lighttp 简易部署SSL

solosoft

已于 2023-12-13 23:46:32 修改

阅读量410

点赞数

文章标签： ssl 网络协议网络 https

于 2022-12-13 21:38:43 首次发布

本文链接：https://blog.csdn.net/qq_41470971/article/details/128307612

版权

下载 apache 版的证书，执行下面命令，注意，域名改成自己的：

cat urdomain.xxx.key <(echo) urdomain.xxx.crt > urdomain.xxx.pem
sudo cp urdomain.xxx.pem root_bundle.crt /etc/lighttpd/ssl/

/etc/lighttd/lighttpd.conf 做如下更改：

`server.modules += (）段增加 mod_openssl

server.modules += (
        "mod_openssl",
        "mod_setenv",
        "mod_compress",
        "mod_dirlisting",
        "mod_staticfile",
        "mod_accesslog",
)

配置SSL文件，并将http80默认转到https443

$SERVER["socket"] == ":443" {
        ssl.engine = "enable"                      # 是否开启SSL
        ssl.pemfile = "/etc/lighttpd/ssl/urdomain.xxx.pem"   # 合并后的私钥和公钥
        ssl.ca-file = "/etc/lighttpd/ssl/root_bundle.crt"    # 证书信任链文件路径
        server.document-root = "/var/www/html/"         # 网站根目录
        ssl.cipher-list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE"        # 配置加密方式
}

$SERVER["socket"] == ":80" {
        $HTTP["host"] =~ ".*" {
                url.redirect = ( ".*" => "https://%0$0" )
        }
}

$HTTP["scheme"] == "https" {
        setenv.add-response-header = ( "Strict-Transport-Security" => "max-age=31536000; includeSubdomains; preload" )
}