生成过程
检查是否安装OpenSSL
openssl version
创建生成证书目录
mkdir sky
生成私钥文件
openssl genrsa -out private.key 2048
生成一个2048位的RSA私钥
生成证书请求文件(CSR)
openssl req -new -key private.key -out server.csr
输入此命令后,会有此提示,随意填写就好
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:jn
Locality Name (eg, city) [Default City]:jn
Organization Name (eg, company) [Default Company Ltd]:jn
Organizational Unit Name (eg, section) []:bj
Common Name (eg, your name or your server's hostname) []:bj
Email Address []:xxx@xxx.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:bj
生成自签名证书
openssl x509 -req -days 365 -in server.csr -signkey private.key -out server.crt
配置Nginx
server {
listen 8103;#http是8103接口
listen 8443 ssl; #https是8443接口。
server_name 133.70.34.138;
ssl_certificate ./server.crt;#crt文件的绝对路径
ssl_certificate_key ./private.key;#key文件的绝对路径
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
}
重启ng
./nginx -s reload