Nginx配置https协议

      https协议是Hypertext Transfer Protocol over Secure Socket Layer的简称，它是基于ssl的http通信协议。用于安全的http数据传输。默认使用443端口。https协议需要生成证书，客户端连接上来，需要先安装证书，例如浏览器打开指定的url,会警告是一个不信任的站点，需要将其加入受信任的站点，然后才可以访问。

      今天介绍如何利用nginx来配置让服务器支持https协议。nginx默认安装是支持https协议的，只需要我们生成证书，并配置证书就可以使用了。

      在linux服务器上可以使用openssl命令直接创建证书具体命令如下。

1、生成服务器私钥key

这一步会提示你输入口令。

[root@docker nginx]# openssl genrsa -des3 -out server.key 1024Generating RSA private key, 1024 bit long modulus............++++++.............++++++e is 65537 (0x10001)Enter pass phrase for server.key:140713354999712:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:869:You must type in 4 to 8191 charactersEnter pass phrase for server.key:Verifying - Enter pass phrase for server.key:[root@docker nginx]# 

利用生成的key，创建签名请求的证书。

[root@docker nginx]# openssl req -new -key server.key -out server.csrEnter pass phrase for server.key:You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:beijingLocality Name (eg, city) [Default City]:beijingOrganization Name (eg, company) [Default Company Ltd]:xxxOrganizational Unit Name (eg, section) []:linuxCommon Name (eg, your name or your server's hostname) []:dockerEmail Address []:[e-mail] enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:lenovoAn optional company name []:lenovo[root@docker nginx]# 

2、生成服务器证书crt

使用上述私钥时去除必要的口令

[root@docker nginx]# cp server.key server.key.org[root@docker nginx]# openssl rsa -in server.key.org -out server.keyEnter pass phrase for server.key.org:writing RSA key[root@docker nginx]# 

标记证书有效期10年并使用上述key和csr

[root@docker nginx]# openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crtSignature oksubject=/C=CN/ST=beijing/L=beijing/O=xxx/OU=linux/CN=docker/emailAddress=[e-mail] Private key[root@docker nginx]# 

3、配置nginx的配置文件，让其包含新标记的证书和私钥，并开启443端口。

 vi /etc/nginx/conf.d/default.conf

4、测试访问.https://192.168.61.150/index.php

第一次访问提示不信任的站点警告。

点击高级，查看证书。

添加安全例外。

访问结果。