nginx反向代理加https证书和自动跳转配置

nginx反向代理加https证书和自动跳转配置

1.机器规划：

nginx代理机器：192.168.14.128

tomcat1机器: 192.168.14.129

tomcat2机器：192.168.14.130

2.实际操作步骤

1)不用nginx代理时候的直接访问后端网站：

 

2)配置域名解析（即类似DNS解析，通过域名能解析到nginx机器的IP，此处在本地window机器的hosts文件中配置解析，也可由自己的DNS服务器解决）

aaaaa.hotread.com   <------->  192.168.14.128  (相互对应)

 

3)nginx机器上(192.168.14.128)安装nginx，并配置反向代理,能通过nginx负载均衡访问服务

[root@bogon ~]# useradd nginx

[root@bogon ~]# yum -y install gcc gcc-c++

[root@bogon ~]# yum -y install openssl-devel zlib-devel pcre-devel

[root@bogon ~]# ls

nginx-1.0.5.tar.gz

[root@bogon ~]# tar -zxf nginx-1.0.5.tar.gz

[root@bogon ~]# ls

nginx-1.0.5  nginx-1.0.5.tar.gz

[root@bogon ~]# cd nginx-1.0.5

[root@bogon nginx-1.0.5]# ls

auto  CHANGES  CHANGES.ru  conf  configure  contrib  html  LICENSE  man  README  src

[root@bogon nginx-1.0.5]# ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx --with-http_ssl_module

[root@bogon nginx-1.0.5]# make && make install

[root@bogon nginx-1.0.5]# ls /usr/local/nginx/

conf  html  logs  sbin

[root@bogon nginx-1.0.5]# vim /usr/local/nginx/conf/nginx.conf

.........

    upstream myserver {

        server 192.168.14.129:8080;

        server 192.168.14.130:8080;

    }

    server {

        listen       80;

        server_name  aaaaa.hotread.com;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {

            root   html;

            index  index.html index.htm;

            proxy_pass  http://myserver;

        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

}

[root@bogon nginx-1.0.5]# /usr/local/nginx/sbin/nginx

[root@bogon nginx-1.0.5]# netstat -anput |grep 80

tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      3691/nginx   

浏览器访问：http://aaaaa.hotread.com/ 

 

4)在阿里云上申请域名对应的ca证书和私钥(aaaaa.hotread.com)，然后下载下来 

下载后，解压并重命名后my.key和my.pem，如下图： 

5)在nginx机器上配置https证书并配置能强制跳转到https的访问

[root@bogon nginx-1.0.5]# vim /usr/local/nginx/conf/nginx.conf

....................

    upstream myserver {

        server 192.168.14.129:8080;

        server 192.168.14.130:8080;

    }

#注意：下面已测：只有301时候可以跳转，307或其他不能跳转，或者不用if判断，直接使用跳转那条也可。

    server {

        listen       80;

        server_name  aaaaa.hotread.com;

        if ($scheme = http){

            return 301 https://$host$request_uri;#或return 301 https://$server_name$request_uri;

        }

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {

            root   html;

            index  index.html index.htm;

            proxy_pass  http://myserver;

        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

}

    server {

        listen       443;

        server_name  aaaaa.hotread.com;

        ssl                  on;

        ssl_certificate      /usr/local/nginx/ssl/my.pem;

        ssl_certificate_key  /usr/local/nginx/ssl/my.key;

    #    ssl_session_timeout  5m;

    #    ssl_protocols  SSLv2 SSLv3 TLSv1;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;

    #    ssl_prefer_server_ciphers   on;

        location / {

            root   html;

            index  index.html index.htm;

            proxy_pass  http://myserver;

        }

}

[root@bogon nginx-1.0.5]# mkdir /usr/local/nginx/ssl

[root@bogon nginx-1.0.5]# cd /usr/local/nginx/ssl/

[root@bogon ssl]# rz

上传上面改过名的证书和私钥，如下：

[root@bogon ssl]# ls

my.key  my.pem

[root@bogon ssl]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@bogon ssl]# /usr/local/nginx/sbin/nginx -s reload

客户端浏览器访问时候能自动跳转，如下：

访问http://aaaaa.hotread.com 会自动跳转到  https://aaaaa.hotread.com 且没有不安全的提示

 回车后，如下：刷新还可以轮询