#yyds干货盘点#Nginx配置SSL证书

1. 申请​​ssl​​ 证书
2. 把证书copy到​​nginx​​ 目录下,比如我放在了一个叫​​ca​​ 的目录，一个​​.cer​​ 文件，一个​​.key​​ 文件，一共两个文件
3. 配置​​.conf​​文件

server {
    server_name ghostwang.xxx.com;
    # 注意这里是443端口
    listen 443 ssl;

    # gzip config
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 9;
    gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";

        # 证书配置相关
        # cer文件存放目录
    ssl_certificate /etc/nginx/ca/xxx.xxx.com.cer;
    # key文件存放目录
    ssl_certificate_key /etc/nginx/ca/xx.xx.com.key;
    # ssl其他的一些配置...
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
    ssl_prefer_server_ciphers on;

    root /var/www/my-project/dist;

        # 配置websocket的代理，这样后端的ws就不需要配置wss了，通过反向代理，去请求ws协议的接口，不然你https的网站，在ajax的请求里直接请求ws会报错
    location /api/v1/ws {
        # ws 就是http里面配置的upstream
            # 等价 proxy_pass http://localhost:8080
        proxy_pass http://ws;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_connect_timeout 60;
        proxy_read_timeout 60;
        proxy_send_timeout 60;
    }

        # 反向代理http接口
    location /api {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://ws;

    }

    location / {
        try_files $uri $uri/ /index.html;
    }
}