网站SSL证书自签名及谷歌浏览器报错提醒处理

自签名

SSL证书太贵了，小老板门又不想花这个钱。
SSL还要定期续费，忘记续费导致线上系统异常，后果难料。。
很多功能、三方接口又™要用HTTPS交互方式。
自签名他来了。。。
又能白嫖了，每年都省出几千几万的成本，老板的嘴角都笑裂开了。。

以下以本机IP：192.168.0.88 来创建一个crt证书，后续可以通过https://192.168.0.88 访问本机

文件分类

1、.key文件：SSL证书私钥文件，包括SSL证书私钥，是信息内容的中心；

2、.csr文件:文件包括证书的公共密钥和公司内部的一些重要秘密信息，用户只有在请求签名后才能直接生成证书；

3、.crt文件：本文件包含S证书的公共密钥、签名信息和不同类型的认证信息。通常，各种签名和签名证书都在这类文件中，如IP；

4、.pem文件：与其他后缀文件相比，该文件更为罕见，其中包含了证书的私密钥和其他部分证书的重要信息。

OpenSSL版本

查看当前是否安装了openssl及版本

[root@iZuf63yp8w5ku5twwur5yuZ ssl]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

生成密钥文件

[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl genrsa -des3 -out chat.key 1024
Generating RSA private key, 1024 bit long modulus
..........................++++++
...........................++++++
e is 65537 (0x10001)
Enter pass phrase for chat.key:
Verifying - Enter pass phrase for chat.key:
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 4
-rw-r--r-- 1 root root 963 Mar 20 09:52 chat.key

生成申请文件

[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl req -new -key chat.key -out chat.csr
Enter pass phrase for chat.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:AnHui
Locality Name (eg, city) [Default City]:HeFei
Organization Name (eg, company) [Default Company Ltd]:Anhui CNBesT Technology Co., Ltd
Organizational Unit Name (eg, section) []:Software R&D Department
Common Name (eg, your name or your server's hostname) []:192.168.0.88
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 8
-rw-r--r-- 1 root root 708 Mar 20 09:56 chat.csr
-rw-r--r-- 1 root root 963 Mar 20 09:52 chat.key

创建ext文件（用于处理浏览器证书异常）

新建文件chat.ext文件，内容如下

[ req ]
default_bits        = 1024
distinguished_name  = req_distinguished_name
req_extensions      = san
extensions          = san
[ req_distinguished_name ]
countryName         = CN
stateOrProvinceName = Definesys
localityName        = Definesys
organizationName    = Definesys
[SAN]
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = IP:192.168.0.88

生成证书文件

备份一份服务器密钥文件 chat.key.org

cp chat.key chat.key.org

去除文件口令 chat.key

openssl rsa -in chat.key.org -out chat.key

生成证书文件

[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl x509 -req -days 36500 -in chat.csr -signkey chat.key -out chat.crt
Signature ok
subject=/C=CN/ST=AnHui/L=HeFei/O=Anhui CNBesT Technology Co., Ltd/OU=R&D/CN=192.168.0.88
Getting Private key
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 20
-rw-r--r-- 1 root root 912 Mar 20 10:28 chat.crt
-rw-r--r-- 1 root root 680 Mar 20 10:26 chat.csr
-rw-r--r-- 1 root root 460 Mar 20 10:27 chat.ext
-rw-r--r-- 1 root root 887 Mar 20 10:26 chat.key
-rw-r--r-- 1 root root 963 Mar 20 10:26 chat.key.org

更新证书文件

[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl x509 -req -days 36500 -in chat.csr -CA chat.crt -CAkey chat.key -CAcreateserial -sha256 -out chat.crt -extfile chat.ext -extensions SAN
Signature ok
subject=/C=CN/ST=AnHui/L=HeFei/O=Anhui CNBesT Technology Co., Ltd/OU=R&D/CN=192.168.0.88
Getting CA Private Key
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# 
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 24
-rw-r--r-- 1 root root   3 Mar 20 10:01 chat.crt
-rw-r--r-- 1 root root 708 Mar 20 09:56 chat.csr
-rw-r--r-- 1 root root 473 Mar 20 09:59 chat.ext
-rw-r--r-- 1 root root 963 Mar 20 09:52 chat.key

浏览器证书异常

下载生成的证书文件，双击运行。

安装证书






重启电脑。

nginx配置

将
chat.crt 和chat.key文件放到nginx的conf文件夹中

修改nginx.conf配置如下

# HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  192.168.0.88;

        ssl_certificate      chat.crt;
        ssl_certificate_key  chat.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   D:/workspace/blchat/blchat-ui/dist;
			try_files $uri $uri/ /index.html;
            index  index.html index.htm;
        }
		
		# chat后端
        location /chat-api/{
            proxy_pass   http://192.168.0.88:2431/; # 将地址代理到api上
            proxy_set_header    Host    $http_host;
            proxy_set_header    X-Real-IP   $remote_addr;
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        }
		
		 # WebSocket
        location /chat-wss/ {
            proxy_pass http://192.168.0.88:2431/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_read_timeout 86400;
        }
    }

重启nginx即可

最终效果