mkdir -p /etc/nginx/conf.d/cert
#2、创建私钥
openssl genrsa -des3 -out https.key 1024
提示输入字符：
输入字符：rancher
root@ocean-app-1a-01 cert# openssl genrsa -des3 -out https.key 1024
Generating RSA private key, 1024 bit long modulus
...++++++
...++++++
e is 65537 (0x10001)
Enter pass phrase for https.key:
139880595519376:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:831:You must type in 4 to 1023 characters
Enter pass phrase for https.key:
Verifying - Enter pass phrase for https.key:
#3、创建签名请求证书
openssl req -new -key https.key -out https.csr
root@ocean-app-1a-01 cert# openssl req -new -key https.key -out https.csr
Enter pass phrase for https.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) XX:rancher
string is too long, it needs to be less than 2 bytes long
Country Name (2 letter code) XX:CN
State or Province Name (full name) \[\]:BJ
Locality Name (eg, city) Default City:beijing
Organization Name (eg, company) Default Company Ltd:
Organizational Unit Name (eg, section) \[\]:
Common Name (eg, your name or your server's hostname) \[\]:
Email Address \[\]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password \[\]:rancher
An optional company name \[\]:
#4、在加载SSL支持的Nginx并使用上述私钥时除去必须的口令
$ cp https.key https.key.org
$ openssl rsa -in https.key.org -out https.key
输入 rancher
root@ocean-app-1a-01 cert# openssl rsa -in https.key.org -out https.key
输入 rancher
Enter pass phrase for https.key.org:
writing RSA key
#5、最后标记证书使用上述私钥和CSR和有效期
openssl x509 -req -days 365 -in https.csr -signkey https.key -out https.crt
root@ocean-app-1a-01 cert# openssl x509 -req -days 365 -in https.csr -signkey https.key -out https.crt
Signature ok
subject=/C=CN/ST=BJ/L=beijing/O=Default Company Ltd
Getting Private key
#6、nginx添加配置如下：
示例
server {
listen 443 ssl; #监听443端口
server_name linking-rancher.di.bigdata;
ssl_certificate /etc/nginx/conf.d/cert/https.crt;
ssl_certificate_key /etc/nginx/conf.d/cert/https.key;
ssl_session_timeout 5m;
#charset koi8-r;
#access_log /var/log/nginx/host.access.log main;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Accept-Encoding 'gzip';
##配置使wss协议生效
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
client_max_body_size 2G;
proxy_pass https://rancher;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}}
实际配置
server {
listen 443 ssl;
server_name linking-rancher.di.bigdata;
ssl_certificate /etc/nginx/conf.d/cert/https.crt;
ssl_certificate_key /etc/nginx/conf.d/cert/https.key;
ssl_session_timeout 5m;
location / {
proxy_pass https://rancher;
proxy_redirect off;
##配置使wss协议生效
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
#下面的参数取决环境需要
#后端的Web服务器可以通过X-Forwarded-For获取用户真实IP
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size 2G; #允许客户端请求的最大单文件字节数
client_body_buffer_size 512k; #缓冲区代理缓冲用户端请求的最大字节数
proxy_connect_timeout 300; #nginx跟后端服务器连接超时时间(代理连接超时)
proxy_send_timeout 300; #后端服务器数据回传时间(代理发送超时)
proxy_read_timeout 300; #连接成功后，后端服务器响应时间(代理接收超时)
proxy_buffer_size 4k; #设置代理服务器（nginx）保存用户头信息的缓冲区大小
proxy_buffers 4 32k; #proxy_buffers缓冲区，网页平均在32k以下的话，这样设置
proxy_busy_buffers_size 64k; #高负荷下缓冲大小（proxy_buffers*2）
proxy_temp_file_write_size 64k; #设定缓存文件夹大小
fastcgi_buffer_size 128k;
fastcgi_buffers 8 128k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 128k;
}
location = /50x.html {
root /usr/share/nginx/html;
}}
8443 是自动部署rancher 暴露的端口 https协议
upstream rancher{
server 10.0.0.24:8443;
server 10.0.0.24:8080;
}