研发环境：SSL证书快速部署

# 创建证书目录
mkdir -p /usr/local/nginx/conf/cert

# 生成单域名证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /usr/local/nginx/conf/cert/dev.luckybin.top.key \
    -out /usr/local/nginx/conf/cert/dev.luckybin.top.crt \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=dev.luckybin.top" \
    -addext "subjectAltName=DNS:dev.luckybin.top,IP:192.168.60.201"

Windows（PowerShell）

bash 复制代码

# 创建证书目录 C:\nginx\conf\cert

# 生成单域名证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 `
    -keyout "C:\nginx\conf\cert\dev.luckybin.top.key" `
    -out "C:\nginx\conf\cert\dev.luckybin.top.crt" `
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=dev.luckybin.top" `
    -addext "subjectAltName=DNS:dev.luckybin.top,IP:192.168.60.201"

通配符证书（*.`luckybin.top`）

Linux

bash 复制代码

# 生成通配符证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout /usr/local/nginx/conf/cert/wildcard.luckybin.top.key \
    -out /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=*.luckybin.top" \
    -addext "subjectAltName=DNS:*.luckybin.top,DNS:luckybin.top,DNS:dev.luckybin.top"

Windows（PowerShell）

bash 复制代码

# 生成通配符证书
openssl req -x509 -nodes -days 365 -newkey rsa:2048 `
    -keyout "C:\nginx\conf\cert\wildcard.luckybin.top.key" `
    -out "C:\nginx\conf\cert\wildcard.luckybin.top.crt" `
    -subj "/C=CN/ST=Beijing/L=Beijing/O=DevTeam/CN=*.luckybin.top" `
    -addext "subjectAltName=DNS:*.luckybin.top,DNS:luckybin.top,DNS:dev.luckybin.top"

Nginx配置示例

单域名配置

bash 复制代码

server {
    listen 443 ssl;
    server_name dev.luckybin.top;
    
    # 单域名证书
    ssl_certificate /usr/local/nginx/conf/cert/dev.luckybin.top.crt;
    ssl_certificate_key /usr/local/nginx/conf/cert/dev.luckybin.top.key;
    
    # 可选：HTTP重定向到HTTPS
    location / {
        # 应用配置...
    }
}

通配符证书配置

bash 复制代码

server {
    listen 443 ssl;
    server_name ~^(?<subdomain>.+)\.luckybin\.top$;
    
    # 通配符证书
    ssl_certificate /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt;
    ssl_certificate_key /usr/local/nginx/conf/cert/wildcard.luckybin.top.key;
    
    location / {
        # ...
    }
}

证书有效性测试

bash 复制代码

# 测试HTTPS连接
curl -v https://dev.luckybin.top --cacert /usr/local/nginx/conf/cert/wildcard.luckybin.top.crt

# 检查证书链
openssl s_client -connect dev.luckybin.top:443 -servername dev.luckybin.top </dev/null 2>/dev/null | openssl x509 -text

注意事项

证书用途 ：仅限研发测试环境使用，切勿用于生产环境
有效期：证书默认365天，到期前需重新生成
浏览器警告：首次访问会有安全警告，需手动信任证书
通配符限制 ：*.luckybin.top 不匹配 luckybin.top（需额外添加）