目錄
一、Nginx負載均衡
二哄芜、ssl原理
三貌亭、生成ssl密鑰對
四、Nginx配置ssl
一认臊、Nginx負載均衡
如果Nginx后面有多臺Web服務(wù)器圃庭，如果同時代理，那Nginx在這里就起到一個負載均衡的作用失晴。
若不使用代理服務(wù)器剧腻，用戶訪問web服務(wù)器時只能一臺一臺的請求內(nèi)容。比如用戶1訪問web1涂屁，用戶2訪問web2恕酸，此時若web1故障，則用戶1無法繼續(xù)訪問網(wǎng)站胯陋。使用代理服務(wù)器時蕊温，若web1故障，則代理服務(wù)器不會繼續(xù)把用戶1的請求發(fā)給web1而是發(fā)給其他服務(wù)器遏乔。
代理配置中的proxy pass字段不支持寫多個ip义矛，可以使用upstream模塊定義多個server（ip+端口）
- dig命令
dig命令是常用的域名查詢工具，可以用來測試域名系統(tǒng)工作是否正常盟萨。
執(zhí)行yum install -y bind-utils安裝
使用dig命令查看一下qq.com域名對應(yīng)的IP
[root@minglinux-01 ~] dig qq.com
; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7_5.1 <<>> qq.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20175
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;qq.com. IN A
;; ANSWER SECTION: //返回解析的兩個IP
qq.com. 194 IN A 111.161.64.40
qq.com. 194 IN A 111.161.64.48
;; Query time: 19 msec
;; SERVER: 119.29.29.29#53(119.29.29.29)
;; WHEN: 五 11月 30 22:10:27 CST 2018
;; MSG SIZE rcvd: 67
有兩個IP就可以走負載均衡了凉翻，配置過程如下：
[root@minglinux-01 ~] vim /usr/local/nginx/conf/vhost/load.conf //寫入以下內(nèi)容
upstream qq_com //upstream來指定多個web server，名字自定義
2 {
3 ip_hash; //ip_hash的目的是讓同一個用戶始終保持在同一臺機器上捻激，達到保持會話的效果制轰。
4 server 111.161.64.40:80;
5 server 111.161.64.48:80;
6 }
7 server
8 {
9 listen 80;
10 server_name www.qq.com;
11 location /
12 {
13 proxy_pass http://qq_com; //跟上面upstream定義字段保持一致
14 proxy_set_header Host $host;
15 proxy_set_header X-Real-IP $remote_addr;
16 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded _for;
17 }
18 }
- 測試
此時未重載配置文件，會訪問默認虛擬主機胞谭，無法訪問到www.qq.com
[root@minglinux-01 ~] curl -x127.0.0.1:80 www.qq.com
Hello,thank you!
[root@minglinux-01 ~] curl -x127.0.0.1:80 localhost
Hello,thank you!
重載配置文件后可以訪問www.qq.com了
[root@minglinux-01 ~] /usr/local/nginx/sbin/nginx -t
[root@minglinux-01 ~] /usr/local/nginx/sbin/nginx -s reload
[root@minglinux-01 ~] curl -x127.0.0.1:80 www.qq.com -I
HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Sat, 01 Dec 2018 08:17:39 GMT
Content-Type: text/html; charset=GB2312
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Expires: Sat, 01 Dec 2018 08:18:39 GMT
Cache-Control: max-age=60
Vary: Accept-Encoding
Vary: Accept-Encoding
X-Cache: HIT from shenzhen.qq.com
Nginx不支持代理https
Nginx代理服務(wù)器代理https：
用戶想要訪問https（443）垃杖，可以讓代理服務(wù)器監(jiān)聽443端口，但代理服務(wù)器訪問后端時必須訪問后端的80端口丈屹，不支持訪問443调俘。
二伶棒、ssl原理
HTTP協(xié)議以明文方式發(fā)送內(nèi)容，不提供任何方式的數(shù)據(jù)加密肤无，如果攻擊者截取了Web瀏覽器和網(wǎng)站服務(wù)器之間的傳輸報文，就可以直接讀懂其中的信息骇钦。
HTTPS在HTTP的基礎(chǔ)上加入了SSL協(xié)議宛渐，SSL依靠證書來驗證服務(wù)器的身份，并為瀏覽器和服務(wù)器之間的通信加密眯搭，即便攻擊者截獲了通信的數(shù)據(jù)包窥翩，也無法破譯里面的內(nèi)容。
HTTPS的通信過程：
(1) 瀏覽器發(fā)送一個HTTPS請求給服務(wù)器坦仍。
(2) 服務(wù)器要有一套數(shù)字證書鳍烁，可以自己制作，也可以向組織申請繁扎，區(qū)別就是自己頒發(fā)的證書需要客戶端驗證通過幔荒，才可以繼續(xù)訪問，而使用受信任的公司申請的證書則不會彈出提示頁面梳玫，這套證書其實就是一對公鑰和私鑰爹梁。
(3) 服務(wù)器會把公鑰傳輸給客戶端。
(4) 客戶端（瀏覽器）收到公鑰后提澎，會驗證其是否合法有效姚垃，無效會有警告提醒，有效則會生成一串隨機字符串盼忌，并用收到的公鑰加密积糯。
(5) 客戶端把加密后的隨機字符串傳輸給服務(wù)器。
(6) 服務(wù)器收到加密隨機字符串后谦纱，先用私鑰解密（公鑰加密看成，私鑰解密），獲取到這一串隨機字符串后跨嘉，再用這串隨機字符串加密傳輸?shù)臄?shù)據(jù)（該加密為“對稱加密”川慌；所謂對稱加密，就是將數(shù)據(jù)和私鑰祠乃，也就是這個隨機字符串通過某種算法混合在一起梦重，這樣除非知道私鑰，否則無法獲取數(shù)據(jù)內(nèi)容）亮瓷。
(7) 服務(wù)器把加密后的數(shù)據(jù)傳輸給客戶端琴拧。
(8) 客戶端收到數(shù)據(jù)后，再用自己的私鑰（也就是那個隨機字符串）解密寺庄。
三艾蓝、生成ssl密鑰對
- 查看openssl命令是由哪個包來安裝
[root@minglinux-01 /usr/local/nginx/conf] which openssl
/usr/bin/openssl
[root@minglinux-01 /usr/local/nginx/conf] rpm -qf `which openssl`
openssl-1.0.2k-12.el7.x86_64 //查看openssl命令是由哪個包來安裝來的
[root@minglinux-01 ~] cd /usr/local/nginx/conf/
- 生成私鑰
[root@minglinux-01 /usr/local/nginx/conf] openssl genrsa -des3 -out tmp.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
............................................................................+++
e is 65537 (0x10001)
Enter pass phrase for tmp.key:
Verifying - Enter pass phrase for tmp.key:
[root@minglinux-01 /usr/local/nginx/conf] openssl rsa -in tmp.key -out ming.key
Enter pass phrase for tmp.key:
writing RSA key
[root@minglinux-01 /usr/local/nginx/conf] rm -f tmp.key
上面第二步將tmp.key轉(zhuǎn)換成ming.key清除密碼力崇，目的是為了讓用戶在訪問https網(wǎng)站時不需要輸入密碼斗塘。ming.key和tmp.key實際是同一個密鑰赢织，只是tmp.key有密碼，ming.key沒有密碼馍盟。
- 生成證書請求文件于置，需要拿這個文件和私鑰一起生成公鑰文件
[root@minglinux-01 /usr/local/nginx/conf] openssl req -new -key ming.key -out ming.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shenzhen
Locality Name (eg, city) [Default City]:Shenzhen
Organization Name (eg, company) [Default Company Ltd]:123
Organizational Unit Name (eg, section) []:123
Common Name (eg, your name or your server's hostname) []:123
Email Address []:admin@ming.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:xiaoming
An optional company name []:ming
- key文件CSR文件一起生成公鑰文件
[root@minglinux-01 /usr/local/nginx/conf] openssl x509 -req -days 365 -in ming.csr -signkey ming.key -out ming.crt
Signature ok
subject=/C=CN/ST=Shenzhen/L=Shenzhen/O=123/OU=123/CN=123/emailAddress=admin@ming.com
Getting Private key
[root@minglinux-01 /usr/local/nginx/conf] ls ming.*
ming.crt ming.csr ming.key
四、Nginx配置ssl
[root@minglinux-01 /usr/local/nginx/conf] vim /usr/local/nginx/conf/vhost/ssl.conf
//寫入以下內(nèi)容
1 server
2 {
3 listen 443;
4 server_name ming.com;
5 index index.html index.php;
6 root /data/wwwroot/ming.com;
7 ssl on;
8 ssl_certificate ming.crt;
9 ssl_certificate_key ming.key;
10 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
11 }
- 檢查Nginx配置出錯
[root@minglinux-01 /usr/local/nginx/conf] /usr/local/nginx/sbin/nginx -t
nginx: [emerg] unknown directive "ssl" in /usr/local/nginx/conf/vhost/ssl.conf:7
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
[root@minglinux-01 /usr/local/nginx/conf] /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.12.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC)
configure arguments: --prefix=/usr/local/nginx
報錯當前的Nginx并不支持SSL贞岭，這是因為在先前的Nginx編譯時八毯，并沒有額外配置支持SSL的參數(shù)，要解決該問題只能重新編譯一遍Nginx瞄桨。
- 重新編譯Nginx
[root@minglinux-01 /usr/local/nginx/conf] cd /usr/local/src/nginx-1.12.2/
[root@minglinux-01 /usr/local/src/nginx-1.12.2] ./configure --help | grep -i ssl
--with-http_ssl_module enable ngx_http_ssl_module
--with-mail_ssl_module enable ngx_mail_ssl_module
--with-stream_ssl_module enable ngx_stream_ssl_module
--with-stream_ssl_preread_module enable ngx_stream_ssl_preread_module
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
[root@minglinux-01 /usr/local/src/nginx-1.12.2] ./configure --prefix=/usr/local/nginx --with-http_ssl_module
[root@minglinux-01 /usr/local/src/nginx-1.12.2] make
[root@minglinux-01 /usr/local/src/nginx-1.12.2] make install
[root@minglinux-01 /usr/local/src/nginx-1.12.2] /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.12.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module
//多了--with-http_ssl_module
[root@minglinux-01 /usr/local/src/nginx-1.12.2] /usr/local/nginx/sbin/nginx -t //檢查配置通過了
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@minglinux-01 /usr/local/src/nginx-1.12.2] /etc/init.d/nginx restart
Restarting nginx (via systemctl): [ 確定 ]
[root@minglinux-01 /usr/local/src/nginx-1.12.2] netstat -lntp
Active Internet connections (only servers) //nginx分別監(jiān)聽了80和443端口
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 4120/nginx: master
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 4120/nginx: master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 764/sshd
tcp6 0 0 :::3306 :::* LISTEN 1199/mysqld
tcp6 0 0 :::22 :::* LISTEN 764/sshd
- 測試
[root@minglinux-01 /usr/local/src/nginx-1.12.2] mkdir /data/wwwroot/ming.com
[root@minglinux-01 /usr/local/src/nginx-1.12.2] cd !$
cd /data/wwwroot/ming.com
[root@minglinux-01 /data/wwwroot/ming.com] vim index.html
[root@minglinux-01 /data/wwwroot/ming.com] vim /etc/hosts
寫入如下行
···
127.0.0.1 ming.com
[root@minglinux-01 /data/wwwroot/ming.com] curl https://ming.com/
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
-
Windows訪問
證書是自己頒發(fā)的话速，是不可信任，如果需要正規(guī)頒發(fā)的受信任證書可以到沃通等站點購買
擴展
針對請求的uri來代理 http://ask.apelearn.com/question/1049
根據(jù)訪問的目錄來區(qū)分后端的web http://ask.apelearn.com/question/920
nginx長連接 http://www.apelearn.com/bbs/thread-6545-1-1.html
nginx算法分析 http://blog.sina.com.cn/s/blog_72995dcc01016msi.html
