEWEG9wc0BiYWljaGVu Zy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDx9r5Y1lulzLL sQ/kyuj+kbaXqqlfVIaiWAVaWkKtzJFGvM8vCmwQNeSq6cwTPGDpGgUjQE9oS1K/ 5x2IXpgF+yGbhWfI84IbD6YXSn196GrLR9oGqg2dI/dCAfqQ9S1kffhFXk25kmqZ kCQtINephwTHnfRSB73COszHduNf88e6voLzF/y+MIaot URM+YOvGnk1zt9HmfZv2iSM8HZvr/PL/BT90t736QCvUMqB/CsEEdNM7Yj9Zb1jcrG8FUHVOHyS+TvO909+sOhQTJrHEBvDwrWyUiIY LZlq//V1AgMBAAGgITAfBgkqhkiG9w0BCQcxEgwQQkpiYzIwMTcxMjA2MTQzODAN BgkqhkiG9w0BAQsFAAOCAQEAVcqOposcUsHg6YaBauFCb3gXcvvyZjH9elb5nYZO y7i1mOK14Vyjop6dssFcZeFijN3lWfTP51PAtE2XsgdXl63jYsbM4EgJyBonXw+R mltOtegLt6Gp5XcFFTLnNy+iAuFTutGpidh6dHuGLQ8SxfdEATi/G3kh3ziTZWSH DHWXGGwLJUNbOIyiuAhwhCXcQ8WhzhFol0sNAxDc9Zb4ahGv3AMiwhfqm/TCn0PD eVA1yABxI4xetkFptnND9QoXHu3LnHlbM5nVSUz76nRW+9l5GL6iOUVqZOHjb3g+ +9218o6zrbnv5J5oWbz+JKllmlaxtUcLzjwLKqVrjR0d1A== -----END CERTIFICATE REQUEST-----
第三步 godaddy会发生邮件给域名所有者(xiewenming@trips.com)进行授权dsz A记录解析码,添加后用域名所有者收到的邮件进行审核批准
第四步 等待godaddy审核(dv审核很快),审核完成会签发证书,可以下载下来2个crt文件如下
fed50e497f67ebb3.crt
gd_bundle-g2-g1.crt
第五步:在haroxy上面利用上面的文件和域名key生产pem文件,命令如下
cat trips.com.key cafd469e37cef3ca.crt gd_bundle-g2-g1.crt > /etc/ssl/service.trips/trips.com.combined.pem
第六步 添加配置文件
bind *:443 ssl crt /etc/ssl/service.trips/trips.com.combined.pem
nginx证书生成如下
cat cafd469e37cef3ca.crt gd_bundle-g2-g1.crt > trips.com.chained.crt
nginx配置文件
server { listen 80; server_name m.trips.com; listen 443 ssl; ssl on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_dhparam /etc/nginx/conf.d/ssl/dhparam.pem; ssl_certificate /etc/nginx/conf.d/ssl/trips.com.crt; ssl_certificate_key /etc/nginx/conf.d/ssl/trips.com.key; # add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; access_log /var/log/nginx/m.trips.log main; location / { proxy_pass http://192.168.31.53; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #include /etc/nginx/conf.d/m123.conf; set $domain default; } }
有时候运营商可能需要一个cer格式的文件,生成方式如下:
cat 证书.crt 私钥.key >> /opt/xxx.cer #公钥在前面 私钥在后面,这里的公钥就是证书crt
志不强者智不达