前提申請(qǐng)免費(fèi)域名https證書(shū)
一、nginx配置https并轉(zhuǎn)發(fā)到tomcat
1蚯瞧、Nginx配置文件
server {
listen 80;
listen 443 ssl default_server;
server_name {域名};
# root /usr/share/nginx/html;
# 解釋：當(dāng)此虛擬站點(diǎn)只允許https訪問(wèn)時(shí)待讳，當(dāng)用http訪問(wèn)時(shí)nginx會(huì)報(bào)出497錯(cuò)誤碼
ssl on;
error_page 497 https://$host$uri$args;
ssl_certificate /etc/nginx/cer/{域名}.crt; #證書(shū)路徑
ssl_certificate_key /etc/nginx/cer/{域名}.key; #私鑰路徑
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH:AESGCM:HIGH:RSA+3DES:!RC4:!DH:!MD5:!aNULL:!eNULL;
ssl_prefer_server_ciphers on;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
client_max_body_size 50m;
location / {
proxy_redirect off;
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect default ;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
2、 nginx配置如上之后蛮原，tomcat需配置如下
<!-- 1卧须、connector配置-->
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" proxyPort="443"/>
<!--2、Engine 中加入該Value-->
<Engine name="Catalina" defaultHost="localhost">
<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="X-Forwarded-For"
protocolHeader="X-Forwarded-Proto"
protocolHeaderHttpsValue="https" httpsServerPort="443"/>
</Engine>
二儒陨、tomcat配置https
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
SSLEnabled="true"
scheme="https"
secure="true"
clientAuth="false"
sslProtocol="TLS"
keystoreFile="{域名}.jks全路徑"
keystorePass="{私鑰花嘶，可填可不填}"/>
歡迎掃碼關(guān)注公眾號(hào)，不定期更新一些干貨
