Nginx配置https访问

一、利用openssl生成自签名证书
1、进入你想创建证书和私钥的目录
[root@web ~]# cd /application/nginx/key

2、创建服务器私钥，命令会让你输入一个口令：
[root@web key]# openssl genrsa -des3 -out server.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
................................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

3、创建签名请求的证书（CSR）：
[root@web key]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key: ← 输入生成server.key文件时的密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN ← 国家名称，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省名，拼音
Locality Name (eg, city) []:BeiJing ← 市名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不输入
Common Name (eg, YOUR name) []:www.mycompany.com ← 服务器主机名，若填写不正确，浏览器会报告证书无效，但并不影响使用
Email Address []:admin@mycompany.com ← 电子邮箱，可随便填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不输入
An optional company name []: ← 可以不输入

4、在Nginx上使用上述私钥时除去口令：
[root@web key]# cp server.key server.key.bak #备份一份带口令的server.key文件
[root@web key]# openssl rsa -in server.key -out server.key

5、最后使用上述私钥和CSR生成证书(-days:指定证书有效期为365天)：
[root@web key]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

二、nginx配置
[root@web conf]# cat nginx.conf

server {
    listen 443;
    server_name www.nginx.com;
    access_log logs/access.log main;
            
    ssl on;
    ssl_certificate /application/nginx/server.crt; 
    ssl_certificate_key /application/nginx/server.key; 
            
    ssl_session_timeout 5m;
    location /echo {
        #proxy_pass http://10.47.39.7:80;
        #proxy_set_header Host $host;
        #proxy_set_header X-Forwarded-For $remote_addr;
        #rewrite ^(.*) https://www.baidu.com permanent;
        #rewrite ^(.*) https://www.baidu.com redirect;
        #if ( $uri ~ "[0-9]" ){
        # rewrite ^(.*) http://10.47.39.7:80/abc/1234/index.html;
        # break;
        #}
        default_type text/html;
        set $foo 'hello world';
        echo "$request_uri";
        echo </br>$foo;
        echo </br>$server_protocol;
        }
    }
}

三、使用certbot工具申请免费证书

# Debian/Ubuntu安装certbot
apt update -y && apt install -y certbot
# CentOS安装certbot
yum -y update && yum -y install certbot
# 自动续签脚本
curl -O https://raw.githubusercontent.com/kejilion/sh/main/auto_cert_renewal.sh
chmod +x auto_cert_renewal.sh
# 定时执行
echo "0 0 * * * cd ~ && ./auto_cert_renewal.sh" | crontab -
# 申请证书，确认80和443未被占用
certbot certonly --standalone -d $yuming --email your@email.com --agree-tos --no-eff-email --force-renewal
# 证书存放目录
ls /etc/letsencrypt/live/
# DNS方式申请(国内申请可用)
certbot certonly --manual --preferred-challenges dns -d yuming.com
# 主域名(国内申请可用)
certbot certonly -d 使用自己的域名替换.com --manual --preferred-challenges dns
# 泛域名(国内申请可用)
certbot certonly -d *.使用自己的域名替换.com --manual --preferred-challenges dns 

https://freessl.org/
https://letsencrypt.osfipin.com/     #免费申请ssl证书
https://blog.csdn.net/hongchen006/article/details/135406416  # 阿里云服务器 使用Certbot申请免费 HTTPS 证书及自动续期