nginx通过shell脚本配置自签名的ssl

#!/bin/bash

cmd_date=`date  "+%Y%m%d"`
if [[ ${nginx_install_path} == */ ]];then
nginx_install_path=${nginx_install_path%*/}
fi
${nginx_install_path}/sbin/nginx -V  2>&1 |  grep configure |grep openssl >> /dev/null
if [ ! $? = 0 ];then
echo "nginx 没有ssl 模块，请添加ssl模块至nginx"
fi

rpm -qa |grep expect >> /dev/null
if [ ! $? = 0 ];then
echo "expect未安装，现在安装expect"
yum install expect -y
fi
if [[ ! -e "/tmp/nginx_ssl_${cmd_date}" ]];then
mkdir /tmp/nginx_ssl_${cmd_date}
fi

which expect
if [ $? != 0 ];then
    echo "expect 安装失败，即将退出。"
    exit 2
fi

if [[ ! -e "/usr/lib64/libssl.so.1.1" ]];then
    if [[ -e "/usr/local/lib64/libssl.so.1.1" ]];then
    ln -s /usr/local/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1
    fi
fi

if [[ ! -e "/usr/lib64/libcrypto.so.1.1" ]];then
    if [[ -e "/usr/local/lib64/libcrypto.so.1.1" ]];then
    ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
    fi
fi

echo "开始创建自签名ssl证书"
cd /tmp/nginx_ssl_${cmd_date}

#生成一个RSA密钥
echo "===========生成一个RSA密钥=============="
/usr/bin/expect <<EOF   
set time -1
spawn openssl genrsa -des3 -out ${cmd_date}nginx.key 1024
expect "${cmd_date}nginx.key:"
send "123456\r"
expect "${cmd_date}nginx.key:"
send "123456\r"
expect eof
EOF

echo ""
sleep 1
cd /tmp/nginx_ssl_${cmd_date}

#生成一个证书请求
echo "=========生成一个证书请求========="
/usr/bin/expect <<EOF   
set time -1
spawn openssl req -new -key ${cmd_date}nginx.key -out ${cmd_date}nginx.csr
expect "${cmd_date}nginx.key:"
send "123456\r"
expect "(2 letter code) \[XX\]:"
send "CN\r"
expect "(full name) \[\]:"
send "GD\r"
expect "\[Default City\]:"
send "SZ\r"
expect "\[Default Company Ltd\]:"
send "ZSJJ\r"
expect "(eg, section) \[\]:"
send "JS\r"
expect "(eg, your name or your server's hostname) \[\]:"
send "${EASYOPS_LOCAL_IP}\r"
expect "Email Address \[\]:"
send "${EASYOPS_LOCAL_IP}@${EASYOPS_LOCAL_IP}.com\r"
expect "challenge password \[\]:"
send "\r"
expect "company name \[\]:"
send "\r"
expect eof
EOF

echo ""
sleep 1

cd /tmp/nginx_ssl_${cmd_date}
cp ${cmd_date}nginx.key ${cmd_date}nginx.key.org

#创建不需要输入密码的RSA证书，否则每次reload、restart都需要输入密码
echo "=========创建不需要输入密码的RSA证书========="
/usr/bin/expect <<EOF   
set time -1
spawn openssl rsa -in ${cmd_date}nginx.key -out ${cmd_date}nginx.key
expect "phrase for ${cmd_date}nginx.key:"
send "123456\r"
expect eof
EOF

echo ""
sleep 1

cd /tmp/nginx_ssl_${cmd_date}

#签发证书
echo "=========签发证书========="
openssl x509 -req -days 36500 -in ${cmd_date}nginx.csr  -signkey ${cmd_date}nginx.key -out ${cmd_date}nginx.crt

echo ""
sleep 1

ls -l /tmp/nginx_ssl_${cmd_date}

cd ${nginx_install_path}
if [[ ! -e nginx_ssl_${cmd_date} ]];then
mkdir nginx_ssl_${cmd_date}
fi

cp -r /tmp/nginx_ssl_${cmd_date}/* nginx_ssl_${cmd_date}

cd conf
cp nginx.conf nginx.conf_$(date  "+%Y%m%d%H%M%S").bak

sed  -i '/^[[:space:]]*server_name[[:space:]]/a\ \ \ \ \ \ \ \ ssl_prefer_server_ciphers on;' nginx.conf
sed  -i '/^[[:space:]]*server_name[[:space:]]/a\ \ \ \ \ \ \ \ ssl_ciphers ALL:!ADH:!EXPORT56:+MEDIUM:+LOW:+SSLv2:+EXP:ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;' nginx.conf
sed  -i '/^[[:space:]]*server_name[[:space:]]/a\ \ \ \ \ \ \ \ ssl_protocols TLSv1 TLSv1.1 TLSv1.2 SSLv2 SSLv3;' nginx.conf
sed  -i '/^[[:space:]]*server_name[[:space:]]/a\ \ \ \ \ \ \ \ ssl_session_timeout 5m;' nginx.conf
sed  -i '/^[[:space:]]*server_name[[:space:]]/a\ \ \ \ \ \ \ \ ssl_certificate_key '"${nginx_install_path}"'/'"nginx_ssl_${cmd_date}"'/'"${cmd_date}"'nginx.key;' nginx.conf
sed  -i '/^[[:space:]]*server_name[[:space:]]/a\ \ \ \ \ \ \ \ ssl_certificate '"${nginx_install_path}"'/'"nginx_ssl_${cmd_date}"'/'"${cmd_date}"'nginx.crt;' nginx.conf

sed  -i '/^[[:space:]]*server_name[[:space:]]/i\ \ \ \ \ \ \ \ listen       443 ssl  default_server;' nginx.conf
sed  -i '/^[[:space:]]*server_name[[:space:]]/i\ \ \ \ \ \ \ \ listen       [::]:443 ssl  default_server;' nginx.conf

sed -i 's/^[[:space:]]*listen[[:space:]]*80;/#\ \ \ \ listen 80;/'  nginx.conf

sed  -i '/^[[:space:]]*server[[:space:]]{/i\ \ \ \ server {\
\ \ \ \ \ \ \ \ listen 80;\
'"$(cat nginx.conf|grep "^[[:space:]]* server_name")"'\
\ \ \ \ \ \ \ \ rewrite /(.*) https://$host permanent; break;\
\ \ \ \ }' nginx.conf

sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_send_timeout 30;' nginx.conf
sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_read_timeout 30;' nginx.conf
sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_connect_timeout 30;' nginx.conf
sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' nginx.conf
sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_set_header X-Real-IP $remote_addr;' nginx.conf
sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_set_header Host $host;' nginx.conf
sed  -i '/^[[:space:]]*proxy_pass[[:space:]]*http/a\ \ \ \ \ \ \ \ \ \ \ \ proxy_redirect off;' nginx.conf

echo "====================重启nginx==============================="
${nginx_install_path}/sbin/nginx -t
${nginx_install_path}/sbin/nginx -s stop
${nginx_install_path}/sbin/nginx