nginx安装
安装需求环境
-
yum -y install gcc gcc-c++
-
yum -y install openssl openssl-devel
-
yum -y install pcre pcre-devel
-
yum -y install zlib zlib-devel
安装NGINX -
下载:nginx:wget http://nginx.org/download/nginx-1.17.9.tar.gz
-
解压:tar zxvf nginx-1.10.2.tar.gz
-
配置SSL: ./configure --prefix=/usr/local/nginx --with-http_ssl_module
-
make && make install
1.nginx的conf配置
server {
listen 443;
server_name qq.****.com;
location / {#转发服务到后端
root /uuht/web/;
index index.html;
proxy_pass http://127.0.0.1:58898;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
ssl on;
ssl_certificate /uuht/ca/ca.crt; https证书公钥
ssl_certificate_key /uuht/ca/ca.key; #https私钥
ssl_client_certificate /uuht/ca/cacert.pem; #启用SSL双向认证的公钥
ssl_verify_client on; #开启客户端证书验证
location ~*\.(js|gif|jpg|jpeg|png|bmp|mp3|css)$ {
root /uuht/web/;
expires 10d;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
PS:注意注释地方
2.SSL认证公私锁生成
1生成CA签名
openssl genrsa -out cakey.pem 2048
openssl req -new -key cakey.pem -passin pass:XXX -out ca.csr -subj "/C=CN/ST=BJ/L=BJ/O=XXX/OU=XXX/CN=XXX.com/emailAddress=XXX@XXX.com"
openssl x509 -req -days 800 -sha1 -extensions v3_ca -signkey cakey.pem -in ca.csr -out cacert.pem
2服务器端私钥和证书
openssl genrsa -out sever.pem 2048
openssl req -new -key sever.pem -passin pass:XXX -out server.csr -subj "/C=CN/ST=BJ/L=BJ/O=XXX/OU=XXX/CN=XXX.com/emailAddress=XXX@XXX.com"
openssl x509 -req -days 800 -sha1 -extensions v3_req -CA cacert.pem -CAkey cakey.pem -CAserial ca.srl -CAcreateserial -in server.csr -out servercert.pem
检查是否正确
openssl verify -CAfile cacert.pem servercert.pem
(3)客户端私钥和证书
openssl genrsa -out client.pem 2048
openssl req -new -key client.pem -passin pass:XXX -out client.csr -subj "/C=CN/ST=BJ/L=BJ/O=XXX/OU=XXXX/CN=XXX.com/emailAddress=XXX@XXX.com"
openssl x509 -req -days 800 -sha1 -extensions v3_req -CA cacert.pem -CAkey cakey.pem -CAserial ca.srl -in client.csr -out clientcert.pem
检查是否正确
openssl verify -CAfile cacert.pem clientcert.pem
pem转P12格式
openssl pkcs12 -export -in clientcert.pem -out clientcert.p12
PS:
- ①XXX需要替换地方
- ②openssl官网 https://www.openssl.net.cn/docs/230.html