HTTPS，NGINX,SSL

1.生成证书

生成根证书

#生成根证书
openssl genrsa -des3 -out root.key
openssl req -new -key root.key -out root.csr
openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey root.key -in root.csr -out root.crt

#服务器证书
openssl genrsa –des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in server.csr -out server.crt

#客户端证书
openssl genrsa -des3 -out client.key 2048
openssl req -new -key client.key -out client.csr
openssl x509 -req -days 730 -sha1 -extensions v3_req -CA root.crt -CAkey root.key -CAserial root.srl -CAcreateserial -in client.csr -out client.crt
openssl pkcs12 -export -in client.crt -inkey client.key -out client.pfx

注意：Common Name 根证书与客户端，服务端证书(IP)不能一样

nginx配置

server {
listen       443 ssl;
server_name  usb.dev;

access_log off;

ssl on;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
ssl_client_certificate /etc/nginx/ssl/ca.crt;
ssl_verify_client on;

location / {
    proxy_pass http://backend$request_uri;
}
}

浏览器chrome配置：
设置->高级->管理证书->导入