linux nginx配置https

安装SSL库
$ cd /usr/local/
$ wget http://www.openssl.org/source/openssl-1.0.1j.tar.gz
$ tar -zxvf openssl-1.0.1j.tar.gz
$ cd openssl-1.0.1j
$ ./config
$ make && make install
openssl version 出现 openssl: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory
执行 建立软连接
ln -s /usr/local/lib64/libssl.so.1.1 /usr/lib64/libssl.so.1.1
ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1

安装zlib库存
$ cd /usr/local/
$ wget http://zlib.net/zlib-1.2.11.tar.gz
$ tar -zxvf zlib-1.2.11.tar.gz
$ ./configure
$ make && make install

安装nginx
安装目录
$ cd /usr/local/
$ tar -zxvf nginx-1.8.0.tar.gz
$ wget http://nginx.org/download/nginx-1.8.0.tar.gz
$ cd nginx-1.8.0
#执行安装并指定安装位置
$./configure --prefix=/usr/local/nginx --with-http_ssl_module
注：出现Leaving directory `/home/**/nginx-1.8.0 是因为ssl指定路径错误问题,openssl解压设置到nginx即可 执行 $./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-openssl=/usr/src/openssl-0.9.8g
$ make && make install
时提示以下错误：./configure: error: SSL modules require the OpenSSL library.
支持此命令：
$yum -y install openssl openssl-devel

创建秘钥文件

mkdir /usr/local/nginx/conf/ssl #创建证书存放目录

cd /usr/local/nginx/conf/ssl #进入目录

创建服务器私钥：
openssl genrsa -des3 -out server.key 1024 #根据提示输入证书口令

创建签名请求的证书（CSR）：
openssl req -new -key server.key -out server.csr #输入上面设置的口令

#根据提示输入相应的信息

Country Name (2 letter code) [XX]:cn #国家

State or Province Name (full name) []:zhejiang #省份

Locality Name (eg, city) [Default City]:hangzhou #城市

Organization Name (eg, company) [Default Company Ltd]:osyunwei #公司

Organizational Unit Name (eg, section) []:sys #部门

Common Name (eg, your name or your server’s hostname) []:osyunwei #主机名称

Email Address []:[email protected] #邮箱

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []:123456 #证书请求密钥，CA读取证书的时候需要输入密码

An optional company name []:osyunwei #公司名称，CA读取证书的时候需要输入密码

openssl rsa -in server.key -out server_nopassword.key #对key进行解密

openssl x509 -req -days 365 -in server.csr -signkey server_nopassword.key -out server.crt

#标记证书使用上述私钥和CSR
配置nginx配置文件

# HTTPS server
    server {
		listen       443 ssl;
		server_name  localhost;
		client_max_body_size 1000M;

       ssl_certificate /usr/local/nginx/conf/ssl/server.crt;
       ssl_certificate_key /usr/local/nginx/conf/ssl/server_nopassword.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
			add_header Content-Security-Policy upgrade-insecure-requests;
            proxy_pass http://127.0.0.1:8080; #映射到本地的Tomcat8080端口
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_redirect http:// https://;
        }
    }

nginx常用命令

#启动
cd /usr/local/nginx/sbin/
./nginx
#指定配置文件启动
./nginx -c ../../nginx.conf

#停止
ps -ef|grep nginx
kill -9 主进程号

#重启
cd /usr/local/nginx/sbin/
./nginx -s reload

./nginx -h #帮助
./nginx -v #显示版本
./nginx -V #显示版本和配置信息
./nginx -t #测试配置
./nginx -q #测试配置时，只输出错误信息
./nginx -s stop #停止服务器