自签名
SSL证书太贵了,小老板门又不想花这个钱。
SSL还要定期续费,忘记续费导致线上系统异常,后果难料。。
很多功能、三方接口又™要用HTTPS交互方式。
自签名他来了。。。
又能白嫖了,每年都省出几千几万的成本,老板的嘴角都笑裂开了。。
以下以本机IP:192.168.0.88 来创建一个crt证书,后续可以通过https://192.168.0.88 访问本机
文件分类
1、.key文件:SSL证书私钥文件,包括SSL证书私钥,是信息内容的中心;
2、.csr文件:文件包括证书的公共密钥和公司内部的一些重要秘密信息,用户只有在请求签名后才能直接生成证书;
3、.crt文件:本文件包含S证书的公共密钥、签名信息和不同类型的认证信息。通常,各种签名和签名证书都在这类文件中,如IP;
4、.pem文件:与其他后缀文件相比,该文件更为罕见,其中包含了证书的私密钥和其他部分证书的重要信息。
OpenSSL版本
查看当前是否安装了openssl及版本
[root@iZuf63yp8w5ku5twwur5yuZ ssl]# openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
生成密钥文件
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl genrsa -des3 -out chat.key 1024
Generating RSA private key, 1024 bit long modulus
..........................++++++
...........................++++++
e is 65537 (0x10001)
Enter pass phrase for chat.key:
Verifying - Enter pass phrase for chat.key:
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 4
-rw-r--r-- 1 root root 963 Mar 20 09:52 chat.key
生成申请文件
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl req -new -key chat.key -out chat.csr
Enter pass phrase for chat.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:AnHui
Locality Name (eg, city) [Default City]:HeFei
Organization Name (eg, company) [Default Company Ltd]:Anhui CNBesT Technology Co., Ltd
Organizational Unit Name (eg, section) []:Software R&D Department
Common Name (eg, your name or your server's hostname) []:192.168.0.88
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 8
-rw-r--r-- 1 root root 708 Mar 20 09:56 chat.csr
-rw-r--r-- 1 root root 963 Mar 20 09:52 chat.key
创建ext文件(用于处理浏览器证书异常)
新建文件chat.ext文件,内容如下
[ req ]
default_bits = 1024
distinguished_name = req_distinguished_name
req_extensions = san
extensions = san
[ req_distinguished_name ]
countryName = CN
stateOrProvinceName = Definesys
localityName = Definesys
organizationName = Definesys
[SAN]
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = IP:192.168.0.88
生成证书文件
备份一份服务器密钥文件 chat.key.org
cp chat.key chat.key.org
去除文件口令 chat.key
openssl rsa -in chat.key.org -out chat.key
生成证书文件
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl x509 -req -days 36500 -in chat.csr -signkey chat.key -out chat.crt
Signature ok
subject=/C=CN/ST=AnHui/L=HeFei/O=Anhui CNBesT Technology Co., Ltd/OU=R&D/CN=192.168.0.88
Getting Private key
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 20
-rw-r--r-- 1 root root 912 Mar 20 10:28 chat.crt
-rw-r--r-- 1 root root 680 Mar 20 10:26 chat.csr
-rw-r--r-- 1 root root 460 Mar 20 10:27 chat.ext
-rw-r--r-- 1 root root 887 Mar 20 10:26 chat.key
-rw-r--r-- 1 root root 963 Mar 20 10:26 chat.key.org
更新证书文件
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# openssl x509 -req -days 36500 -in chat.csr -CA chat.crt -CAkey chat.key -CAcreateserial -sha256 -out chat.crt -extfile chat.ext -extensions SAN
Signature ok
subject=/C=CN/ST=AnHui/L=HeFei/O=Anhui CNBesT Technology Co., Ltd/OU=R&D/CN=192.168.0.88
Getting CA Private Key
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]#
[root@iZuf63yp8w5ku5twwur5yuZ chat_ssl]# ll
total 24
-rw-r--r-- 1 root root 3 Mar 20 10:01 chat.crt
-rw-r--r-- 1 root root 708 Mar 20 09:56 chat.csr
-rw-r--r-- 1 root root 473 Mar 20 09:59 chat.ext
-rw-r--r-- 1 root root 963 Mar 20 09:52 chat.key
浏览器证书异常
下载生成的证书文件,双击运行。
安装证书
重启电脑。
nginx配置
将
chat.crt 和chat.key文件放到nginx的conf文件夹中
修改nginx.conf配置如下
# HTTPS server
#
server {
listen 443 ssl;
server_name 192.168.0.88;
ssl_certificate chat.crt;
ssl_certificate_key chat.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
root D:/workspace/blchat/blchat-ui/dist;
try_files $uri $uri/ /index.html;
index index.html index.htm;
}
# chat后端
location /chat-api/{
proxy_pass http://192.168.0.88:2431/; # 将地址代理到api上
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# WebSocket
location /chat-wss/ {
proxy_pass http://192.168.0.88:2431/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
}
重启nginx即可
最终效果