SSL账号申请及配置

Ajian2023-08-12 8:18

摘自个人印象笔记https://app.yinxiang.com/fx/db244155-c858-4d8a-93a8-08071d168dc8

ssl申请平台：https://blog.freessl.cn/ ajian51168@qq.com ...

操作说明：https://blog.freessl.cn/acme-quick-start/

nginx配置：

upstream local_tomcat{
  server 127.0.0.1:8080;
}




server
    {
        listen 80;
        #listen [::]:80;
        server_name miyuhua.scmhbk.com;
        index index.html index.htm index.php default.html default.htm default.php;


        location / {
             proxy_pass http://local_tomcat;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }        


    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }


        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }


        location ~ /.well-known {
            allow all;
        }


        location ~ /\.
        {
            deny all;
        }


    }
server{
        listen 443;
        server_name miyuhua.scmhbk.com;
        #ssl on;
        ssl_certificate /root/.acme.sh/scmhbk.com/scmhbk.com.cer;
        ssl_certificate_key /root/.acme.sh/scmhbk.com/scmhbk.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        #ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
    ssl_ciphers "TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5";
        ssl_session_cache builtin:1000 shared:SSL:10m;
        add_header Strict-Transport-Security "max-age=31536000";
    
    location ^~ {
            proxy_pass   http://127.0.0.1:8080/;
            root /home/apache-tomcat-8.5.73/webapps/ROOT;
            proxy_redirect  off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }


}

如果小程序出现request:fail -2:net::ERR_FAILED、Provisional headers are shown 类似请求异常，参考此文解决：https://blog.csdn.net/Cike___/article/details/109544449