Nginx HTTPS实现原理及配置实践

#官方示例
worker_processes auto;
http {
    ...
    server {
            listen            443 ssl;
            keepalive_timeout 70;
            ssl_protocols     TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers       AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
            ssl_certificate   /usr/local/nginx/conf/cert.pem;
            ssl_certificate_key /usr/local/nginx/conf/cert.key;
            ssl_session_cache shared:SSL:10m;
            ssl_session_timeout  10m;
            ...
    } 
}

[root@nginx1 ~]# mkdir -p /etc/nginx/ssl_key
[root@nginx1 ~]# cd /etc/nginx/ssl_key/

[root@nginx1 /etc/nginx/ssl_key]# openssl genrsa -idea -out server.key 2048
Generating RSA private key, 2048 bit long modulus
.................................................................................................................................................................................................+++
.........................+++
e is 65537 (0x10001)
#记住配置密码，我这里是123456
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

[root@nginx1 /etc/nginx/ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
Generating a 2048 bit RSA private key
..............................................+++
.............+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:WH
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:hhhh
Organizational Unit Name (eg, section) []:hhhh
Common Name (eg, your name or your server's hostname) []:s.wzx.net
Email Address []:wzx@qq.com
#req  --->用于创建新的证书
#new  --->表示创建的是新证书
#x509 --->表示定义证书的格式为标准格式
#key  --->表示调用的私钥文件信息
#out  --->表示输出证书文件信息
#days --->表示证书的有效期
[root@nginx1 /etc/nginx/ssl_key]# ls
server.crt  server.key

[root@nginx1 /etc/nginx/conf.d]# vim s.wzx.net.conf
server {
        listen 443 ssl;
        server_name s.wzx.net;
        ssl on;
        ssl_certificate /etc/nginx/ssl_key/server.crt;
        ssl_certificate_key ssl_key/server.key;
        location / {
                root /code4;
                index index.html;
        }
}

准备对应的站点目录，并重启Nginx服务
[root@nginx1 /etc/nginx/conf.d]# mkdir /code4
[root@nginx1 /etc/nginx/conf.d]# echo "https...." >/code4/index.html
[root@nginx1 /etc/nginx/conf.d]# systemctl restart nginx

[root@nginx1 /etc/nginx/conf.d]# vim s.wzx.net.conf
server {
        listen 443 ssl;
        server_name s.wzx.net;
        ssl on;
        ssl_certificate /etc/nginx/ssl_key/server.crt;
        ssl_certificate_key ssl_key/server.key;
        location / {
                root /code4;
                index index.html;
        }
}
server {
        listen 80;
        server_name s.wzx.net;
        return 302 https://$server_name$request_uri;
}
[root@nginx1 /etc/nginx/conf.d]# systemctl restart nginx

[root@nginx1 /etc/nginx/conf.d]# vim s.wzx.net.conf
server {
        listen 80;
        server_name s.wzx.net;
        root /code/wordpress;
        location / {
                index index.html;
        }
}
root@nginx1 /etc/nginx/conf.d]# systemctl restart nginx

[root@db-nfs ~]# mkdir /etc/nginx/ssl_key -p
[root@db-nfs ~]# cd /etc/nginx/ssl_key/
[root@db-nfs /etc/nginx/ssl_key]# openssl genrsa -idea -out server.key 2048
[root@db-nfs /etc/nginx/ssl_key]# openssl req -days 36500 -x509 -sha256 \
> -nodes -newkey rsa:2048 -keyout server.key -out server.crt

[root@db-nfs /etc/nginx/ssl_key]# vim /etc/nginx/conf.d/proxy.conf
upstream site {
        server 192.168.146.101:80 max_fails=2 fail_timeout=10s;
        server 192.168.146.175:80 max_fails=2 fail_timeout=10s;
}
server {
        listen 443;
        server_name s.oldxu.net;
        ssl on;
        ssl_certificate ssl_key/server.crt;
        ssl_certificate ssl_key/server.key;
        location / {
                proxy_pass http://site;
                include proxy_params;
        }
}
server {
        listen 80;
        server_name s.oldxu.net;
        return 302 https://$server_name$request_uri;
}

[root@nginx1 ~]# vim /etc/nginx/conf.d/star.wzx.net.conf
server {
        listen 443 ssl;
        server_name star.wzx.net;
        ssl_certificate ssl_key/server.crt;
        ssl_certificate_key ssl_key/server.key;
        root /code/login;
        location / {
                index index.html;
        }
}
[root@nginx1 ~]# mkdir /code/login
[root@nginx1 /code/login]# echo "login......." > index.html
[root@nginx1 /code/login]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@nginx1 /code/login]# systemctl restart nginx

[root@nginx2 ~]# vim /etc/nginx/conf.d/yh.wzx.net.conf
server {
        listen 80;
        server_name yh.wzx.net;
        root /code;
        location / {
                index index.html;
        }
        location /login {
                return 302 https://star.wzx.net;
        }
}
[root@nginx2 ~]# mkdir /code
[root@nginx2 ~]# echo "yh" >/code/index.html
[root@nginx2 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@nginx2 ~]# systemctl restart nginx

[root@db-nfs /etc/nginx/conf.d]# cat proxy_agent.wzx.net.conf
upstream webs {
        server 192.168.146.101:80;
        server 192.168.146.175:80;
}
server {
        listen 443 ssl;
        ssl_certificate ssl_key/server.crt;
        ssl_certificate ssl_key/server.key;
        server_name agent.wzx.net;
        location / {
                proxy_pass http://webs;
                include proxy_params;
        }
}
server {
        listen 80;
        server_name agent.wzx.net;
        if ($request_uri !~* "^/abc") {
                return 302 https://$http_host$request_uri;
        }
        location / {
                proxy_pass http://webs;
                include proxy_params;
        }
}

worker_processes auto;
http {
    ...
    server {
        listen 443 ssl;
        server_name www.example.com;
        ssl_certificate www.example.com.crt;
        ssl_certificate_key www.example.com.key;
        ssl_protocols TLSv1.2;
        ssl_prefer_server_ciphers on;
        #Nginx决定使用哪些协议与浏览器进行通讯
        keepalived_timeout 70;
        #设置长连接
        #默认不开启session_cache: a握手后，关闭浏览器，再次访问，需要重新握手；
        #建立握手后如果连接断开，在session_timeout时间内再次连接，无需再次建立握手，可直接复用之间缓存的连接
        ssl_session_cache shared:SSL:10m;
        #1M缓存空间能存储4000个会话数量；
        ssl_session_timeout 1440m;
        #配置会话超时时间（默认5分钟）
    }
}