nginx实现https

https作用

数据加密传输

OSI七层模型：表示层加密/解密

证书申请流程

证书类型介绍

证书购买

• 单域名

• ​只能单个域名使用

• ​​​www.baidu.com​​​

• ​混合域名

• ​多个域名都可以使用该证书

• ​​​www.yjt.com​​ ​​www.yyy.com​​​

• 泛域名

• ​通配符域名证书

• ​*.yyyyyy.com

• ​​​www.yyyyyy.com​​​
• ​blog.yyyyyy.com​
• ​​​php.yyyyyy.com​​​
• .yyyyyy.com

​

https注意事项

• 1.证书过期，无法续费
• ​​三级域名无法使用https(比如：​​main.m.taobao.com​​)​
• ​注意证书的颜色：​

• ​绿色：全站的URL都是https加密的
• ​红色：假证书或者证书过期
• ​黄色：并非全站URL都是https加密的

​

单台nginx实现HTTPS

# 编辑nginx配置文件
[root@web01 ~]# vim /etc/nginx/conf.d/test.yjt.conf 
server{
        listen 80;
        server_name test.yjt.com;
        root /code/test;
        index index.html;
}

# 重启nginx
[root@web01 ~]# nginx -t
[root@web01 ~]# systemctl reload nginx

# 创建站点目录
[root@web01 ~]# mkdir /code/test/

# 部署代码
[root@web01 ~]#  echo 'test https' > /code/test/index.html

# 域名解析
10.0.0.7 test.yjt.com 

# 域名访问浏览器 ：http://test.yjt.com

跟CA机构申请证书

## CA机构创建证书
[root@web01 ~]# openssl genrsa -idea -out server.key 2048
Generating RSA private key, 2048 bit long modulus
................+++
................................................................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for server.key:  1234
Verifying - Enter pass phrase for server.key: 1234
密码必须要，且四位数以上

## 当前所在目录会生成证书
[root@web01 ~]# ll
-rw-r--r--  1 root root 1747 Jun 22 11:04 server.key

## 跟CA机构填写个人信息，签发证书
[root@web01 ~]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
Generating a 2048 bit RSA private key
.........................................+++
........................+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
## 国家代码  简写，2个字符
Country Name (2 letter code) [XX]:CN
## 所在省
State or Province Name (full name) []:zhejiang
## 城市名字
Locality Name (eg, city) [Default City]:zhejiang  
## 公司名字
Organization Name (eg, company) [Default Company Ltd]:oldboy
## 公司名字
Organizational Unit Name (eg, section) []:oldboy   
## 域名
Common Name (eg, your name or your server's hostname) []:test.yjt.com
## 邮箱
Email Address []:1234@qq.com


## 查看证书文件
[root@web01 ~]# mv server.* /etc/nginx/ssl/  （最好创建一个专门存放证书的目录）
[root@web01 ~]# ll /etc/nginx/ssl
total 8
-rw-r--r-- 1 root root 1415 Jun 22 11:12 server.crt
-rw-r--r-- 1 root root 1708 Jun 22 11:12 server.key

配置ssl证书语法

# qidong SSL 功能
Syntax: ssl on | off;
Default: ssl off;
Context: http,server

#证书文件
Syntax: ssl_certificate file;
Default: -
Context: http,server

#私钥文件
Syntax: ssl_certificate_key file;
Default: -
Context: http,server

修改nginx配置文件

# 1.创建证书存放的目录
[root@web01 ~]# mkdir /etc/nginx/ssl
[root@web01 ~]# mv server.* /etc/nginx/ssl/

[root@web01 ~]# ll /etc/nginx/ssl
total 8
-rw-r--r-- 1 root root 1415 Jun 22 11:12 server.crt
-rw-r--r-- 1 root root 1708 Jun 22 11:12 server.key

# 2.配置nginx证书（老语法）
[root@web01 ~]# vim /etc/nginx/conf.d/test.yjt.conf         
server{
        listen 443 ;
        server_name test.yjt.com;
        root /code/test;
        index index.html;
        ssl on;
        ssl_certificate ssl/server.crt;
        ssl_certificate_key ssl/server.key;
}

[root@web01 ~]# nginx -t
[root@web01 ~]# systemctl reload nginx

# 3.配置证书新语法
[root@web01 ~]# vim /etc/nginx/conf.d/test.yjt.conf   
server{
        listen 443 ssl;
        server_name test.yjt.com;
        root /code/test;
        index index.html;
        ssl_certificate ssl/server.crt;
        ssl_certificate_key ssl/server.key;
}

# 4.检测语法，重启nginx
[root@web01 ~]# nginx -t
[root@web01 ~]# systemctl reload nginx

# 5.浏览器访问：https://test.yjt.com/

使用rewrite协议跳转

# 80端口强转443 提升用户体验
[root@web01 ~]# vim /etc/nginx/conf.d/test.yjt.conf 
server{
        listen 80;
        server_name test.yjt.com;
        rewrite (.*) https://test.yjt.com$1 redirect;
}
server{
        listen 443 ssl;
        server_name test.yjt.com;
        root /code/test;
        index index.html;
        ssl_certificate ssl/server.crt;
        ssl_certificate_key ssl/server.key;
}

[root@web01 ~]# cat /etc/nginx/conf.d/test.yjt.conf
server{
        listen 80;
        server_name test.yjt.com;
        #rewrite (.*) https://test.yjt.com$1 redirect;
        return 302 https://$server_name$request_uri;
}
server{
        listen 443 ssl;
        server_name test.yjt.com;
        root /code/test;
        index index.html;
        ssl_certificate ssl/server.crt;
        ssl_certificate_key ssl/server.key;
}

给wordpress博客加证书

## 生成证书
[root@web01 ~]# openssl genrsa -idea -out 2022_6_22.yjt.com.key 2048 

[root@web01 ~]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout 2022_6_22.yjt.com.key -out 2022_6_22.yjt.com.pem

## 创建证书存放位置
[root@web01 ~]# mkdir /etc/nginx/ssl
[root@web01 ~]# mv 2022_6_22.yjt.com* /etc/nginx/ssl/

## 配置nginx配置文件

解决php破图现象

[root@web01 ~]# cat /etc/nginx/conf.d/blog.yjt.com.conf
server{
        listen 80;
        server_name blog.yjt.com;
        rewrite (.*) https://blog.yjt.com$1 redirect;
}
server{
        listen 443 ssl;
        server_name blog.yjt.com;
        root /code/wordpress;
        index index.html;
  ssl_certificate ssl/2022_6_22.yjt.com.pem;
  ssl_certificate_key ssl/2022_6_22.yjt.com.key;

  location / {
    if ( -f $request_filename/index.html ){
      rewrite (.*) $1/index.html break;
    }
    if ( -f $request_filename/index.php ){
      rewrite (.*) $1/index.php;
    }
    if ( !-f $request_filename ){
      rewrite (.*) /index.php;
    }
  }
  
  location ~ \.php$ {
    fastcgi_pass unix:/dev/shm/php.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    ## 让nginx访问php时，也要使用https
    fastcgi_param HTTPS on;
    include fastcgi_params;
  }
}

多台nginx配置ssl证书

## 负载均衡配置证书
[root@lb01 ~]# cat /etc/nginx/conf.d/lb.yjt.com.conf 
upstream test.yjt.com {
  server 172.16.1.7;
  server 172.16.1.8;
}
server {
  listen 80;
  server_name test.yjt.com;
  rewrite (.*) https://test.yjt.com$1 redirect;
}

server{
  listen 443 ssl;
  server_name test.yjt.com;
  ssl_certificate ssl/server.crt;
  ssl_certificate_key ssl/server.key;
  
  location /{
    proxy_pass http://test.yjt.com;
    include proxy_params;
  }
}


## 将证书放在负载均衡服务器的/etc/nginx/ssl
[root@lb01 ~]#  508  scp /etc/nginx/ssl/* 172.16.1.5:/etc/nginx/ssl

## web01和web02配置
[root@web01 test]# cat /etc/nginx/conf.d/test.yjt.conf
server{
  listen 80;
  server_name test.yjt.com;
  root /code/test;
  index index.html;
}

[root@web02 test]# vim /etc/nginx/conf.d/test.yjt.com.conf

server{
        listen 80;
        server_name test.yjt.com;
        root /code/test;
        index index.html;
}

ssl优化参数

ssl_session_cache shared:SSL:10m;#在建立完ssl握手后如果断开连接，在session_timeout时间内再次连 接，是不需要再次获取公钥建立握手的，可以服用之前的连接
ssl_session_timeout 1440m;#ssl连接断开后的超时时间
ssl_ciphers ECDHE-RSA-AES128-GCM- SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;#配置加密套接协议
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;#使用TLS版本协议
ssl_prefer_server_ciphers on;#nginx决定使用哪些协议与浏览器通信