centos7 nginx+tomcat配置https 安装免费SSL Let’s Encrypt

1、centos7 没有安装git 下面命令安装Git

yum -y install git bc epel-release

2、下载Let’s Encrypt

git clone https://github.com/letsencrypt/letsencrypt

3、生成证书 邮箱 例如：1234@qq.com 申请的域名：例如： baidu.com

./letsencrypt-auto certonly --email 1234@qq.com -d baidu.com

4、生成四个文件
找不到生成的位置可以用 find / -name fullchain.pem

cd /etc/letsencrypt/live/baidu.com
cert.pem  chain.pem  fullchain.pem  privkey.pem

5、配置nginx baidu.com替换成自己的域名

 server {
        listen       443 ssl;
        server_name  baidu.com;
        root         /usr/share/nginx/html;
        ssl          on;

        ssl_certificate "/etc/letsencrypt/live/baidu.com/fullchain.pem";
        ssl_certificate_key "/etc/letsencrypt/live/baidu.com/privkey.pem";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        location / {
           proxy_pass http://127.0.0.1:8088;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

6、重启nginx

service nginx restart 

7、https域名访问启动tomcat页面