Nginx配置https

Nginx配置https

配置秘钥

# 1.创建服务器证书密钥文件
openssl genrsa -des3 -out server.key 1024
...
Enter pass phrase for server.key:			# 输入密码			
Verifying - Enter pass phrase for server.key:		# 确认密码


# 2.创建服务器证书的申请文件
openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:			# 输入前面创建的密码		
...
Country Name (2 letter code) [XX]:CN			# 国家代号. 中国输入 CN	
State or Province Name (full name) []:BeiJing		# 省的全名. 拼音	
Locality Name (eg, city) [Default City]:BeiJing		# 市的全名. 拼音	
Organization Name (eg, company) [Default Company Ltd]:Coco	# 公司英文名	
Organizational Unit Name (eg, section) []:		# 可以不输入		
Common Name (eg, your name or your server's hostname) []:www.Coco.com # 域名	
Email Address []:ChenZhuang1217@163.com			 # 电子邮箱. 可随意填
...
A challenge password []:				# 可以不输入		
An optional company name []:				# 可以不输入		


# 3.备份一份服务器密钥文件
cp server.key server.key.org


# 4.去除文件口令
openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:			# 输入密码				

# 5.生成证书文件
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJing/O=Coco/CN=www.Coco.com/emailAddress=ChenZhuang1217@163.com
Getting Private key

配置nginx

server {
	listen 443;
	ssl on;
	###############
	# listen  443 ssl;       两种方式,需要根据nginx版本而定,此种使用与1.10

    ssl_certificate ssl/server.crt;		# 证书地址,此处相对路径为/nginx/conf
    ssl_certificate_key ssl/server.key;		# 秘钥地址
    server_name  www.Coco.com;			# 代理地址
    
    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
	ssl_prefer_server_ciphers  on;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}