Nginx配置https - 技术栈

上传文件到linux

java 复制代码

[root@zonghe01 nginx24]# pwd
/data/nginx24
[root@zonghe01 nginx24]# mkdir ssl
[root@zonghe01 ssl]# ll
total 8
-rw-r--r-- 1 root root 1675 Nov 15 22:19 xxx1.key
-rw-r--r-- 1 root root 3834 Nov 15 22:19 xxx2.pem

修改配置监听

java 复制代码

server {
        listen 8888 ssl;
        server_name xxx.gov.cn;
        underscores_in_headers on;
        ssl_certificate     /data/nginx24/ssl/xxx1.pem;
        ssl_certificate_key /data/nginx24/ssl/xxx2.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSV1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_prefer_server_ciphers on;

        #location / {
         #   root   html;
          #  index  index.html index.htm;
        #}
         location  /audit/ {
          alias /data/web/audit/lvfa_web/;
          index index.html /data/web/audit/lvfa_web/index.html;
        }
        location /minio/ {
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                #proxy_set_header Host lft.xxx.com;
                proxy_set_header   Host $http_host;
                proxy_pass http://127.0.0.1:9000/;
        }

         location /api2/ {
                        proxy_pass http://http_res;
                        proxy_http_version 1.1;
                        proxy_set_header   Host $http_host;
                        proxy_set_header Upgrade $http_upgrade;
                        proxy_set_header Connection "upgrade";
        }
         location /api/ {
                        proxy_pass http://http_res;
                        proxy_http_version 1.1;
                        proxy_set_header   Host $http_host;
                        proxy_set_header Upgrade $http_upgrade;
                        proxy_set_header Connection "upgrade";
        }

nginx的ngx_stream_core_module模块，但是该模块在安装时不是默认构建的，需要在编译安装执行 ./configure时加上参数--with-http_ssl_module

java 复制代码

使用命令./nginx -V查看，如果在configure arguments后面没有出现--with-http_ssl_module则说明没有安装此模块
[root@test sbin]# cd /usr/local/nginx/sbin/
[root@test sbin]# ./nginx -Vnginx version: nginx/1.24.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
configure arguments: --prefix=/usr/local/nginx
[root@test sbin]#

平滑安装https模块(如果之前没配置https模块)

java 复制代码

# 找到nginx源码目录，如此处nginx源码目录为：/home/nginx/nginx-1.24.0，即为编译命令执行目录
cd /data/nginx-1.24.0
# 执行编译命令
./configure --prefix=/data/nginx24 --with-http_ssl_module
# 执行make，此处一定不能使用make install命令，执行该命令会将原有nginx目录进行覆盖
make
# 关掉nginx
cd /data/nginx24/sbin/
./nginx -s stop# 
备份原有nginx二进制文件。
cp /data/nginx24/sbin/nginx /data/nginx24/sbin/nginx-no-https
# 复制新编译好的nginx二进制文件。从此处nginx源码目录为：/data/nginx-1.24.0。即为编译命令执行目录。
cp /data/nginx-1.24.0/objs/nginx /data/nginx24/sbin/nginx24
# 重新启动服务
cd /data/nginx24/sbin/
./nginx
# 可以通过./nginx -V命令查看以下模块是否安装成功