nginx反向代理加https证书和自动跳转配置

nginx反向代理加https证书和自动跳转配置

1.机器规划：

nginx代理机器：192.168.14.128

tomcat1机器: 192.168.14.129

tomcat2机器：192.168.14.130

2.实际操作步骤

1)不用nginx代理时候的直接访问后端网站：

2)配置域名解析（即类似DNS解析，通过域名能解析到nginx机器的IP，此处在本地window机器的hosts文件中配置解析，也可由自己的DNS服务器解决）

aaaaa.hotread.com <-------> 192.168.14.128 (相互对应)

3)nginx机器上(192.168.14.128)安装nginx，并配置反向代理,能通过nginx负载均衡访问服务

[root@bogon ~]# useradd nginx

[root@bogon ~]# yum -y install gcc gcc-c++

[root@bogon ~]# yum -y install openssl-devel zlib-devel pcre-devel

[root@bogon ~]# ls

nginx-1.0.5.tar.gz

[root@bogon ~]# tar -zxf nginx-1.0.5.tar.gz

[root@bogon ~]# ls

nginx-1.0.5 nginx-1.0.5.tar.gz

[root@bogon ~]# cd nginx-1.0.5

[root@bogon nginx-1.0.5]# ls

auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src

[root@bogon nginx-1.0.5]# ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx --with-http_ssl_module

[root@bogon nginx-1.0.5]# make && make install

[root@bogon nginx-1.0.5]# ls /usr/local/nginx/

conf html logs sbin

[root@bogon nginx-1.0.5]# vim /usr/local/nginx/conf/nginx.conf

.........

upstream myserver {

server 192.168.14.129:8080;

server 192.168.14.130:8080;

}

server {

listen 80;

server_name aaaaa.hotread.com;

#charset koi8-r;

#access_log logs/host.access.log main;

location / {

root html;

index index.html index.htm;

proxy_pass http://myserver;

}

#error_page 404 /404.html;

# redirect server error pages to the static page /50x.html

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

}

[root@bogon nginx-1.0.5]# /usr/local/nginx/sbin/nginx

[root@bogon nginx-1.0.5]# netstat -anput |grep 80

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3691/nginx

浏览器访问：http://aaaaa.hotread.com/

4)在阿里云上申请域名对应的ca证书和私钥(aaaaa.hotread.com)，然后下载下来

下载后，解压并重命名后my.key和my.pem，如下图：

5)在nginx机器上配置https证书并配置能强制跳转到https的访问

[root@bogon nginx-1.0.5]# vim /usr/local/nginx/conf/nginx.conf

....................

upstream myserver {

server 192.168.14.129:8080;

server 192.168.14.130:8080;

}

#注意：下面已测：只有301时候可以跳转，307或其他不能跳转，或者不用if判断，直接使用跳转那条也可。

server {

listen 80;

server_name aaaaa.hotread.com;

if ($scheme = http){

return 301 https://$host$request_uri;#或return 301 https://$server_name$request_uri;

}

#charset koi8-r;

#access_log logs/host.access.log main;

location / {

root html;

index index.html index.htm;

proxy_pass http://myserver;

}

#error_page 404 /404.html;

# redirect server error pages to the static page /50x.html

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

}

server {

listen 443;

server_name aaaaa.hotread.com;

ssl on;

ssl_certificate /usr/local/nginx/ssl/my.pem;

ssl_certificate_key /usr/local/nginx/ssl/my.key;

# ssl_session_timeout 5m;

# ssl_protocols SSLv2 SSLv3 TLSv1;

# ssl_ciphers HIGH:!aNULL:!MD5;

# ssl_prefer_server_ciphers on;

location / {

root html;

index index.html index.htm;

proxy_pass http://myserver;

}

}

[root@bogon nginx-1.0.5]# mkdir /usr/local/nginx/ssl

[root@bogon nginx-1.0.5]# cd /usr/local/nginx/ssl/

[root@bogon ssl]# rz

上传上面改过名的证书和私钥，如下：

[root@bogon ssl]# ls

my.key my.pem

[root@bogon ssl]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@bogon ssl]# /usr/local/nginx/sbin/nginx -s reload

客户端浏览器访问时候能自动跳转，如下：

访问http://aaaaa.hotread.com 会自动跳转到 https://aaaaa.hotread.com 且没有不安全的提示

回车后，如下：刷新还可以轮询