nginx 的 ssl 模块安装

我的已经有了nginx,直接进入源码目录

./configure --prefix=/usr/local/nginx --with-http_ssl_module
make

使用 make 命令编译（使用make install会重新安装nginx），此时当前目录会出现 objs 文件夹。

bjs/src/core/ngx_open_file_cache.o
objs/src/core/ngx_crypt.o
objs/src/core/ngx_proxy_protocol.o
objs/src/core/ngx_syslog.o
objs/src/event/ngx_event.o
objs/src/event/ngx_event_timer.o
objs/src/event/ngx_event_posted.o
objs/src/event/ngx_event_accept.o
objs/src/event/ngx_event_udp.o
objs/src/event/ngx_event_connect.o
objs/src/event/ngx_event_pipe.o
objs/src/os/unix/ngx_time.o
objs/src/os/unix/ngx_errno.o
objs/src/os/unix/ngx_alloc.o
objs/src/os/unix/ngx_files.o
objs/src/os/unix/ngx_socket.o
objs/src/os/unix/ngx_recv.o
objs/src/os/unix/ngx_readv_chain.o
objs/src/os/unix/ngx_udp_recv.o
objs/src/os/unix/ngx_send.o
objs/src/os/unix/ngx_writev_chain.o
objs/src/os/unix/ngx_udp_send.o
objs/src/os/unix/ngx_udp_sendmsg_chain.o
objs/src/os/unix/ngx_channel.o
objs/src/os/unix/ngx_shmem.o
objs/src/os/unix/ngx_process.o
objs/src/os/unix/ngx_daemon.o
objs/src/os/unix/ngx_setaffinity.o
objs/src/os/unix/ngx_setproctitle.o
objs/src/os/unix/ngx_posix_init.o
objs/src/os/unix/ngx_user.o
objs/src/os/unix/ngx_dlopen.o
objs/src/os/unix/ngx_process_cycle.o
objs/src/os/unix/ngx_linux_init.o
objs/src/event/modules/ngx_epoll_module.o
objs/src/os/unix/ngx_linux_sendfile_chain.o
objs/src/event/ngx_event_openssl.o
objs/src/event/ngx_event_openssl_stapling.o
objs/src/core/ngx_regex.o
objs/src/http/ngx_http.o
objs/src/http/ngx_http_core_module.o
objs/src/http/ngx_http_special_response.o
objs/src/http/ngx_http_request.o
objs/src/http/ngx_http_parse.o
objs/src/http/modules/ngx_http_log_module.o
objs/src/http/ngx_http_request_body.o
objs/src/http/ngx_http_variables.o
objs/src/http/ngx_http_script.o
objs/src/http/ngx_http_upstream.o
objs/src/http/ngx_http_upstream_round_robin.o
objs/src/http/ngx_http_file_cache.o
objs/src/http/ngx_http_write_filter_module.o
objs/src/http/ngx_http_header_filter_module.o
objs/src/http/modules/ngx_http_chunked_filter_module.o
objs/src/http/modules/ngx_http_range_filter_module.o
objs/src/http/modules/ngx_http_gzip_filter_module.o
objs/src/http/ngx_http_postpone_filter_module.o
objs/src/http/modules/ngx_http_ssi_filter_module.o
objs/src/http/modules/ngx_http_charset_filter_module.o
objs/src/http/modules/ngx_http_userid_filter_module.o
objs/src/http/modules/ngx_http_headers_filter_module.o
objs/src/http/ngx_http_copy_filter_module.o
objs/src/http/modules/ngx_http_not_modified_filter_module.o
objs/src/http/modules/ngx_http_static_module.o
objs/src/http/modules/ngx_http_autoindex_module.o
objs/src/http/modules/ngx_http_index_module.o
objs/src/http/modules/ngx_http_mirror_module.o
objs/src/http/modules/ngx_http_try_files_module.o
objs/src/http/modules/ngx_http_auth_basic_module.o
objs/src/http/modules/ngx_http_access_module.o
objs/src/http/modules/ngx_http_limit_conn_module.o
objs/src/http/modules/ngx_http_limit_req_module.o
objs/src/http/modules/ngx_http_geo_module.o
objs/src/http/modules/ngx_http_map_module.o
objs/src/http/modules/ngx_http_split_clients_module.o
objs/src/http/modules/ngx_http_referer_module.o
objs/src/http/modules/ngx_http_rewrite_module.o
objs/src/http/modules/ngx_http_ssl_module.o
objs/src/http/modules/ngx_http_proxy_module.o
objs/src/http/modules/ngx_http_fastcgi_module.o
objs/src/http/modules/ngx_http_uwsgi_module.o
objs/src/http/modules/ngx_http_scgi_module.o
objs/src/http/modules/ngx_http_memcached_module.o
objs/src/http/modules/ngx_http_empty_gif_module.o
objs/src/http/modules/ngx_http_browser_module.o
objs/src/http/modules/ngx_http_upstream_hash_module.o
objs/src/http/modules/ngx_http_upstream_ip_hash_module.o
objs/src/http/modules/ngx_http_upstream_least_conn_module.o
objs/src/http/modules/ngx_http_upstream_random_module.o
objs/src/http/modules/ngx_http_upstream_keepalive_module.o
objs/src/http/modules/ngx_http_upstream_zone_module.o
objs/ngx_modules.o
-ldl -lpthread -lcrypt -lpcre -lssl -lcrypto -ldl -lpthread -lz
-Wl,-E
sed -e “s|%%PREFIX%%|/usr/local/nginx|”
-e “s|%%PID_PATH%%|/usr/local/nginx/logs/nginx.pid|”
-e “s|%%CONF_PATH%%|/usr/local/nginx/conf/nginx.conf|”
-e “s|%%ERROR_LOG_PATH%%|/usr/local/nginx/logs/error.log|”
< man/nginx.8 > objs/nginx.8
make[1]: 离开目录“/usr/local/nginx-1.18.0”

用新的 nginx 文件覆盖当前的 nginx 文件

cp  objs/nginx  /usr/local/nginx/sbin/ 
cd /usr/local/nginx/sbin/
./nginx -s reload
./nginx -V

[root@localhost sbin]# ./nginx -V
nginx version: nginx/1.18.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module

configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module 说明已经安装成功

安装完成

SSL证书配置

下载申请好的 ssl 证书文件压缩包到本地并解压（这里是用的 pem 与 key 文件，文件名可以更改）。
在 nginx 目录新建 cert 文件夹存放证书文件。

cd /usr/local/nginx
mkdir cert

将这两个文件上传至服务器的 cert 目录里。

nginx.conf 配置

编辑 /usr/local/nginx/conf/nginx.conf 配置文件：

配置 https server。
注释掉之前的 http server 配置，新增 https server：

server {
    listen 443 ssl;
    server_name xxx.xxx.cn; #域名
    charset utf-8;
   	 ssl on;
    ssl_certificate    /user/local/ngix/cert/xxx.pem; # 证书路径
    ssl_certificate_key  /user/local/ngix/cert/xxx.key; # 请求认证 key 的路径

   ssl_session_timeout 30m;
   ssl_ciphers ECDHE-RSA-AES256-SHA,ECDHE-RSA-AES256-GCM-SHA384,AES256-SHA256,AES128-SHA256,ECDHE-RSA-AES128-SHAZ56,ECDHE-RSA-AES128-GCM-SHAZ56,AES256-SHA,AES128-SHA;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2 SSLv3; 
   ssl_prefer_server_ciphers on;