nginx配https转发

1、生成证书

创建私钥 长度2048

openssl genrsa -out privkey.pem 2048
##完成后会在当前目录生成私钥文件

自己制作证书

openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095

需要输入信息如下

字段	说明	示例
Country	ISO国家代码(两位字母)	CN
State or Provine Name	所在省份	LiaoNing
Locality Name	所在城市	ShenYang
Organization Name	公司名称	PuFei
Organization Unit Name	部门名称	IT Dept
Common Name	申请证书域名	www.baidu.com
Email Address	电子邮箱(可以不输入)	-
A challenge password	加密证书请求密码(可以不输入)	-

2、配置https

# 配置转发到harbor
server {
    listen 80;
    listen 443 ssl http2;
    server_name harbor.dongriaf.com;
    ssl_certificate         /etc/nginx/cert/cacert.pem; #pem证书路径
    ssl_certificate_key     /etc/nginx/cert/privkey.pem; #pem证书key路径
    ssl_session_timeout     5m; #会话超时时间
    ssl_ciphers     ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #加密算法
    ssl_protocols   TLSv1 TLSv1.1 TLSv1.2; #SSL协议
    ssl_prefer_server_ciphers on;

    location / {
        # proxy_pass http://localhost:5050;
        proxy_pass https://localhost:6443; # 转发到harbor的https端口
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

3、配置https并且支持websocket

# websocket 配置变量
map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

# 配置转发去rancher
server{
  listen 80;
  listen 443 ssl http2;

  server_name rancher.dongriaf.com;

  ssl_certificate         /etc/nginx/cert/cacert.pem; #pem证书路径
  ssl_certificate_key     /etc/nginx/cert/privkey.pem; #pem证书key路径
  ssl_session_timeout     5m; #会话超时时间
  ssl_ciphers     ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #加密算法
  ssl_protocols   TLSv1 TLSv1.1 TLSv1.2; #SSL协议
  ssl_prefer_server_ciphers on;

  location / {
        proxy_http_version 1.1; #代理使用的http协议
        proxy_set_header Host $host; #header添加请求host信息
        proxy_set_header X-Real-IP $remote_addr; # header增加请求来源IP信息
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # 增加代理记录
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_pass http://localhost:5060; #服务A访问地址
  }
}