https如何通过nginx完成双向认证转发

# 生成客户端私钥（.pem文件），会让你输自定义密码（例：222222）

openssl genrsa -aes256 -out client.pem 1024

# .pem文件转换.key文件

openssl rsa -in client.pem -out client.key

# 222222

# 生成签发请求

openssl req -new -key client.pem -out client.csr

# 输入Client密码：222222

# Common Name填写自己的ip地址即可，其他随意

# 用CA签发证书

openssl x509 -req -sha256 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -out client.crt

# 输入CA密码：000000

# 使用浏览器访问时，需要生成p12格式的客户端证书，会让你输入自定义密码（例：123456）

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

const express = require("express");

const https = require("https");

const fs = require("fs");

const app = express();

const PORT = 7000;

const options = {

key: fs.readFileSync("./ssl/server.key"),

cert: fs.readFileSync("./ssl/server.crt"),

ca: [fs.readFileSync("./ssl/ca.crt")],

requestCert: true,

rejectUnauthorized: true,

};

https

.createServer(options, app)

.listen(PORT, () => console.log(`App listening on port ${PORT}!`));

app.get("/v1", (req, res) => res.send("Hello World!"));

server {

listen       8080;

server_name  localhost;

location /api {

proxy_ssl_certificate ssl/client.crt;

proxy_ssl_certificate_key ssl/client.key;

# client-pw.txt 里面是Client密码：222222

proxy_ssl_password_file ssl/client-pw.txt;

proxy_pass https://localhost:7000/v1;

}

error_page   500 502 503 504  /50x.html;

location = /50x.html {

root   html;

}

}