Nginx配置客户端SSL双向认证

nginx安装

安装需求环境

• yum -y install gcc gcc-c++

• yum -y install openssl openssl-devel

• yum -y install pcre pcre-devel

• yum -y install zlib zlib-devel
  安装NGINX

• 下载：nginx：wget http://nginx.org/download/nginx-1.17.9.tar.gz

• 解压：tar zxvf nginx-1.10.2.tar.gz

• 配置SSL： ./configure --prefix=/usr/local/nginx --with-http_ssl_module

• make && make install

1.nginx的conf配置

server {
    listen 443; 
	server_name qq.****.com;
	location / {#转发服务到后端
		root /uuht/web/; 
		index index.html;
		proxy_pass http://127.0.0.1:58898;
	   	proxy_set_header Host $host;
	  	proxy_set_header X-Real-IP $remote_addr;
	  	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	}
	 ssl on;  
        ssl_certificate  /uuht/ca/ca.crt;  https证书公钥
        ssl_certificate_key  /uuht/ca/ca.key;  #https私钥 
        ssl_client_certificate /uuht/ca/cacert.pem;  #启用SSL双向认证的公钥
        ssl_verify_client on;  #开启客户端证书验证  
		
	location ~*\.(js|gif|jpg|jpeg|png|bmp|mp3|css)$ {
		root /uuht/web/;
		expires 10d;
	}
	error_page 404 /404.html;
        location = /40x.html {
    }
	error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}

PS：注意注释地方

2.SSL认证公私锁生成

1生成CA签名
openssl genrsa -out cakey.pem 2048
openssl req -new -key cakey.pem -passin pass:XXX -out ca.csr -subj "/C=CN/ST=BJ/L=BJ/O=XXX/OU=XXX/CN=XXX.com/emailAddress=XXX@XXX.com"
openssl x509 -req -days 800 -sha1 -extensions v3_ca -signkey cakey.pem -in ca.csr -out  cacert.pem


2服务器端私钥和证书
openssl genrsa -out sever.pem 2048 
openssl req -new -key sever.pem -passin pass:XXX -out server.csr -subj "/C=CN/ST=BJ/L=BJ/O=XXX/OU=XXX/CN=XXX.com/emailAddress=XXX@XXX.com"

openssl x509 -req -days 800 -sha1 -extensions v3_req -CA cacert.pem -CAkey cakey.pem -CAserial ca.srl -CAcreateserial -in server.csr -out servercert.pem

检查是否正确
openssl verify -CAfile cacert.pem  servercert.pem


（3）客户端私钥和证书
openssl genrsa -out client.pem 2048 

openssl req -new -key client.pem -passin pass:XXX -out client.csr -subj "/C=CN/ST=BJ/L=BJ/O=XXX/OU=XXXX/CN=XXX.com/emailAddress=XXX@XXX.com"

openssl x509 -req -days 800 -sha1 -extensions v3_req -CA  cacert.pem -CAkey cakey.pem  -CAserial ca.srl -in client.csr -out clientcert.pem

检查是否正确
openssl verify -CAfile cacert.pem  clientcert.pem 


pem转P12格式
openssl pkcs12 -export -in clientcert.pem -out clientcert.p12  

PS:

1. ①XXX需要替换地方
2. ②openssl官网 https://www.openssl.net.cn/docs/230.html