一:HTTPS的注意事项
- https不支持续费,证书到期需要重新并进行替换
- https如果是通配符域名*.cxy.com,二级域名和三级域名需要分别购买,如test.y.cxy.com
- https显示绿色,说明整个网站的URL都是https
- https显示黄色,说明网站代码中包含http的不安全链接
- https显示红色,要么证书是假的,要么证书过期了
二:Nginx单台实现HTTPS
2.1 准备环境
#nginx必须有ssl模块
[root@web01-7 ~]# nginx -V
--with-http_ssl_module
#创建存放ssl证书的路径
[root@web01-7 ~]# cd /etc/nginx/
[root@web01-7 nginx]# mkdir ssl_key
[root@web01-7 nginx]# cd ssl_key/
2.2 通过openssl生成私钥和证书
#生成私钥
[root@web01-7 ~]# cd /etc/nginx/ssl_key
[root@web01 /etc/nginx/ssl_key]# openssl genrsa -idea -out server.key 2048
#记住配置密码
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
#通过生成的私钥生成证书
[root@web01 /etc/nginx/ssl_key]#
Country Name (2 letter openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
State or Province Name (full name) []:SZ
Locality Name (eg, city) [Default City]:SZ
Organization Name (eg, company) [Default Company Ltd]:MKTG
Organizational Unit Name (eg, section) []:SA
Common Name (eg, your name or your server's hostname) []:MKTG
Email Address []: XXXX@qq.com
# req -->用于创建新的证书
# new -->表示创建的是新证书
# x509 -->表示定义证书的格式为标准格式
# key -->表示调用的私钥文件信息
# out -->表示输出证书文件信息
# days -->表示证书的有效期
2.3 配置单个实例
[root@web01-7 conf.d]# vim /etc/nginx/conf.d/ssl.conf
server {
listen 443 ssl; #开启ssl认证
server_name s.cxy.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
location / {
root /code/ssl;
index index.html;
}
}
server {
listen 80;
server_name s.cxy.com;
rewrite ^(.*) https://$server_name$1 redirect; #强制跳转http到https
}
三:集群实现HTTPS(wordpress和zh)
image.png
思路:
web服务器上不需要做任何操作
通过负载均衡服务器去完成https的访问
3.1 在负载均衡lb01上生成证书
[root@lb01-5 ~]# cd /etc/nginx/ssl_key
[root@lb01-5 ~]# cd /etc/nginx/ssl_key
[root@lb01-5 /etc/nginx/ssl_key]# openssl genrsa -idea -out server.key 2048
##通过生成的密钥生成证书
[root@lb01-5 /etc/nginx/ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
3.2 将lb01上的证书复制到lb02上
[root@lb01-5 conf.d]# scp /etc/nginx/ssl_key/* 10.0.0.6:/etc/nginx/ssl_key/
3.3 配置lb01上和lb02上的nginx负载均衡配置文件
[root@lb01-5 ~]# cat /etc/nginx/conf.d/ssl_proxy.conf
upstream cxy {
server 172.16.1.7:80;
server 172.16.1.8:80;
server 172.16.1.9:80;
}
server {
listen 443 ssl;
server_name blog.cxy1.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
location / {
proxy_pass http://cxy;
include proxy_params;
}
}
server {
listen 443 ssl;
server_name zh.cxy1.com;
ssl_certificate ssl_key/server.crt;
ssl_certificate_key ssl_key/server.key;
location / {
proxy_pass http://cxy;
include proxy_params;
}
}
server {
listen 80;
server_name blog.cxy1.com;
rewrite (.*) https://$server_name$1 redirect;
}
server {
listen 80;
server_name zh.cxy1.com;
rewrite (.*) https://$server_name$1 redirect;
}
#重启nginx服务
[root@lb01-5 conf.d]# systemctl restart nginx
#lb02上的配置和lb01上的一样
3.4 完善wordpress和zh的配置
#想要通过https访问wordpress,还需要到web服务器上修改wordpress的nginx配置文件
location ~ \.php$ {
root /code/wordpress;
.......
fastcgi_param HTTPS on; ##加这一条
image.png
zh论坛只需要修改论坛web后台设置
image.png
