NginxSSL

Nginx的安装与配置

• 前端：AngularJS
• 后端：SpringBoot + Tomcat

前端静态资源放在Nginx服务器上，后端Tomcat置于Nginx后方，访问到Tomcat的请求由Nginx转发，全程访问使用https，访问前端地址为默认地址(如 https://192.168.28.232 ) ，访问后端地址加上/server(如 https://192.168.28.232/server )

SSL证书的生成

首先，进入你想创建证书和私钥的目录，例如：

# cd /usr/local/nginx/conf

创建服务器私钥，命令会让你输入一个口令：

# openssl genrsa -des3 -out server.key 2048

创建签名请求的证书（CSR）：

# openssl req -new -key server.key -out server.csr

在加载SSL支持的Nginx并使用上述私钥时不带口令的key：

# openssl rsa -in server.key -out server_nopwd.key

最后标记证书使用上述私钥和CSR：

# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Nginx的安装

Windows平台下的Nginx安装

1. 下载地址：
   http://nginx.org
   文件：nginx-1.9.5.zip
2. 启动
   解压至c:\nginx，运行nginx.exe，默认使用80端口，日志见文件夹C:\nginx\logs
3. 使用
   http://localhost
   访问成功后进入Nginx欢迎界面
4. 关闭
   nginx.exe -s stop 强制关闭
   nginx.exe -s quit 优雅的关闭
5. 修改配置
   修改conf目录下的nginx.conf文件，启用https服务

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    # 允许加载静态资源
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;

    server {
        server_name  localhost;
        # 监听443端口，启用https服务
        listen 443;
        ssl on;
        # ssl证书的位置
        ssl_certificate   C:/nginx-1.9.5/cert/server.crt;
        ssl_certificate_key  C:/nginx-1.9.5/cert/server_nopwd.key;

        ssl_session_timeout  30m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
            ssl_prefer_server_ciphers  on;

        # 加载AngularJS的build之后的文件位置 (gulp build)
        location / {
            root C:/nginx-1.9.5/apps/web-console/build;
            index index.html;
            expires 30d;
            try_files $uri $uri/ /index.html;
        }
        # 反向代理Tomcat服务器，将类似htts://localhost/server的请求转发到Tomcat上
        location /server {
           # /server只是我们定义的请求格式，需要截取/server后面的uri重组url
           if ($request_uri ~ ^/server/(.*)$ ){
                   # 每个服务器都有一个Nginx将请求转发到本地的Tomcat上
                   proxy_pass http://127.0.0.1:8080/$1;
           }
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_redirect off;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

Linux(CentOS)下的Nginx安装

Nginx需要gcc g++开发库之类的环境：
安装make:

# yum -y install gcc automake autoconf libtool make

安装g++:

# yum install gcc gcc-c++

1.安装PCRE库
通过yum安装pcre库,也可以自己下载并make，这里通过yum快速安装：

# yum search pcre
  pcre-devel.i686 : Development files for pcre
  pcre-devel.x86_64 : Development files for pcre
  pcre-static.i686 : Static library for pcre
  pcre-static.x86_64 : Static library for pcre
  pcre-tools.x86_64 : Auxiliary utilities for pcre
  pcre.i686 : Perl-compatible regular expression library
  pcre.x86_64 : Perl-compatible regular expression library
# yum install pcre-static.x86_64

2.安装zlib库
通过yum安装zlib库：

# yum search zlib
  zlib-devel.i686 : Header files and libraries for Zlib development
  zlib-devel.x86_64 : Header files and libraries for Zlib development
  zlib-static.i686 : Static libraries for Zlib development
  zlib-static.x86_64 : Static libraries for Zlib development
  zlib.i686 : The compression and decompression library
  zlib.x86_64 : The compression and decompression library
# yum install zlib-static.x86_64

3.安装OpenSSL

# yum install openssl.x86_64

4.安装Nginx

# cd /usr/local/src
# wget http://nginx.org/download/nginx-1.4.2.tar.gz
# tar -zxvf nginx-1.4.2.tar.gz
# cd nginx-1.4.2
# ./configure --sbin-path=/usr/local/nginx/nginx --with-http_ssl_module
# make 
# make install

5.启动
启动前确保80端口没有被占用：

# netstat -ano|grep 80

运行nginx

# /usr/local/nginx/nginx

6.修改Nginx配置支持https服务

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    server {
        server_name  localhost;
        listen 443;
        ssl on;
        ssl_certificate   /usr/local/cert/server.crt;
        ssl_certificate_key   /usr/local/cert/server_nopwd.key;
        ssl_session_timeout  30m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
            ssl_prefer_server_ciphers  on;

        location / {
            root /usr/local/apps/webconsole/build;
            index index.html index.htm;
            try_files $uri $uri/ /index.html;
        }

        location /server {
           if ($request_uri ~ ^/server/(.*)$ ){
                   proxy_pass http://127.0.0.1:8080/$1;
           }
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_redirect off;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

另外还可以加入如下代码实现80端口重定向到443：

server {
    listen 80;=
    rewrite ^(.*) https://$host$1 permanent;
    # returen效率更高
    # return 301 https://$host$request_uri;
}