nginx 鑷缓璇佷功浠ttps 璁块棶

Posted 2021-03-26

鏍囩锛?a href='http://www.mamicode.com/so/1/cal' title='cal'>cal   for   try   prot   娌℃湁   protocol   html   鍥藉   enter   

1.鐢熸垚鑷鍚峴sl璇佷功

mkdir /ssl
鍒涘缓涓枃浠跺す鏀緎sl璇佷功
openssl genrsa -des3 -out domain.key 1024
#鐢熸垚RSA瀵嗛挜(杩囩▼闇€瑕佽缃竴涓瘑鐮?璁颁綇杩欎釜瀵嗙爜)

openssl rsa -in ylc520.key -out ylc520_nopass.key
#鎷疯礉涓€涓笉闇€瑕佽緭鍏ュ瘑鐮佺殑瀵嗛挜鏂囦欢

openssl req -new -key domain.key -out domain.csr
#鐢熸垚涓€涓瘉涔﹁姹?br/>杩欓噷浼氭彁绀鸿緭鍏ュ浗瀹?鍦板尯缁勭粐,email绛変俊鎭?鏈€閲嶈鐨勪竴涓槸"common name",闇€瑕佷笌缃戠珯鍩熷悕鐩稿悓.

Enter pass phrase for domain.key: # 涔嬪墠璁剧疆鐨勫瘑鐮?/h2>

Country Name (2 letter code) [XX]:CN # 鍥藉
State or Province Name (full name) []:Jilin # 鍦板尯鎴栫渷浠?br/>Locality Name (eg, city) [Default City]:Changchun # 鍦板尯灞€閮ㄥ悕
Organization Name (eg, company) [Default Company Ltd]:Python # 鏈烘瀯鍚嶇О
Organizational Unit Name (eg, section) []:Python # 缁勭粐鍗曚綅鍚嶇О
Common Name (eg, your name or your server鈥榮 hostname) []:ylc520.f3322.net # 缃戠珯鍩熷悕
Email Address []:[e-mail] # 閭
A challenge password []: # 绉侀挜淇濇姢瀵嗙爜,鍙洿鎺ュ洖杞?br/>An optional company name []: # 涓€涓彲閫夊叕鍙稿悕绉?鍙洿鎺ュ洖杞?br/>杈撳叆瀹岃繖浜涘氨浼氱敓鎴愪竴涓獃lc520.csr鏂囦欢,鎻愪氦缁檚sl鎻愪緵鍟嗙殑鏃跺€欏氨鏄繖涓猚sr鏂囦欢.褰撶劧杩欓噷骞舵病鏈夊悜浠讳綍璇佷功鎻愪緵鍟嗙敵璇?鑰屾槸鑷繁绛惧彂璇佷功.

openssl x509 -req -days 365 -in ylc520.csr -signkey ylc520.key -out ylc520.crt
#浣跨敤涓婇潰鐨勫瘑閽ュ拰CSR瀵硅瘉涔︾鍚?br/>

2.淇敼nginx鐨勪唬鐮?/p>

server {
listen 80 ;
listen 443 ssl;
#鏂板涓€涓洃鍚鍙ｇ粰ssl 鐢?br/>server_name ylc520.f3322.net;
#浣犵殑鍩熷悕
root /usr/share/nginx/html;

    include /etc/nginx/default.d/*.conf;

ssl_certificate      /ssl/ylc520.crt;
ssl_certificate_key  /ssl/ylc520_nopass.key;

ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
# 鍗忚浼樺寲(鍙€?浼樺寲https鍗忚,澧炲己瀹夊叏鎬?
 if ($server_port = 80) {
    rewrite ^(.*)$ https://$host$1 permanent;
}
# url閲嶆柊锛屼互80绔彛璁块棶杩涙潵鐨勮浆鍒癶ttps 璁块棶

3.璁块棶

鏁蹭笂鍩熷悕锛岃嚜鍔ㄨ瀹氫綅鍒癶ttps璁块棶浜?/p>