Nginx 配置https以及wss

顽石九变2023-08-20 11:57

一、申请https证书

可以在阿里云申请免费ssl证书，一年更换一次

二、Nginx配置ssl

shell 复制代码

upstream tomcat_web{
     server 127.0.0.1:8080;
}

server {
    listen  443 ssl;
    server_name  www.xxx.com;
	## 配置日志文件
    access_log  /var/log/nginx/web/xxx-ssl-access.log  main;
    error_log  /var/log/nginx/web/xxx-ssl-err.log;
    ## 配置证书所在目录
    ssl_certificate   sslkey/www.xxx.com.pem;
    ssl_certificate_key sslkey/www.xxx.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_prefer_server_ciphers on;
    ssl_session_timeout 1d;
    ssl_stapling on;
    ssl_stapling_verify on;
    ## 重要，否则应用redirect的时候，会跳转到http，这里强制替换成https
    proxy_redirect http:// $scheme://;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;

        proxy_set_header    Host $host;
        proxy_set_header    X-Real-IP  $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto  $scheme;
        proxy_pass      http://tomcat_web;
        proxy_http_version 1.1;
        ## 以下两个配置如果没配置，websocket会报错，链接时使用wss://
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

		## 配置上传文件大小 300Mb
        client_max_body_size 300m;
        client_body_buffer_size 128k;
        ## 配置链接超时时间 10分钟
        proxy_connect_timeout 600;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        proxy_buffer_size 64k;
        proxy_buffers   4 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
    }

}

注意：

1、配置完成后nginx需要重启，reload证书是不会生效的

2、如需要支持wss协议，需要增加配置：
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

3、配置https之后，最后就禁用掉http，通过如下配置，强制跳转https
proxy_redirect http:// $scheme://;