Nginx 和 Tomcat 升级 Https

Posted 2021-08-18 装在瓶子里的西班牙阳光

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Nginx 和 Tomcat 升级 Https相关的知识，希望对你有一定的参考价值。

生成密钥和证书

秘钥和证书请求文件

在 nginx 的 conf 创建 crt 目录，生成私钥和证书请求文件

[123@123 crt]$ openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

填写证书请求文件的信息

Generating a RSA private key
.....+++++
.................................................+++++
writing new private key to \'server.key\'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter \'.\', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BJ
Locality Name (eg, city) []:beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hligy
Organizational Unit Name (eg, section) []:hligy
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:baasd@asd.com

Please enter the following \'extra\' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:

查看秘钥

[123@123 crt]$ openssl rsa -text -in server.key

查看证书请求文件

[123@123 crt]$ openssl req -text -in server.csr

证书

给自己颁发一个证书（想让浏览器变绿就去 CA 拿着私钥和证书请求文件去申请，变绿要钱）

[123@123 crt]$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

查看证书

[123@123 crt]$ openssl x509 -text -in server.crt

配置 nginx

添加 SSL 和 HTTP2 模块

查看是否有 --with-http_ssl_module --with-http_v2_module，http2 需要 openssl-1.0.2 和 nginx-1.9.5 之后的版本。

[123@123 sbin]$ ./nginx -V
nginx version: nginx/1.19.6
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 0.9.8xxxxxxxx忘记了
TLS SNI support enabled
configure arguments: --prefix=/home/xxx/nginx --with-http_stub_status_module --with-pcre

没有的话进入 nginx 的源码包，在原来 ./configure 后添加 --with-http_ssl_module --with-http_v2_module（如果 openssl 版本低就加上自己高版本 openssl 源码的位置 --with-openssl=/home/xxx/openssl-1.x.xx ， --with-openssl 配置的是 openssl 压缩包解压后的源码路径。），重新执行

[123@123 nginx-1.19.6]$ ./configure --prefix=/home/xxx/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-openssl=/home/xxx/openssl-1.0.2j --with-pcre

执行 make 重新编译（自定义的 openssl 版本太高会因为 perl 版本太低导致失败）。停掉 nginx，备份原来的启动脚本 nginx，拷贝 objs 目录下新编译的启动脚本到原脚本位置，再次查看显示添加成功。

[123@123 sbin]$ ./nginx -V
nginx version: nginx/1.19.6
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 1.0.2j  26 Sep 2016
TLS SNI support enabled
configure arguments: --prefix=/home/xxx/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-openssl=/home/xxx/openssl-1.0.2j --with-pcre

修改 nginx.conf

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    gzip            on;
    gzip_comp_level    6;
    gzip_min_length    1k;
    gzip_types        text/plain text/css text/xml text/javascript text/x-component application/json application/javascript application/x-javascript application/xml application/soap+xml application/xhtml+xml application/rss+xml application/atom+xml application/x-font-ttf application/vnd.ms-fontobject image/svg+xml image/x-icon font/opentype;

    keepalive_timeout  65;

    #log_format  main  \'$remote_addr - $remote_user [$time_local] "$request" \'
                      \'$status $body_bytes_sent "$http_referer" \'
                      \'"$http_user_agent" "$http_x_forwarded_for"\'
                      \'"$upstream_addr" "$upstream_status" "$upstream_response_time" "$request_time"\';

    #access_log  logs/access.log  main;

    upstream tomcat {
        server 127.0.0.1:9001;
        server 127.0.0.1:9002;
        server 127.0.0.1:9003;
    }

    server {
        listen       8443 ssl http2 default_server;
        server_name  localhost;

        ssl_certificate      crt/server.crt;
        ssl_certificate_key  crt/server.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Proto https; # 如果设置http rewrite https就把https换成$scheme，这为了让tomcat知道真正请求协议
            proxy_redirect off;
            proxy_connect_timeout      240;
            proxy_send_timeout         240;
            proxy_read_timeout         240;
            # note, there is not SSL here! plain HTTP is used
            proxy_pass http://tomcat;
        }
    }

}

最后检查一下配置文件。

[123@123 sbin]$ ./nginx -t
nginx: the configuration file /home/xxx/xxx/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /home/xxx/xxx/nginx/conf/nginx.conf test is successful

修改 Tomcat 的 server.xml

修改所有的 redirectPort。

<Connector port="8001" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="9001"/>
<Connector port="8002" protocol="AJP/1.3" redirectPort="9001" />

在 <Host></Host> 中添加（ httpsServerPort 不修改）

<Valve className="org.apache.catalina.valves.RemoteIpValve"
               remoteIpHeader="x-forwarded-for"
               remoteIpProxiesHeader="x-forwarded-by"
               protocolHeader="x-forwarded-proto"
               httpsServerPort="9001"/> <!-- httpsServerPort 默认是 443 -->