简介

在这篇文章中，我介绍了使用nginx作为web服务器，然后给网站配置ssl证书，并且将非https的访问，重定向到了https上

参考

https://www.bilibili.com/video/BV1f14y1E7cs?p=9&vd_source=75dbec7ad4709dbb9145a059a5374980

https://www.bilibili.com/video/BV1yS4y1N76R?p=11&spm_id_from=pageDriver&vd_source=75dbec7ad4709dbb9145a059a5374980

感谢

Photo by Man Dy: https://www.pexels.com/photo/brown-squirrel-above-snow-at-daytime-in-selective-focus-photo-1082179/

申请证书

我是在tx云上申请的，很简单，不在此赘述

最终的结果就是我获得了一些证书文件

1
2
3
4
liode@liodedeMacBook-Pro madebypalyer.fun % ls
Apache            Tomcat            xxx.pem
IIS            xxx.csr
Nginx            xxx.keys

里面的pem和key就是nginx需要用到的

配置nginx

修改配置文件

用nginx给网站配置ssl证书，其实就是写nginx的配置文件，修改里面的一些参数，这个文件在我的机器上的位置是/usr/local/nginx/conf/nginx.conf

该文件应当配置成如下的形式

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# HTTPS server
  #
  server {
    listen    443 ssl;
    server_name xxx.com;
 
    ssl_certificate   /root/sslkey/xxx.pem;
    ssl_certificate_key /root/sslkey/xxx.key;
 
    ssl_session_cache  shared:SSL:1m;
    ssl_session_timeout 5m;
 
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
 
    location / {
      root  html;
      index index.html index.htm;
    }
  }

解释下

server_name 是网站的域名

ssl_certificate 应当填写pem文件的路径

ssl_certificate_key 应当填写key文件的路径

localtion 这个section中是网站默认显示的网页，对应nginx安装目录的html文件夹

让配置生效

进入nginx安装路径的sbin目录，执行

1
./nginx -s reload

报错

1
2
[root@vital-text-1.localdomain:29:sbin]# ./nginx -s reload
nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:99

这是因为nginx没有安装ssl相关的模块，需要安装

安装ssl模块

来到源码目录，重新配置编译

1
[root@vital-text-1.localdomain:39:nginx-1.22.1]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module

有报错，提示没有OpenSSL library

1
yum install openssl openssl-devel

再次执行config就正确了

编译make，make之后会在源码目录中多了一个objs目录，其中的nginx可执行文件就是新生成的，查看下是否含有ssl模块

1
./nginx -V

输出如下，最后的configure arguments中有ssl模块，说明正确

1
2
3
4
5
6
[root@vital-text-1.localdomain:50:objs]# ./nginx -V
nginx version: nginx/1.22.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module

接下来要将此文件替换正在使用的文件，首先先备份一下，我将原来的命名成了nginx.bak了

1
2
3
4
[root@vital-text-1.localdomain:62:sbin]# pwd
/usr/local/nginx/sbin
[root@vital-text-1.localdomain:63:sbin]# ls
nginx* nginx.bak*

检查一下配置文件是否正确

1
2
3
[root@vital-text-1.localdomain:74:sbin]# ./nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

没有问题

测试

在浏览器中使用https加域名的方式访问，会有一个锁的图样，证明ssl配置成功

test

最后，可以将非ssl的域名访问重定向到https这样都是安全的了，哈哈哈，需要在配置文件中增加一个block，内容如下

1
2
3
4
5
server{
       listen 80;
       server_name xxx;
       rewrite .* https://$server_name redirect;
   }

最后完整的配置文件如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
[root@vital-text-1.localdomain:92:sbin]# cat ../conf/nginx.conf
 
#user nobody;
worker_processes 1;
 
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
 
#pid    logs/nginx.pid;
 
 
events {
  worker_connections 1024;
}
 
 
http {
  include    mime.types;
  default_type application/octet-stream;
 
  #log_format main '$remote_addr - $remote_user [$time_local] "$request" '
  #         '$status $body_bytes_sent "$http_referer" '
  #         '"$http_user_agent" "$http_x_forwarded_for"';
 
  #access_log logs/access.log main;
 
  sendfile    on;
  #tcp_nopush   on;
 
  #keepalive_timeout 0;
  keepalive_timeout 65;
 
  #gzip on;
 
  server {
    listen    80;
    server_name localhost;
 
    #charset koi8-r;
 
    #access_log logs/host.access.log main;
 
    location / {
      root  html;
      index index.html index.htm;
    }
 
    #error_page 404       /404.html;
 
    # redirect server error pages to the static page /50x.html
    #
    error_page  500 502 503 504 /50x.html;
    location = /50x.html {
      root  html;
    }
 
    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #  proxy_pass  http://127.0.0.1;
    #}
 
    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #  root      html;
    #  fastcgi_pass  127.0.0.1:9000;
    #  fastcgi_index index.php;
    #  fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
    #  include    fastcgi_params;
    #}
 
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #  deny all;
    #}
  }
 
 
  # another virtual host using mix of IP-, name-, and port-based configuration
  #
  #server {
  #  listen    8000;
  #  listen    somename:8080;
  #  server_name somename alias another.alias;
 
  #  location / {
  #    root  html;
  #    index index.html index.htm;
  #  }
  #}
 
 
  # HTTPS server
  #
  server {
    listen    443 ssl;
    server_name xxx;
 
    ssl_certificate   /root/sslkey/xxx.pem;
    ssl_certificate_key /root/sslkey/xxx.key;
 
    ssl_session_cache  shared:SSL:1m;
    ssl_session_timeout 5m;
 
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
 
    location / {
      root  html;
      index index.html index.htm;
    }
  }
  server{
    listen 80;
    server_name xxx;
    rewrite .* https://$server_name redirect;
  }
}