Nginx自有证书生成

最新推荐文章于 2024-08-15 16:42:36 发布

老虎爱代码

最新推荐文章于 2024-08-15 16:42:36 发布

阅读量550

点赞数 1

文章标签： nginx linux ssl https python

本文链接：https://blog.csdn.net/qq_34399969/article/details/108105240

版权

OPENSSL生成Nginx自有证书，

1、创建配置文件—MyCompanyCA.cnf

[ req ]
distinguished_name  = req_distinguished_name
x509_extensions     = root_ca

[ req_distinguished_name ]

# 以下内容可随意填写
countryName             = CN (2 letter code)
countryName_min         = 2
countryName_max         = 2
stateOrProvinceName     = JiangSu
localityName            = Suzhou
0.organizationName      = xxxx #把公司名称放在这里
organizationalUnitName  = technology 
commonName              = develop 
commonName_max          = 64
emailAddress            = xxxxxxxx@xxx.com #可以把公司的开放mail放置在这里
emailAddress_max        = 64
[ root_ca ]
basicConstraints        = critical, CA:true

2、配置ip或域名扩展文件—MyCompanyLocalhost.ext

[req_ext]
subjectAltName = @alt_names
extendedKeyUsage = serverAuth
[alt_names]
# 域名，如有多个用DNS.2,DNS.3…来增加
DNS.1 = domain.com 
# IP地址
IP.1 = 127.0.0.1

3、生成证书

openssl req -x509 -newkey rsa:2048 -out MyCompanyCA.cer -outform PEM -keyout MyCompanyCA.pvk -days 10000 -verbose -config MyCompanyCA.cnf -nodes -sha256 -subj "/CN=company name CA"
openssl req -newkey rsa:2048 -keyout MyCompanyLocalhost.pvk -out MyCompanyLocalhost.req -subj /CN=localhost -sha256 -nodes
openssl x509 -req -CA MyCompanyCA.cer -CAkey MyCompanyCA.pvk -in MyCompanyLocalhost.req -out MyCompanyLocalhost.cer -days 10000 -extfile MyCompanyLocalhost.ext -sha256 -set_serial 0x1111
#运行将生成一些文件
MyCompanyCA.cer #可以导入导浏览器，这样访问就是绿色标识了
MyCompanyLocalhost.cer #配置nginx
MyCompanyLocalhost.pvk #配置nginx

4、更新Nginx配置文件

#一般Nginx配置文件放置在
/etc/nginx
在这个目录将上面生成的
MyCompanyLocalhost.cer
MyCompanyLocalhost.pvk
拷贝过来
更新Nginx配置文件
server {
        listen       443 ssl;
        charset utf-8;
		client_max_body_size          200m; 
		client_header_timeout	      1m; 
		client_body_timeout           1m; 
		proxy_connect_timeout         60s; 
		proxy_read_timeout            1200;  
		proxy_send_timeout            1m;

        ssl on;
        ssl_certificate      MyCompanyLocalhost.cer;
        ssl_certificate_key  MyCompanyLocalhost.pvk;
	
       index index.html index.htm index.nginx-debian.html;
      ...
}