Nginx-PHP 证书应用步骤

来源：互联网发布：崩坏学园2淘宝初始号编辑：程序博客网时间：2024/05/16 06:21

Common Name: 网站域名（这个一定要填对，不然在IE还会有安全提示）
STEP 3：用CA证书进行签名
openssl ca -in server.csr -cert ca.crt -keyfile ca.key -out server.crt
STEP 4：、合并证书文件（crt）和私钥文件（key），产生证书链
cat server.crt server.key > server.pem

4、從【認證中心】發行所有WEB用戶的個人證書
---------------------------------------------------
STEP 1：、創建KEY
openssl genrsa -out user.key 1024
STEP 2：、req
openssl req -new -key user.key -out user.csr
Common Name: benero
STEP 3：、crt文件
openssl ca -in user.csr -cert ca.crt -keyfile ca.key -out benero.crt
STEP 4：、證書
openssl pkcs12 -export -clcerts -in user.crt -inkey user.key -out user.p12

5、配置NGINX服务器

STEP 1：、nginx ssl配置
server
{
      include  http.types;
      listen 443;
      server_name 域名;
      ssl on;
      ssl_certificate /etc/pki/CA/private/server.pem;
      ssl_certificate_key /etc/pki/CA/private/server.key;
      ssl_session_timeout 5m;
      ssl_protocols SSLv2 SSLv3 TLSv1;
      ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
      ssl_prefer_server_ciphers on;
      ssl_verify_client on;
      ssl_client_certificate /etc/pki/CA/private/ca.crt;
      ssl_verify_depth 1;

      index index.php index.shtml index.htm index.html;
      root  /var/www/html/;
      access_log  /var/log/www/access.log  access;
}

STEP 2: 添加ssl變量
/usr/local/nginx/conf/fcgi.conf

fastcgi_param  SSL_VERIFIED       $ssl_client_verify;
fastcgi_param  SSL_DN             $ssl_client_s_dn;
fastcgi_param  SSL_PROTOCOL       $ssl_protocol;
fastcgi_param  SSL_CIPHER          $ssl_cipher;

上面的變量設置后，在PHP利用 $_SERVER 可以找到證書相關信息

STEP 3：nginx 重啟
/usr/local/nginx/sbin/nginx -s  reload

6、其它

-- 利用JAVASCRIPT将CA证书添加到【IE受信任的根证书颁发机构】

<?php$cert = file_get_contents(dirname(__FILE__) . '/ca.crt');$newcert = "sPKCS7=/"/"/r/n";$line=strtok($cert,"/r/n");$i=0;while($line){if($i++ > 1000) die;$newcert=$newcert." sPKCS7=sPKCS7 & /"".$line."/" & vbcrlf/r/n";$line=strtok("/r/n");}?><html><object id="XEnroll" classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1" codebase="xenroll.dll"></object><mce:script Language="VBScript"></mce:script></html>

-- 发行WEB SERVER的脚本

#!/bin/sh[ -n "$1" ] && USERID=$1 || exit 0[ -n "$2" ] && USERKEY=$2 || exit 0CAKEY="CA证书密码"USERINFOPATH="/etc/pki/CA/private/"USERINFO="/etc/pki/CA/private/server.info"cd /etc/pki/CA/privaterm -r -f $USERID.*echo $USERKEY > "$USERID.password"openssl genrsa -des3 -passout pass:$USERKEY -out $USERID.key 1024openssl req -new -key $USERID.key -passin pass:$USERKEY -out $USERID.csr -days 3650 < $USERINFO openssl ca -in $USERID.csr -cert cacert.pem -keyfile cakey.pem -out $USERID.crt -key $CAKEY -days 3650 -batch

參考網站：

Nginx模块参考手册中文版

http://www.queryer.cn/DOC/nginxCHS/index.html

Nginx之https 客户端ssl验证(双向认证)的配置&&用php实现证书登陆

http://blog.cheemer.org/?p=151

Nginx-PHP 证书应用步骤

目录：