Linux中使用nginx代理https
生成自签名证书
# 生成一对秘钥,把公钥做成证书
[root@localhost crt]# openssl genrsa -out /home/ca.key 2048
Generating RSA private key, 2048 bit long modulus
....................................+++
.........+++
e is 65537 (0x10001)
[root@localhost crt]# ls
[root@localhost crt]# openssl genrsa -out /home/crt/ca.key 2048
Generating RSA private key, 2048 bit long modulus
.......................................................................................................................+++
.............................................................................................+++
e is 65537 (0x10001)
[root@localhost crt]# ls
ca.key
# 生成证书CRT
[root@localhost crt]# openssl req -new -x509 -key /home/crt/ca.key -out /home/crt/server.crt -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:l^H^H^H
string is too long, it needs to be less than 2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GS
Locality Name (eg, city) [Default City]:LZ
Organization Name (eg, company) [Default Company Ltd]:LDEY
Organizational Unit Name (eg, section) []:YF
Common Name (eg, your name or your server's hostname) []:CZD
Email Address []:2574920008@qq.com
[root@localhost crt]# ls
ca.key server.crt
生成成功以后 /home目录下生成ca.key和server.crt文件
此时配置Nginx如下:
server {
listen 443 ssl;
root /;
server_name 102.108.10.30;
ssl_certificate /home/server.crt;
ssl_certificate_key /home/ca.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
location / {
proxy_pass https://182.63.200.29:8090/;
}
}
重启Nginx: service nginx restart
此时在次访问: