nginx https必须是443吗

Posted 2023-04-30

可以是任意端口，https是通过ssl这个参数来指定的，而不是通过listen的端口号
如果监听的其他端口（除https默认端口443），那么在访问的时候就要加上端口号 参考技术A

443是默认的HTTPS端口，你也可以修改指定其它商品，关键的是证书。

参考：全站启用https设置

nginx配置https

 

HTTPS配置场景

秘钥生成操作步骤

1.生成key密钥
2.生成证书签名请求文件(csr文件)
3.生成证书签名文件(CA文件)

 1.检查当前环境

//openssl必须是1.0.2
[[email protected] ~]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

//nginx必须有ssl模块
[[email protected] ~]# nginx -V
 --with-http_ssl_module
 
[[email protected] ~]# mkdir /usr/local/nginx/conf/ssl -p
[[email protected] ~]# cd //usr/local/nginx/conf/ssl 

2.创建私钥

[[email protected] ssl]# openssl genrsa -idea -out server.key 2048
Generating RSA private key, 2048 bit long modulus
.....+++
//记住配置密码, 我这里是1234
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

3.生成使用签名请求证书和私钥生成自签证书

[[email protected] ssl]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SZ
Locality Name (eg, city) [Default City]:SZ
Organization Name (eg, company) [Default Company Ltd]:edu    
Organizational Unit Name (eg, section) []:SA
Common Name (eg, your name or your server‘s hostname) []:xuli　　
Email Address []:[email protected]

4.配置nginx访问的配置文件

server {
    listen 443;
    server_name localhost;
    ssl on;
    index index.html index.htm index.php;
    #ssl_session_cache share:SSL:10m;
    ssl_session_timeout 10m;
    ssl_certificate   /usr/local/nginx/conf/ssl/server.crt;
    ssl_certificate_key  /usr/local/nginx/conf/ssl/server.key;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

        location / {
  access_log /data/wwwlogs/www.ikmak.com_nginx.log combined;
  index index.html index.htm index.php;
  root /data/wwwroot/default;
        }
        location ~ [^/]\.php(/|$) {
    #fastcgi_pass remote_php_ip:9000;
    fastcgi_pass unix:/dev/shm/php-cgi.sock;
    fastcgi_index index.php;
    include fastcgi.conf;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param   PATH_INFO   $fastcgi_path_info;
    fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

}

server {
        listen 80;
        server_name localhost;
        rewrite ^(.*) https://$server_name$1 redirect;
}