国密版 Nginx服务器安装

三雷科技

已于 2022-06-17 14:47:13 修改

阅读量5.1k

点赞数

分类专栏： centos7应用 linux 文章标签： nginx centos openssl linux 国密

于 2020-11-01 17:43:27 首次发布

本文链接：https://blog.csdn.net/arv002/article/details/109431639

版权

linux 同时被 2 个专栏收录

54 篇文章

订阅专栏

centos7应用

12 篇文章

订阅专栏

博客介绍了GMSSL提供的国密版OpenSSL和国密版Nginx，支持单向/双向认证及标准SSL/国密SSL自适应。运行环境为Centos7 x86_64，详细说明了国密OpenSSL与国密Nginx的下载、以nginx - 1.8.0为例的编译部署步骤，还给出了配置示例。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一、简介

GMSSL提供一个国密版OpenSSL和国密版Nginx，支持单向/双向认证，支持标准SSL/国密SSL自适应。
其中国密版OpenSSL基于OpenSSL1.1.1d实现，且已经修正了CVE-2020-1967。

证书申请

GMSSL - 国密SSL实验室

二、运行环境

Centos7 x86_64

三、下载

yum install wget -y

国密OpenSSL与国密Nginx
gmssl_openssl_1.1_bxx.tar.gz
nginx-1.18.0.tar.gz

四、编译部署（以nginx-1.8.0为例）

1) 下载gmssl_openssl_1.1_bxx.tar.gz到/roo/下
2) 解压 tar xzfm gmssl_openssl_1.1_bxx.tar.gz -C /usr/local
3) 下载nginx-1.18.0.tar.gz到/roo/下
4) 解压 tar xzfm nginx-1.18.0.tar.gz
5) 进入目录 cd /root/nginx-1.18.0
6) 编辑auto/lib/openssl/conf，将全部$OPENSSL/.openssl/修改为$OPENSSL/并保存

./configure \
--without-http_gzip_module \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-http_v2_module \
--with-file-aio \
--with-openssl="/usr/local/gmssl" \
--with-cc-opt="-I/usr/local/gmssl/include" \
--with-ld-opt="-lm"

8) 编译安装
make install
9) /usr/local/nginx即为生成的nginx目录
注：可能需要使用yum install pcre-devel需要安装pcre-devel

配置示例(国密单向)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;
  ssl_verify_client off;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;
  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;

  location /
  {
    root html;
    index index.html index.htm;
  }
}

配置示例(国密双向)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;
  ssl_client_certificate /usr/local/nginx/conf/demo1.sm2.trust;
  ssl_verify_client on;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

  location /
  {
    root html;
    index index.html index.htm;
  }
}

配置示例(国密/RSA单向自适应)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;
  ssl_verify_client off;

  ssl_certificate /usr/local/nginx/conf/demo1.rsa.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.rsa.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

  location /
  {
    root html;
    index index.html index.htm;
  }
}