Windows下Nginx配置SSL实现Https访问(包含证书生成) Windows下Nginx配置SSL实现Https访问(包含证书生成)   首先要说明为什么要实现https?   HTT

 

Windows下Nginx配置SSL实现Https访问(包含证书生成)

Windows下Nginx配置SSL实现Https访问(包含证书生成)

  首先要说明为什么要实现https?

  HTTP全名超文本传输协议,客户端据此获取服务器上的超文本内容。超文本内容则以HTML为主,客户端拿到HTML内容后可根据规范进行解析呈现。因此,HTTP主要负责的是“内容的请求和获取”。问题就出在这部分。行监控、劫持、阻挡等行为很容易导致网站泄密,一些关键参数比如登录密码开发者会在客户端进行MD5加密,不过互联网所承载的机密信息远不只是密码,搜索内容同样属于敏感信息。现如今,百度、谷歌、Github等网站已经全站启用https,https就像是给网站上了一个“锁”,HTTPS做的就是给请求加密,让其对用户更加安全。对于自身而言除了保障用户利益外,还可避免本属于自己的流量被挟持,以保护自身利益。所以在我看来,终有一天HTTPS会实现全网普及。

  下面进入正题。

  说明:此教程适合已经配置好WNMP环境,并配置Virtualhost实现多站点的同学。如果您尚未配置,请参照我之前的文章进行配置。

  实现Https首先需要向管理机构申请证书,而我们此次由于是练习目的,所以通过Openssl自己生成证书。首先我们需要用到生成证书的Openssl软件。

步骤:

1. 安装Openssl

  下载地址:http://slproweb.com/products/Win32OpenSSL.html (根据系统选择32位或者64位版本下载安装)。

  下载完成后,进行安装,我安装在了 C:\wnmp\OpenSSL-Win64文件夹中。

2. 安装ActivePerl (此软件目的为了解析pl文件,部分系统不安装也可以实现本教程的功能,安装该软件目的为了学习perl)。

  下载地址:http://www.activestate.com/activeperl/downloads/  (根据系统选择win32或者win64版本下载安装)。

3. 配置环境变量

  在环境变量中添加环境变量

    变量名: OPENSSL_HOME            变量值:C:\wnmp\OpenSSL-Win64\bin;        (变量值为openssl安装位置)

    在path变量结尾添加如下 : %OPENSSL_HOME%;

配置文件openssl.cnf

#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#


# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = $ENV::HOME/.rnd


# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids


# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)


[ new_oids ]


# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6


# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7


####################################################################
[ ca ]
default_ca = CA_default # The default ca section


####################################################################
[ CA_default ]


dir = /usr/ssl # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.


certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file


x509_extensions = usr_cert # The extentions to add to the cert


# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options


# Extension copying option: use with caution.
# copy_extensions = copy


# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions = crl_ext


default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = default # use public key default MD
preserve = no # keep passed DN ordering


# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match


# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional


# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional


####################################################################
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert


# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret


# This sets a mask for permitted string types. There are several options. 
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only


# req_extensions = v3_req # The extensions to add to a certificate request


[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = AU
countryName_min = 2
countryName_max = 2


stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Some-State


localityName = Locality Name (eg, city)


0.organizationName = Organization Name (eg, company)
0.organizationName_default = Internet Widgits Pty Ltd


# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd


organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =


commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_max = 64


emailAddress = Email Address
emailAddress_max = 64


# SET-ex3 = SET extension number 3


[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20


unstructuredName = An optional company name


[ usr_cert ]


# These extensions are added when 'ca' signs a request.


# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.


basicConstraints=CA:FALSE


# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.


# This is OK for an SSL server.
# nsCertType = server


# For an object signing certificate this would be used.
# nsCertType = objsign


# For normal client use this is typical
# nsCertType = client, email


# and for everything including object signing:
# nsCertType = client, email, objsign


# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment


# This will be displayed in Netscape's comment listbox.
nsComment = "OpenSSL Generated Certificate"


# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer


# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move


# Copy subject details
# issuerAltName=issuer:copy


#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName


# This is required for TSA certificates.
# extendedKeyUsage = critical,timeStamping


[ v3_req ]


# Extensions to add to a certificate request


basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment


[ v3_ca ]




# Extensions for a typical CA




# PKIX recommendation.


subjectKeyIdentifier=hash


authorityKeyIdentifier=keyid:always,issuer


# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true


# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign


# Some might want this also
# nsCertType = sslCA, emailCA


# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy


# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF


[ crl_ext ]


# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.


# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always


[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate


# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.


basicConstraints=CA:FALSE


# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.


# This is OK for an SSL server.
# nsCertType = server


# For an object signing certificate this would be used.
# nsCertType = objsign


# For normal client use this is typical
# nsCertType = client, email


# and for everything including object signing:
# nsCertType = client, email, objsign


# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment


# This will be displayed in Netscape's comment listbox.
nsComment = "OpenSSL Generated Certificate"


# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer


# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move


# Copy subject details
# issuerAltName=issuer:copy


#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName


# This really needs to be in place for it to be a proxy certificate.
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo


####################################################################
[ tsa ]


default_tsa = tsa_config1 # the default TSA section


[ tsa_config1 ]


# These are used by the TSA reply generation only.
dir = ./demoCA # TSA root directory
serial = $dir/tsaserial # The current serial number (mandatory)
crypto_device = builtin # OpenSSL engine to use for signing
signer_cert = $dir/tsacert.pem # The TSA signing certificate
# (optional)
certs = $dir/cacert.pem # Certificate chain to include in reply
# (optional)
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)


default_policy = tsa_policy1 # Policy if request did not specify it
# (optional)
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
digests = md5, sha1 # Acceptable message digests (mandatory)
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
clock_precision_digits  = 0 # number of digits after dot. (optional)
ordering = yes # Is ordering defined for timestamps?
# (optional, default: no)
tsa_name = yes # Must the TSA name be included in the reply?
# (optional, default: no)
ess_cert_id_chain = no # Must the ESS cert id chain be included?
# (optional, default: no)






生成证书

可以通过以下步骤生成一个简单的证书:
首先,进入你想创建证书和私钥的目录,例如:

  1. $ cd /usr/local/nginx/conf

创建服务器私钥,命令会让你输入一个口令:

  1. $ openssl genrsa -des3 -out server.key 1024  -config ../openssl.cnf

创建签名请求的证书(CSR):

  1. $ openssl req -new -key server.key -out server.csr  -config ../openssl.cnf

在加载SSL支持的Nginx并使用上述私钥时除去必须的口令:

  1. $ cp server.key server.key.org
  2. $ openssl rsa -in server.key.org -out server.key

配置nginx

最后标记证书使用上述私钥和CSR:

  1. $ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

修改Nginx配置文件,让其包含新标记的证书和私钥:

  1. server {
  2.     server_name YOUR_DOMAINNAME_HERE;
  3.     listen 443;
  4.     ssl on;
  5.     ssl_certificate /usr/local/nginx/conf/server.crt;
  6.     ssl_certificate_key /usr/local/nginx/conf/server.key;
  7. }

重启nginx。
这样就可以通过以下方式访问:

https://YOUR_DOMAINNAME_HERE

另外还可以加入如下代码实现80端口重定向到443IT人乐园

  1. server {
  2. listen 80;
  3. server_name ww.centos.bz;
  4. rewrite ^(.*) https://$server_name$1 permanent;
  5. }


  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值