Nginx 实现 https

最新推荐文章于 2022-08-27 10:30:00 发布

学渣角鹿白

最新推荐文章于 2022-08-27 10:30:00 发布

阅读量759

点赞数

分类专栏： Nginx 文章标签： nginx

本文链接：https://blog.csdn.net/a20251839/article/details/113571636

版权

Nginx 专栏收录该内容

15 篇文章 0 订阅

订阅专栏

3.4：Nginx 实现 https

3.4.1：构建私有 CA

证书颁发机构（CA, Certificate Authority）；

这里生成一个私钥 Key 和自签名的 crt 证书，将自己作为一个私有 CA，后续为自己颁发 CA 证书；

生成私有 CA 的私钥和自签名证书：

umask 077：设置创建文件或目录时的 umask 为 077，即创建的文件权限为 600，目录权限为 700；

[root@node106 ~]# (umask 077; openssl req -newkey rsa:4096 -nodes -sha256 -keyout /etc/pki/CA/private/ca.key -x509 -days 3650 -out /etc/pki/CA/ca.crt)
Generating a 4096 bit RSA private key
...............................++
...........................................................................................................................................++
writing new private key to '/etc/pki/CA/private/ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shanxi
Locality Name (eg, city) [Default City]:Taiyuan
Organization Name (eg, company) [Default Company Ltd]:yqc
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:yqc.ca
Email Address []:20251839@qq.com

查看私钥和自签名 CA 证书：

[root@node106 ~]# ll /etc/pki/CA/private/ca.key
-rw------- 1 root root 3272 Dec  3 10:12 /etc/pki/CA/private/ca.key

[root@node106 ~]# ll /etc/pki/CA/ca.crt 
-rw------- 1 root root 2074 Dec  3 10:12 /etc/pki/CA/ca.crt

3.4.2：生成私钥和证书签署请求

csr 表示 Certificate Signature Request，证书签署请求；

[root@node106 ~]# mkdir /apps/nginx/ssl

生成私钥和csr：

[root@node106 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout /apps/nginx/ssl/www.yqc.com.key -out /apps/nginx/ssl/www.yqc.com.csr
Generating a 4096 bit RSA private key
...................++
..........................++
writing new private key to '/apps/nginx/ssl/www.yqc.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shanxi
Locality Name (eg, city) [Default City]:Taiyuan
Organization Name (eg, company) [Default Company Ltd]:yqc.com
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:www.yqc.com
Email Address []:20251839@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

查看生成的文件：

[root@node106 ~]# ll /apps/nginx/ssl/
total 8
-rw------- 1 root root 1740 Dec  3 10:27 www.yqc.com.csr
-rw------- 1 root root 3272 Dec  3 10:27 www.yqc.com.key

3.4.3：签发证书

使用私有 CA 签发证书：

[root@node106 ~]# openssl x509 -req -days 3650 -in /apps/nginx/ssl/www.yqc.com.csr -CA /etc/pki/CA/ca.crt -CAkey /etc/pki/CA/private/ca.key -CAcreateserial -out /apps/nginx/ssl/www.yqc.com.crt
Signature ok
subject=/C=CN/ST=Shanxi/L=Taiyuan/O=yqc.com/OU=Ops/CN=www.yqc.com/emailAddress=20251839@qq.com
Getting CA Private Key

验证证书序列号和登记内容：

[root@node106 ssl]# openssl x509 -in /apps/nginx/ssl/www.yqc.com.crt -noout -serial -subject      
serial=FA5590CFB34CBE92
subject= /C=CN/ST=Shanxi/L=Taiyuan/O=yqc.com/OU=Ops/CN=www.yqc.com/emailAddress=20251839@qq.com

[root@node106 ssl]# cat /etc/pki/CA/ca.srl 
FA5590CFB34CBE92

3.4.4：www.yqc.com 的 https 访问

编辑配置文件：

[root@node106 ~]# vim /apps/nginx/conf.d/www.yqc.com.conf
server {
#  listen 192.168.1.106:80;
  listen 192.168.1.106:443;
  server_name www.yqc.com;
  ssl_certificate /apps/nginx/ssl/www.yqc.com.crt;
  ssl_certificate_key /apps/nginx/ssl/www.yqc.com.key;
  ssl_session_cache shared:sslcache:20m;
  ssl_session_timeout 10m;
  error_page 500 502 503 504 404 /error.html;
  access_log /data/nginx/logs/www-yqc-com_access_json.log format2;
  error_log /data/nginx/logs/www-yqc-com_error.log;
  gzip on;
  gzip_comp_level 3;
  gzip_min_length 1k;
  gzip_types text/plain text/html application/javascript application/x-javascript text/cssapplication/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
  gzip_vary on;
  
  location / {
    root /data/nginx/yqc/www;
    index index.html;
  }

  location = /error.html {
    root /data/nginx/yqc/redirect;
  }

  location = /status {
    stub_status;
    allow 192.168.1.0/24;
    allow 127.0.0.1;
    deny all;
  }
}

检查配置文件并重载nginx：

[root@node106 ~]# nginx -t
nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /apps/nginx/conf/nginx.conf test is successful
[root@node106 ~]# systemctl reload nginx

测试访问：

在这里插入图片描述

继续访问：

在这里插入图片描述

查看证书信息：

在这里插入图片描述

3.4.5：wap.yqc.com 的 https 访问

生成私钥和证书签署申请：

[root@node106 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout /apps/nginx/ssl/wap.yqc.com.key -out /apps/nginx/ssl/wap.yqc.com.csr
Generating a 4096 bit RSA private key
..........................................................................................................................++
..................................................................................++
writing new private key to '/apps/nginx/ssl/wap.yqc.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN      
State or Province Name (full name) []:Shanxi
Locality Name (eg, city) [Default City]:Taiyuan
Organization Name (eg, company) [Default Company Ltd]:yqc
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:wap.yqc.com
Email Address []:20251839@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

签发证书：

[root@node106 ~]# openssl x509 -req -days 3650 -in /apps/nginx/ssl/wap.yqc.com.csr -CA /etc/pki/CA/ca.crt -CAkey /etc/pki/CA/private/ca.key -CAcreateserial -out /apps/nginx/ssl/wap.yqc.com.crt
Signature ok
subject=/C=CN/ST=Shanxi/L=Taiyuan/O=yqc/OU=Ops/CN=wap.yqc.com/emailAddress=20251839@qq.com
Getting CA Private Key

配置 nginx：

[root@node106 ~]# vim /apps/nginx/conf.d/wap.yqc.com.conf 
server {
#  listen 192.168.1.106:80;
  listen 192.168.1.106:443 ssl;
  server_name wap.yqc.com;
  ssl_certificate /apps/nginx/ssl/wap.yqc.com.crt;
  ssl_certificate_key /apps/nginx/ssl/wap.yqc.com.key;
  ssl_session_cache shared:sslcache:20m;
  ssl_session_timeout 10m;
  location / {
    root /data/nginx/yqc/wap;
  }
}

检查配置文件并重置 nginx：

[root@node106 ~]# nginx -t
nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /apps/nginx/conf/nginx.conf test is successful
[root@node106 ~]# systemctl reload nginx