部署自建CA颁发证书实现https加密

理论忽略：百度上很多

需求：自建证书并实现域名的https加密

部署：

在linux机器上执行以下命令生成私钥

mkdir -p /opt/ssl-cert

cd  /opt/ssl-cert

1.#openssl genrsa -out server.key 2048

在linux机器上执行以下命令生成csr文件

2.#openssl req -new -key server.key -out certreq.csr

以下黑色标识文字仅供参考，请根据商户自己实际情况进行填写

Country Name： CN                      //您所在国家的ISO标准代号，中国为CN

State or Province Name：tianjin       //您单位所在地省/自治区/直辖市

Locality Name：tianjin                 //您单位所在地的市/县/区

Organization Name： esgcc                //您单位/机构/企业合法的名称 

Organizational Unit Name： yunwei         //部门名称 

Common Name： 172.16.66.151     //通用名，例如：www.itrus.com.cn。此项必须与您访问提供SSL服务的服务器时所应用的域名完全匹配或者直接写nginx前端的IP地址

Email Address： [email protected]                         //您的邮件地址，不必输入，直接回车跳过

"extra"attributes                        //以下信息不必输入，回车跳过直到命令执行完毕。

执行上面的命令后，在当前目录下即可生成私钥文件server.key和certreq.csr csr文件

3.备份一份服务器密钥文件

cp server.key server.key.org

4.去除文件口令

openssl rsa -in server.key.org -out server.key

5.生成证书文件server.crt

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

二、HTTPS服务器配置

mkdir -p /opt/nginx/ssl

cp -r server.crt  server.key  /opt/nginx/ssl

1、 Nginx配置

server
{
        listen          80;
        server_name     test.dianelian.com;
        location ^~ /boss   {
                include proxy.conf;
                proxy_pass http://172.16.2.211:8100;
        }
         location ^~ /third   {
                include proxy.conf;
                proxy_pass http://172.16.2.211:8100;
        }
         location ^~ /mobile   {
                include proxy.conf;
                proxy_pass http://172.16.2.211:8100;
        }
          location ^~ /platform   {
                include proxy.conf;
                proxy_pass http://172.16.2.212:19017/;
        }
          location ^~ /   {
                include proxy.conf;
                proxy_pass http://172.16.2.212:19018/common-api/swagger-ui.html;
        }
}


server
{
        listen          443 ssl;
        server_name     test.dianelian.com;
        access_log  /opt/nginx/logs/ssl_test_dianelian_access.log;
        error_log   /opt/nginx/logs/ssl_test_dianelian_error.log;
        include ssl.conf;
        location ^~ /boss   {
                include proxy.conf;
                proxy_pass http://172.16.2.211:8100;
        }
         location ^~ /third   {
                include proxy.conf;
                proxy_pass http://172.16.2.211:8100;
        }
         location ^~ /mobile   {
                include proxy.conf;
                proxy_pass http://172.16.2.211:8100;
        }
          location ^~ /platform   {
                include proxy.conf;
                proxy_pass http://172.16.2.212:19017/;
        }
          location ^~ /   {
                include proxy.conf;
                proxy_pass http://172.16.2.212:19018/common-api/swagger-ui.html;
        }
}

View Code

2.ssl.conf

ssl on;  #开启 还有证书的路径
        ssl_certificate       /opt/nginx/ssl/server.crt;
        ssl_certificate_key   /opt/nginx/ssl/server.key;

        ssl_session_cache  builtin:1000  shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 sslv3;
        ssl_ciphers "ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:DES-CBC3-SHA:RC4-MD5:AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:RC4-SHA:IDEA-CBC-MD5:IDEA-CBC-SHA:AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:DES-CBC3-MD5:E5-CBC3-MD5:EXP-RC4-MD5:DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:+HIGH:-MEDIUM:-LOW:-EXPORT:-aNULL:-eNULL";
        ssl_prefer_server_ciphers on;

View Code

3.proxy.conf

 proxy_set_header Host $http_host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;

View Code

 

转载于:https://www.cnblogs.com/python-cat/p/10565193.html