nginx安装GODADDY证书

2019独角兽企业重金招聘Python工程师标准>>>

[root@longquan opt]# openssl genrsa -out domain.com.key 2048   //创建私钥

Generating RSA private key, 2048 bit long modulus

[root@longquan opt]# openssl req -new -key domain.com.key -out domain.com.csr   //创建CSR (Certificate signing request)，需要指定刚才生成的私钥

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:SH

Locality Name (eg, city) [Default City]:SH

Organization Name (eg, company) [Default Company Ltd]:厦门某某某有限公司

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:domain.com

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@longquan opt]# ls

domain.com.csr  domain.com.key  RAP  rap_release_v0.11.3_20150727.war  rh  ROOT

[root@longquan opt]# cat domain.com.csr   //把这一串粘帖到GODADDY那边

-----BEGIN CERTIFICATE REQUEST-----

...

...

...

...

...

-----END CERTIFICATE REQUEST-----

验证域名所有权限，2个方法

1、验证DNS

2、放到根目录上（用这个方法需要在上传后自己浏览器访问一下）

大概10分钟内就可以下载证书

[root@longquan opt]# mkdir -p /usr/local/nginx/conf/ssl/

[root@longquan opt]# cp domain.com.key /usr/local/nginx/conf/ssl/

[root@longquan opt]# cd /usr/local/nginx/conf/ssl/longquan/

[root@longquan opt]# rz    //上传从GODADDY下载下来的2个crt文件

rz waiting to receive.

 zmodem trl+C 100%       1 KB    1 KB/s 00:00:01       0 Errors.

  100%       4 KB    4 KB/s 00:00:01       0 Errors

[root@longquan opt]# ll

总用量 16

-rw-r--r-- 1 root root 1838 10月 28 03:00 4f66c3613*.crt

-rw-r--r-- 1 root root 4795 10月 28 03:00 gd_bundle-g2-g1.crt

-rw-r--r-- 1 root root 1675 10月 28 19:25 domain.com.key

Fix Intermediate Certificate Chain   

[root@longquan opt]# cat gd_bundle-g2-g1.crt >> 4f66c3613*.crt 

[root@longquan opt]# cp 4f66c3613*.crt domain.com.crt   //取个我们容易识别的CRT名称

在虚拟主机配置文件上的server段里面添加

        ssl                  on;

        ssl_certificate      ssl/domain.com.crt;

        ssl_certificate_key   ssl/domain.com.key;

        ssl_session_timeout  5m;

        ssl_protocols  SSLv3 TLSv1;

        ssl_ciphers HIGH:!aNULL:!MD5:!EXPORT56:!EXP;

        ssl_prefer_server_ciphers   on;

[root@longquan opt]# nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

[root@longquan opt]# nginx -s reload

注意：先在测试机上测试再上到正式线上

转载于:https://my.oschina.net/longquan/blog/657180