之前使用apache，懒得去看文档了，重新弄个nginx来搞。nginx的server配置很是简单，因为conf里面自带了https server的配置模板。。。
免费CA选择的是https://letsencrypt.org/。
获取两个必要的东西: 证书 和 私钥 也十分简单，网站有操作就不细说了。
获取到这两样东西，在nginx的conf里面配置二者的路径即可。一般在/etc/letsencrypt的live中。
主要是网站访问时从HTTP转HTTPS的技巧：nginx监听80端口肯定有个默认主页，只要在默认主页里面重定向即可：
index.html
<html>
<meta http-equiv="refresh" content="0;url=https://test.com/">
</html>
这里有个疑问，假设直接访问某个页面，这样的机制就不会有效果了，如何做呢？
rewrite是个选择:
即在conf中http的server配置中添加
rewrite ^(.*)$ https://$host$1 permanent;
将所有80端口的请求都rewrite到https上面。
还遇到一个问题：
nginx的server root目录下面的子目录无法访问的问题。
权限配置正确，死活找不到原因，后来看到一个nginx的配置：
在conf中写：
autoindex on;
即可。。。
现在全站即开启HTTPS了。
另外就是当前的nginx配置，作为以后参考：
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
autoindex on;
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
rewrite ^(.*)$ https://$host$1 permanent;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 https://kyrray.tech;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
# Settings for a TLS enabled server.
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name kyrray.tech;
root /usr/share/nginx/html;
ssl_certificate "/etc/letsencrypt/live/kyrray.tech/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/kyrray.tech/privkey.pem";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
