内网IP认证SSL拿下

概要

结果展示

这样：

还是这样：

最终你会：

整体架构流程

一、创建文件夹

sudo mkdir -p /etc/nginx/ssl
cd /etc/nginx/ssl

二、创建配置文件

新建 /etc/nginx/ssl/ssl.conf
//内容如下：
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext

[dn]
C = CN
ST = Beijing
L = Beijing
O = MyCompany
OU = IT
CN = sdxh.test.cn  //必须填写域名

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = sdxh.test.cn  //访问域名
IP.1 = 10.8.8.111      // 服务器IP

三、生成证书

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /etc/nginx/ssl/nginx-selfsigned.key \
    -out /etc/nginx/ssl/nginx-selfsigned.crt \
    -config /etc/nginx/ssl/ssl.conf \
    -extensions req_ext

四、验证证书

openssl x509 -in /etc/nginx/ssl/nginx-selfsigned.crt -text -noout
//查看输出结果中是否存在以下内容
X509v3 Subject Alternative Name:
    DNS:sdxh.extremefei.cn, IP Address:10.8.8.111

五、更改ginx配置

server {
    listen 443 ssl;
    server_name sdxh.test.cn 10.8.8.111;

    ssl_certificate /etc/nginx/ssl/nginx-selfsigned.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx-selfsigned.key;
    
    # 强制HTTPS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # 其他配置...
}

六、重启 Nginx并访问IP

小结

如果不显示则把证书复制双击添加到受信任的根证书颁发机构即可