Nginx——配置ssl证书

文章目录

检测nginx

监测nginx是否带有http_ssl_module。

/usr/local/nginx/sbin/nginx -V

在这里插入图片描述
如果不携带此模块，需要再nginx安装时，编译配置中增加下列命令：

./configure --prefix=/usr/local/nginx --with-http_ssl_module

Nginx 配置 HTTPS 完整过程

证书路径

在centos服务上创建新的文件夹，保存ssl证书文件：

mkdir /root/ssl

将ssl证书文件上传至服务器中，保存至指定的文件夹内：
在这里插入图片描述

配置nginx.config

由于服务器上项目较多，采取的是分离配置文件的方式实现监听。

nginx.config：

[root@VM-0-13-centos conf]# cat nginx.conf
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

#user nginx;
worker_processes 2; # auto
worker_cpu_affinity 01 10;
error_log /var/log/nginx/error.log warn;
#pid /var/run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
#include /usr/share/nginx/modules/*.conf;

events {
    accept_mutex on;   #on
    multi_accept on;  #off
    use epoll;      #gselect|poll|kqueue|epoll|resig|/dev/poll|eventport
    worker_connections  20480;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
	# 保存日志的目录，如果/var/log/ 路径下无nginx文件夹，只需要mkdir创建即可
    access_log  /var/log/nginx/access.log  main;

#    sendfile            on;
#    tcp_nopush          on;
    tcp_nodelay         on;
    server_tokens    off;

    sendfile off;             
    sendfile_max_chunk 100k;  
    keepalive_timeout   65;
    types_hash_max_size 2048;
    gzip  on;
    gzip_min_length  1k;
    gzip_buffers     4 32k;
    gzip_comp_level  5;
    gzip_types    application/javascript text/plain application/x-javascript text/css application/xml text/javascript image/jpeg image/jpg image/gif image/png;
    gzip_disable "MSIE [1-6]\.";
    gzip_vary on;
    
    server_names_hash_bucket_size  128;
    
    underscores_in_headers on;
    #ignore_invalid_headers off;
    #设定请求缓冲
    client_header_timeout 15;
    client_body_timeout 15;
    send_timeout 15;
    client_header_buffer_size    128k;
    large_client_header_buffers  4 128k;
	# 包含的各个配置文件
    include /usr/local/nginx/conf/conf.d/*.conf;
}

配置单一的config

cd /usr/local/nginx/conf/conf.d/

[root@VM-0-13-centos conf.d]# cat sm-wx.conf

server {
#    listen 443 ssl default deferred;
    listen 443 ssl;
    listen       [::]:443 ssl;
    
    # your url
    # If there are more than one, separate them with spaces
    server_name bmdsp.s5.linkpower.com.cn;

    # your application route
    root /var/www/sp;

    # your ssl certificate file route
    ssl_certificate      /root/ssl/full_chain.pem;
    ssl_certificate_key  /root/ssl/private.key;
    ssl_session_timeout 5m;
    ssl_session_cache   shared:SSL:20m;

    # open session tickets ,and set tikeckets file route
    ssl_session_tickets on;
   #ssl_session_ticket_key /usr/local/nginx/conf.d/tls_session_ticket.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 10s;

    ssl_prefer_server_ciphers on;
    #ssl_dhparam /etc/ssl/certs/dhparam.pem;

    client_max_body_size 16M;
    keepalive_timeout   30;
    #charset koi8-r;
    #access_log  /var/log/nginx/log/host.access.log  main;
    underscores_in_headers on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    #add_header  Content-Security-Policy  "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://a.disquscdn.com; img-src 'self' data: https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; frame-src https://disqus.com";

    location / {
        proxy_next_upstream error timeout http_500 http_502 http_503 http_504;
        proxy_redirect off;
        proxy_hide_header        X-Powered-By;  
        proxy_set_header X-Real-IP $remote_addr;  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        proxy_set_header X-Forwarded-Proto https;  
        proxy_set_header Host $http_host;  
        proxy_set_header X-NginX-Proxy true;  
        proxy_set_header Connection "";  
        proxy_http_version 1.1;  
        proxy_pass http://127.0.0.1:20195;
    #        root   /usr/share/nginx/html;
    #        index  index.html index.htm;
    #    index  index.html;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}