为了加密传输http的数据,我们需要用到https证书。免费的证书有lets‘s encrypt。
1. 配置nginx
server {
listen 80 ;
server_name web.mayou365.com;
return 301 https://$host$request_uri;
location / {
root /var/www/fuli/website/dist;
index index.html;
proxy_pass http://website;
proxy_set_header Host $host;
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404
#add_header Cache-Control "no-cache, no-store";
}
# location / {
# return 301 https://$host$request_uri;
# }
#这里在申请证书的时候会提示要求这么配置
# location ~ /.well-known/acme-challenge {
# root /var/www/fuli/website/dist;
# allow all;
#}
}
说明:第一个location意思是转发所有的80请求到https连接。第二个请求的意思是,如果访问.well-known,则使用我们提供的/var/www/html目录。
将文件保存为default.conf。
这里我使用了nginx docker来部署,所以没有安装nginx。
将第一个代码段存为default.conf,第二个代码段存为dockerfile,然后运行docker build -t nginx-server .
certbot程序会访问你的域名,来确认你的域名所有权是你,这就用到了上一步操作的nginx的配置。其中还有一些参数,查看help可以知道含义。另外,除非你确认要部署到服务器上,否则在测试阶段使用--test-cert参数来进行测试。因为证书生成是有数量限制的。
另外一点就是生成dhparam。他是迪菲-赫尔曼秘钥交换协议参数,生成时间较长。之后我们会在nginx中使用这个。
不出意外你会获得证书,他们存在/etc/letsencrypt/目录下。并且,由于在容器启动的时候使用了挂卷,证书会出现在宿主机中。
2.安装certbot并使用certbot申请证书
sudo apt-get install certbot
certbot certonly --agree-tos -a webroot --webroot-path=/var/www/html -d www.unrealblue.cc -m linanwx@gmail.com
3.配置证书及http跳转
3.1配置证书
server {
listen 443 ssl;
server_name web.mayou365.com;
ssl_certificate /etc/letsencrypt/live/web.mayou365.com/fullchain.pem;
# ssl_trusted_certificate /etc/letsencrypt/live/web.mayou365.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/web.mayou365.com/privkey.pem;
# ssl_dhparam /etc/letsencrypt/live/dhparams.pem;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=60;
location / {
root /var/www/fuli/website/dist;
index index.html index.htm;
}
# location = /gfwlist {
# proxy_pass http://server-handy:8081;
# }
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
location /api/ {
proxy_pass http://127.0.0.1:2000/;
}
location /pic/ {
proxy_pass http://127.0.0.1:2600/;
}
}
3.1配置跳转
server {
listen 80 ;
server_name web.mayou365.com;
return 301 https://$host$request_uri;
location / {
root /var/www/fuli/website/dist;
index index.html;
proxy_pass http://website;
proxy_set_header Host $host;
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404
#add_header Cache-Control "no-cache, no-store";
}
}