Nginx反向代理https

Nginx反向代理https

• 系统环境

系统版本：CentOS7.3 64bit

软件版本：

              nginx-1.12.2.tar.gz    官网地址：http://nginx.org/

              pcre-8.42.tar.gz      官网地址：http://sourceforge.net/projects/pcre/files/pcre//

下载地址

    wget http://nginx.org/download/nginx-1.12.2.tar.gz

    wget https://excellmedia.dl.sourceforge.net/project/pcre/pcre/8.42/pcre-8.42.zip

 

• 安装nginx

1、系统环境安装

# yum install -y zlib zlib-devel gcc gcc-c++ make

# yum -y install openssl openssl-devel

 

2、解压pcre

           # cd /tmp

        # tar zxvf pcre-8.42.tar.gz

 

       3、安装nginx

      

              # tar zxvf nginx-1.12.2.tar.gz

              # cd nginx-1.12.2

#./configure --prefix=/opt/nginx --with-http_ssl_module --with-pcre=/tmp/pcre-8.42     

# make && make install

 

       4、配置nginx.conf

######################################################################

   upstream aabc.cc.com{

        server xx.xx.xx.xxx:xxx;

    }

 

 

server {

                listen 443;

                server_name     aabc.cc.com;

                access_log  /log/nginx/access_aabc.cc.com.log;

                error_log  /log/nginx/error_aabc.cc.com.log;

                ssl on;

                ssl_certificate aabc.cc.com_bundle.crt;

                ssl_certificate_key     aabc.cc.com.key;

                ssl_session_timeout 5m;

                ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

                ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;

                ssl_prefer_server_ciphers on;

 

                location / {

                proxy_read_timeout 300;

                proxy_connect_timeout 300;

                proxy_redirect off;

                proxy_http_version 1.1;

                proxy_set_header Host $http_host;

                proxy_set_header X-Real-IP $remote_addr;

                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_pass      https://aabc.cc.com;

            }

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

}其中红色部份的证书是由证书颁发机构颁发的，

 

其他:

如果需要将多个证书合成一个mycert.cer证书是把四个证书的内容集合成一个（ca.cer、inter.cer、mycert.cer、xs.cer）

# cat ca.cer inter.cer xs.cer >> mycert.cer

导入的证书格式必须是如下的格式

/EM=

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----  导入的时候是一行，必须进行重新编辑，分成二行

MIIHyTCCBbGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJJTDEW

 

 

附:完整的nginx配置文件

 

#user  nobody;

worker_processes  2;

 

#error_log  logs/error.log;

#error_log  logs/error.log  notice;

#error_log  logs/error.log  info;

 

#pid        logs/nginx.pid;

worker_rlimit_nofile 65535;

 

 

events {

    use epoll;

    worker_connections  65535;

}

 

 

http {

    include       mime.types;

    default_type  application/octet-stream;

 

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

    #                  '$status $body_bytes_sent "$http_referer" '

    #                  '"$http_user_agent" "$http_x_forwarded_for"';

 

    #access_log  logs/access.log  main;

 

    sendfile        on;

    #tcp_nopush     on;

 

    #keepalive_timeout  0;

    keepalive_timeout  65;

 

    #gzip  on;

    upstream aabc.cc.com{

        server xx.xx.xx.xx:xx;

    }

 

 

server {

            listen 443;

            server_name     aabc.cc.com;

            access_log  /log/nginx/access_aabc.cc.com.log;

            error_log  /log/nginx/error_aabc.cc.com.log;

            ssl on;

            ssl_certificate aabc.cc.com_bundle.crt;

            ssl_certificate_key     aabc.cc.com.key;

            ssl_session_timeout 5m;

            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

            ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;

            ssl_prefer_server_ciphers on;

 

            location / {

        proxy_read_timeout 300;

                proxy_connect_timeout 300;

                proxy_redirect off;

                proxy_http_version 1.1;

                proxy_set_header Host $http_host;

                proxy_set_header X-Real-IP $remote_addr;

                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                proxy_set_header X-Forwarded-Proto http;

            proxy_pass      https://aabc.cc.com;

            }

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

}

 

 

 

}