一.在阿里云申请免费根证书
2.绑定域名添加解析
生成后，会有两个文件，key...pem 上传到服务器
3.在nginx配置文件添加
upstream ydyswap {
server 192.168.1.8:7080 ;
server 192.168.1.9:7080 ;
server 192.168.1.9:6080 ;
sticky; check interval=3000 rise=2 fall=5 timeout=1000;
} ##反向代理
server {
listen 80;
server_name m.***.com;
charset UTF8;
#新版本重定向语句 return 301 https://$server_name$request_uri;
}
##旧版本重定向语句
rewrite ^/(.*)$ http://domain.com/$1 permanent;
server {
listen 443 ssl;
server_name m.**.com;
ssl on;
charset UTF8;
ssl_certificate /aebiz/soft/cert/214664096860650.pem;
ssl_certificate_key /aebiz/soft/cert/214664096860650.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers AESGCM:ALL:!DH:!EXPORT:!RC4:+HIGH:!MEDIUM:!LOW:!aNULL:!eNULL;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://ydyswap;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
index index.html index.jsp login.jsp index.htm;
#proxy_redirect off;
}
}
##重启nginx
## /sbin/nginx -t #检查配置语法是否正确
如果报错
则nginx编译可能是没有添加ssl模块
1.查看是否有模块
[root@zabbix ~]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.10.2
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: –prefix=/usr/local/nginx
2..进入之前下载并解压了的源码包目录；重新编译nginx
[root@zabbix nginx-1.10.2]# cd /usr/local/src/nginx-1.10.0
[root@zabbix nginx-1.10.2]# ./configure –prefix=/usr/local/nginx –with-http_stub_status_module –with-http_ssl_module
.[root@zabbix nginx-1.10.2]# make
这一步千万不能 make install ；不然会把之前已经安装的nginx 覆盖掉
3.之后会看在当前目录生成objs文件，执行
./objs/nginx -V
nginx version: nginx/1.10.2
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 1.0.0d 8 Feb 2011
TLS SNI support enabled
发现 TLS SNI support enabled 这我们可以放心用了，这可以实现一个ip多个站点。
但是nginx -v 这时候还是老版本的nginx，下面我们需要做的比较关键
我们需要先备份
mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old
然后转移
cp ./objs/nginx /usr/local/nginx/sbin/nginx
测试下
/usr/local/nginx/sbin/nginx -t
ok，执行更新
make upgrade
然后的最后
nginx -V
nginx version: nginx/1.10.2
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 1.0.0d 8 Feb 2011…
到此就成功了升级了 nginx 并且添加了 TLS SNI support 。
4.再次查看nginx的模块，看下是否把需要的模块编译进去了
[root@zabbix ~]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.10.2
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: –prefix=/usr/local/nginx –with-http_stub_status_module –with-http_ssl_module
5.重新启动nginx；
/sbin/nginx -s reload
6.访问你的域名查看是否跳转到https