nxinx如何将http地址转成https

一、编译部署nginx（以nginx-1.8.0为例）

1)进入https://www.gmssl.cn/gmssl/index.jsp 下载gmssl_openssl_1.1_bxx.tar.gz到/root/下

2) 解压 tar xzfm gmssl_openssl_1.1_bxx.tar.gz -C /usr/local

3) 下载nginx-1.18.0.tar.gz到/root/下

4) 解压 tar xzfm nginx-1.18.0.tar.gz

5) 进入目录 cd /root/nginx-1.18.0

6) 编辑auto/lib/openssl/conf，将全部$OPENSSL/.openssl/修改为$OPENSSL/并保存

7) 编译配置

./configure \

--without-http_gzip_module \

--with-http_ssl_module \

--with-http_stub_status_module \

--with-http_v2_module \

--with-file-aio \

--with-openssl="/usr/local/gmssl" \

--with-cc-opt="-I/usr/local/gmssl/include" \

--with-ld-opt="-lm"

8) 编译安装

make install

9) /usr/local/nginx即为生成的nginx目录

注：可能需要使用yum install pcre-devel需要安装pcre-devel

nginx.conf配置示例(国密单向)

server

{

listen 0.0.0.0:443 ssl;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;

ssl_verify_client off;

ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;

ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;

location /

{

root html;

index index.html index.htm;

}

}

配置示例(国密双向)

server

{

listen 0.0.0.0:443 ssl;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;

ssl_client_certificate /usr/local/nginx/conf/demo1.sm2.trust;

ssl_verify_client on;

ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;

ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;

ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

location /

{

root html;

index index.html index.htm;

}

}