nginx阿里云证书配置

Nginx安装http_ssl_module模块

Nginx如果未开启SSL模块，配置Https时提示错误

nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:xxx

1.进入到源码包

cd /app/download/nginx-1.12.2

2.nginx缺少http_ssl_module模块，编译安装的时候带上–with-http_ssl_module配置就行了。

./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module
 
#可能需要的依赖包
yum -y install pcre-devel openssl openssl-devel

3.make

make

4.不需要执行make install，否则就覆盖安装了。

5.备份原有的nginx，如：

cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx_bak

6.然后将刚刚编译好的nginx覆盖掉原有的nginx（nginx需要停止）

cp ./objs/nginx /usr/local/nginx/sbin/

7.查看安装情况：

/usr/local/nginx/sbin/nginx -V

nginx version: nginx/1.12.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

安装证书

第一步下载

第二步将下载好的证书解压复制到cert目录下

nginx配置https

server {
 listen 80;
 server_name localhost;   #将localhost修改为您证书绑定的域名，例如：www.example.com。
rewrite ^(.*)$ https://$host$1 permanent;   #将所有http请求通过rewrite重定向到https。
 location / {
index index.html index.htm;
	}
}

在这里插入代码片

# 以下属性中以ssl开头的属性代表与证书配置有关，其他属性请根据自己的需要进行配置。
server {
listen 443 ssl;   #SSL协议访问端口号为443。此处如未添加ssl，可能会造成Nginx无法启动。
server_name localhost;  #将localhost修改为您证书绑定的域名，例如：www.example.com。
root html;
index index.html index.htm;
ssl_certificate cert/domain name.pem;   #将domain name.pem替换成您证书的文件名。
ssl_certificate_key cert/domain name.key;   #将domain name.key替换成您证书的密钥文件名。
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;  #使用此加密套件。
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;   #使用该协议进行配置。
ssl_prefer_server_ciphers on;   
location / {
root html;   #站点目录。
index index.html index.htm;   
}

检验配置的对不对：

/usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

配置完成的conf文件

user  root;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  xiaoayu.top;
	    rewrite ^(.*) https://$server_name$1 permanent; #http 跳转 https

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   /opt/blog/dist;
            try_files $uri $uri/ /index.html;
            #expires 10s;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
    
   server {
	listen 443 ssl;
	server_name www.xiaoayu.top;
	 ssl on;
 	 ssl_certificate cert/3812583_www.xiaoayu.top.pem;
  	ssl_certificate_key cert/3812583_www.xiaoayu.top.key;
  	ssl_session_timeout 5m;
  	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  	ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
  	ssl_prefer_server_ciphers on;
  	
  	 location / {
            root   /opt/blog/dist;
            try_files $uri $uri/ /index.html;
            #expires 10s;
        }
}