SSL证书生成及Nginx配置（亲测可用）

Posted 2020-12-10 JaxYoun

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了SSL证书生成及Nginx配置（亲测可用）相关的知识，希望对你有一定的参考价值。

一、服务端证书制作（`针对B/S项目`）

1.在Centos7上新建一个空目录，创建mySsl.conf的配置文件，包含如下内容：

[ req ]
default_bits    = 2048
distinguished_name = req_distinguished_name
req_extensions   = req_ext

[ req_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = cn
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = sc
localityName         = Locality Name (eg, city)
localityName_default     = cd
organizationName       = Organization Name (eg, company)
organizationName_default   = my
organizationalUnitName       = Organizational Unit Name (eg, section)
organizationalUnitName_default   = as
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_max        = 64
commonName_default      = yang.com

[ req_ext ]
subjectAltName = @alt_names

# 可配置多域名，用于访问的域名或ip一定要包含在此列表
[alt_names]
IP.1   = 192.168.50.62 # 服务端主机ip
DNS.1  = yang.com # 服务端域名1
DNS.2  = yang.net # 服务端域名2

2.依次执行下列命令生成服务端证书：

penssl genrsa -out server.key 2048
openssl req -new -sha256 -out server.csr -key server.key -config mySsl.conf
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt -extensions req_ext -extfile mySsl.conf

二、nginx证书配置

# 前端项目部署http
server {
    listen    80;
    server_name  front;
    return 301 https://$host$request_uri;  # 自动将80的请求转发到443
}

# 前端项目部署https
server {
	ssl on;
	listen    443 ssl;
	server_name  front;

	keepalive_timeout 100;
	ssl_session_timeout 10M;
	ssl_session_cache shared:SSL:10M;

	ssl_certificate  \myconf\ssl\server.crt;
	ssl_certificate_key \myconf\ssl\server.key;

	location / {
		root  D:\zzCloudDvd\outer\dist\;
		index  index.html index.htm;
	}
	
	error_page  500 502 503 504  /50x.html;
        location = /50x.html {
        root  html;
	} 
}

# 后端接口反向代理
server {
	ssl on;
	listen    8881 ssl;
	server_name  back;	
	keepalive_timeout 100;
	
 	ssl_session_timeout 10M;
	ssl_session_cache shared:SSL:10M;

	ssl_certificate  \myconf\ssl\server.crt;
	ssl_certificate_key \myconf\ssl\server.key;

	location / {
		proxy_pass http://192.168.50.62:8880;
	}
}