1..創(chuàng)建一個存放證書的目錄
- [root@web01 conf.d]# mkdir /etc/nginx/ssl_key
- [root@web01 conf.d]# cd /etc/nginx/ssl_key/
2.創(chuàng)建私鑰證書( 無效的,不用care )
- [root@web01 conf.d]# openssl genrsa -idea -out server.key 2048
- [root@web01 conf.d]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
3.配置一個https的網(wǎng)站 ( 只能通過https訪問 )
- [root@web01 conf.d]# cat /etc/nginx/conf.d/s.oldxu.com.conf
server {
listen 443 ssl;
server_name s.oldxu.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
charset utf8;
root /code;
location / {
index index.html;
}
}
4.將http的請求過渡到https
- [root@web01 conf.d]# cat /etc/nginx/conf.d/s.oldxu.com.conf
server {
listen 443 ssl;
server_name s.oldxu.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
charset utf8;
root /code;
location / {
index index.html;
}
}
server {
listen 80;
server_name s.oldxu.com;
return 302 https://request_uri;
}
=============================================================
web01
[root@web01 conf.d]# cat ssl.oldxu.com.conf
server {
listen 80;
server_name ssl.oldxu.com;
root /code;
location / {
index index.html;
}
}
web02
[root@web02 conf.d]# cat ssl.oldxu.com.conf
server {
listen 80;
server_name ssl.oldxu.com;
root /code;
location / {
index index.html;
}
}
lb01
[root@lb01 conf.d]# cat proxy_ssl.oldxu.com.conf
upstream ssl {
server 172.16.1.7:80;
server 172.16.1.8:80;
}
server {
listen 443 ssl;
server_name ssl.oldxu.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
location / {
proxy_pass http://ssl;
include proxy_params;
}
}
server {
listen 80;
server_name ssl.oldxu.com;
return 302 https://$http_host$request_uri;
}
2.https使用場景示例:
需求: 希望用戶訪問網(wǎng)站的所有Url走Https協(xié)議，但訪問s.oldxu.com/abc時能支持Http|https協(xié)議?
[root@web02 conf.d]# vim s.oldxu.com.conf
server {
listen 443 ssl;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
server_name s.oldxu.com;
root /code;
location / {
index index.html;
}
}
server {
listen 80;
server_name s.oldxu.com;
if ( $request_uri != '/abc') {
return 302 https://$http_host$request_uri;
}
}
[root@web01 conf.d]# cat s.oldxu.com.conf
server {
listen 443 ssl;
server_name s.oldxu.com;
ssl_certificate ssl_key/1524377920931.pem;
ssl_certificate_key ssl_key/1524377920931.key;
ssl_session_cache shared:SSL:10m; #在建立完ssl握手后如果斷開連接嗤栓，在session_timeout時間內(nèi)再次連接冻河，是不需要在次建立握手，可以復(fù)用之前的連接
ssl_session_timeout 1440m; #ssl連接斷開后的超時時間（24小時）
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #使用的TLS版本協(xié)議
ssl_prefer_server_ciphers on; #Nginx決定使用哪些協(xié)議與瀏覽器進行通訊
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #配置加密套間
location / {
root /code;
index index.html index.htm;
}
}
#http-https
server {
listen 80;
server_name s.oldxu.com;
return 302 https://$server_name$request_uri;
}
