Nginx SSL模块配置提供HTTPS支持（Ngx_http_ssl_module）
Ngx_http_ssl_module：此模块为Nginx提供HTTPS支持；
官方文档：http://nginx.org/en/docs/http/ngx_http_ssl_module.html
- 相关指令：
ssl_buffer_size：设置用于发送数据的缓冲区大小；
ssl_certificate：当前虚拟主机所使用的证书文件；
ssl_certificate_key：当前虚拟主机与其证书文件匹配的私钥文件，用来解密；
ssl_ciphers：指定支持加密算法；
ssl_client_certificate：指定一个受信任的CA证书用于验证客户端证书；
ssl_crl：证书吊销列表；
ssl_password_file：password文件
ssl_prefer_server_ciphers：服务端倾向使用的加密算法；
ssl_protocols：使用什么样的加密协议，支持ssl协议版本；
ssl_session_cache：ssl会话缓存；
ssl_session_timeout：ssl参数的有效时长，会话超时时间；
- 官方示例：
http {
...
server {
listen 443 ssl; #监听443端口，通过ssl建立会话，
keepalive_timeout 70;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #ssl协议的版本
ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; #支持的加密算法；
ssl_certificate /usr/local/nginx/conf/cert.pem; #指定证书文件；
ssl_certificate_key /usr/local/nginx/conf/cert.key; #证书配对的私钥文件；
ssl_session_cache shared:SSL:10m; #会话缓存时长；
ssl_session_timeout 10m; #超时时长；
...
}
| Syntax: | ssl_session_cache off | none | [builtin[:size]] [shared:name:size]; |
| Default: | ssl_session_cache none; |
| Context: | http, server |
off：功能禁用；
none：Nginx告知客户端会话可能重用，但是不缓存会话；
builtion：使用OpenSSL内建的缓存机制，每个worker进程都使用自己专用的缓存空间
->注意：当存在两个进程A/B，每个进程都是用专用的缓存空间，同一个客户端第一请求由A进程处理，第二次请求由B处理，缓存会话即失效；
shared：使用共享的缓存，可以被所有的woeker进程所共享，类似NFS共享存储，A/B进程都可以使用；
[shared：name：size]：指定共享缓存时，指定缓存空间名称name，缓存空间大小size；
->以上两种机制builtion，shared可以共同使用；
- 演示环境：
Server：192.168.47.140
[root@GaoServer ~]# cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)
[root@GaoServer ~]# uname -r
3.10.0-327.el7.x86_64
[root@GaoServer ~]# nginx -V
nginx version: nginx/1.10.2
......- 相关配置：
#配置环境在虚拟机，自建CAserver；
[root@GaoServer ~]# cd /etc/pki/CA/
[root@GaoServer CA]# ll
drwxr-xr-x. 2 root root 6 6月 29 2015 certs
drwxr-xr-x. 2 root root 6 6月 29 2015 crl
drwxr-xr-x. 2 root root 6 12月 4 04:53 newcerts
drwx------. 2 root root 22 12月 4 04:54 private
#生成私钥；
[root@GaoServer CA]# openssl genrsa -out private/cakey.pem 2048
[root@GaoServer CA]# chmod 400 private/cakey.pem
[root@GaoServer CA]# ll private/cakey.pem
-r-------- 1 root root 1675 12月 4 05:02 private/cakey.pem
#生成自签名证书；
[root@GaoServer CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: #国家
State or Province Name (full name) []: #地区
Locality Name (eg, city) [Default City]: #城市
Organization Name (eg, company) [Default Company Ltd]: #组织名称
Organizational Unit Name (eg, section) []: #部门名称
Common Name (eg, your name or your server's hostname) []: #CA颁发者名称
Email Address []:
#生成证书索引数据库文件；
[root@GaoServer CA]# touch index.txt
#生成证书序列号文件；
[root@GaoServer CA]# echo 01 > serial
#为Nginx生成证书;
[root@GaoServer CA]# cd /etc/nginx/
[root@GaoServer nginx]# mkdir certs
[root@GaoServer nginx]# cd certs/
#生成私钥文件;
[root@GaoServer certs]# (umask 077; openssl genrsa -out nginx.key 2048)
[root@GaoServer certs]# ll
-rw------- 1 root root 1675 12月 4 05:06 nginx.key
#生成证书签署请求；
[root@GaoServer certs]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:192.168.47.140 #需要跟服务器名称相同
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#签署证书；
[root@GaoServer certs]# openssl ca -in nginx.csr -out /etc/nginx/certs/nginx.crt
......
[root@GaoServer certs]# vim ../conf.d/server.conf
......
server {
listen 443 ssl;
server_name 192.168.47.140;
root /data/nginx/server1/;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
ssl_certificate /etc/nginx/certs/nginx.crt;
ssl_certificate_key /etc/nginx/certs/nginx.key;
ssl_session_cache shared:sslcache:10m;
ssl_session_timeout 10m;
}
......
[root@GaoServer certs]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@GaoServer certs]# nginx -s reload#监听443端口，浏览器访问https；
[root@GaoServer certs]# ss -ntulp | grep nginx
tcp LISTEN 0 128 *:8080 *:* users:(("nginx",pid=2400,fd=9),("nginx",pid=2399,fd=9),("nginx",pid=2362,fd=9))
tcp LISTEN 0 128 *:80 *:* users:(("nginx",pid=2400,fd=8),("nginx",pid=2399,fd=8),("nginx",pid=2362,fd=8))
tcp LISTEN 0 128 *:443 *:* users:(("nginx",pid=2400,fd=10),("nginx",pid=2399,fd=10),("nginx",pid=2362,fd=10)