Nginx(12):nginx配置https

最近收到封邮件说我丢失的的iphone在维修店被激活,上面有2个连接让我登录appleid来锁定手机。在点开页面在“苹果网页”输入密码后地址不是不是https。马上百度苹果真正的登录页面把密码改了。
我么来看看https和http有什么不同之处。
HTTPS
SSL Secure Sockets Layer 3.0
TLS Transport Layer Security 1.0
key tool java的一个工具在jdk的bin目录下
openssl 是个开源的工具,我的linux已经安装了:

[root@iZ2zei0nwllapkwklisoncZ ~]# openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Mon Jun 29 12:45:07 UTC 2015
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) 
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic 

看一下nginx有没有安装ssl模块

[root@iZ2zei0nwllapkwklisoncZ nginx-1.10.1]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.10.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) 
configure arguments:

没有,需要用nginx的源代码包重新编译,使用configure工具：

./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

报错：

./configure: error: SSL modules require the OpenSSL library.
You can either do not enable the modules, or install the OpenSSL library
into the system, or build the OpenSSL library statically from the source
with nginx by using --with-openssl=<path> option.

yum install openssl openssl-devel   -y 

后再次执行
然后使用 make命令,注意不要make install否则会覆盖usr/local下面的nginx
make完毕后关掉kill -QUIT nginx
再把/data/nginx-1.10.1/objs/下的nginx替换掉/usr/local/nginx/sbin/下的nginx
再次确认是否安装ssl模块

[root@iZ2zei0nwllapkwklisoncZ sbin]# ./nginx -V
nginx version: nginx/1.10.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) 
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

nginx配置:

 # HTTPS server
   server {
      listen       443;
      server_name  upstream  www.boysonic.com;
      access_log  /usr/local/nginx/logs/host.access443.log;
      ssl on;
      ssl_certificate      cert/214107046600206.pem;
      ssl_certificate_key  cert/214107046600206.key;

      ssl_session_timeout 5m;
      ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      ssl_prefer_server_ciphers on;

      location / {
           root   html;
           index  index.html index.htm;
       }
   }

访问https://www.boysonic.com/