1..创建一个存放证书的目录
- [root@web01 conf.d]# mkdir /etc/nginx/ssl_key
- [root@web01 conf.d]# cd /etc/nginx/ssl_key/
2.创建私钥证书( 无效的,不用care )
- [root@web01 conf.d]# openssl genrsa -idea -out server.key 2048
- [root@web01 conf.d]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
3.配置一个https的网站 ( 只能通过https访问 )
- [root@web01 conf.d]# cat /etc/nginx/conf.d/s.oldxu.com.conf
server {
listen 443 ssl;
server_name s.oldxu.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
charset utf8;
root /code;
location / {
index index.html;
}
}
4.将http的请求过渡到https
- [root@web01 conf.d]# cat /etc/nginx/conf.d/s.oldxu.com.conf
server {
listen 443 ssl;
server_name s.oldxu.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
charset utf8;
root /code;
location / {
index index.html;
}
}
server {
listen 80;
server_name s.oldxu.com;
return 302 https://request_uri;
}
=============================================================
web01
[root@web01 conf.d]# cat ssl.oldxu.com.conf
server {
listen 80;
server_name ssl.oldxu.com;
root /code;
location / {
index index.html;
}
}
web02
[root@web02 conf.d]# cat ssl.oldxu.com.conf
server {
listen 80;
server_name ssl.oldxu.com;
root /code;
location / {
index index.html;
}
}
lb01
[root@lb01 conf.d]# cat proxy_ssl.oldxu.com.conf
upstream ssl {
server 172.16.1.7:80;
server 172.16.1.8:80;
}
server {
listen 443 ssl;
server_name ssl.oldxu.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
location / {
proxy_pass http://ssl;
include proxy_params;
}
}
server {
listen 80;
server_name ssl.oldxu.com;
return 302 https://$http_host$request_uri;
}
2.https使用场景示例:
需求: 希望用户访问网站的所有Url走Https协议，但访问s.oldxu.com/abc时能支持Http|https协议?
[root@web02 conf.d]# vim s.oldxu.com.conf
server {
listen 443 ssl;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
server_name s.oldxu.com;
root /code;
location / {
index index.html;
}
}
server {
listen 80;
server_name s.oldxu.com;
if ( $request_uri != '/abc') {
return 302 https://$http_host$request_uri;
}
}
[root@web01 conf.d]# cat s.oldxu.com.conf
server {
listen 443 ssl;
server_name s.oldxu.com;
ssl_certificate ssl_key/1524377920931.pem;
ssl_certificate_key ssl_key/1524377920931.key;
ssl_session_cache shared:SSL:10m; #在建立完ssl握手后如果断开连接，在session_timeout时间内再次连接，是不需要在次建立握手，可以复用之前的连接
ssl_session_timeout 1440m; #ssl连接断开后的超时时间（24小时）
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #使用的TLS版本协议
ssl_prefer_server_ciphers on; #Nginx决定使用哪些协议与浏览器进行通讯
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #配置加密套间
location / {
root /code;
index index.html index.htm;
}
}
#http-https
server {
listen 80;
server_name s.oldxu.com;
return 302 https://$server_name$request_uri;
}
