基于Openresty进行配置https,配置https后能够对传输的文本进行加密传输（http请求转换为https请求）
一、配置https
1、默认openresty、openssl已经安装完成，我在/usr/local/openresty/nginx/conf/目录下创建一个cert文件夹用来存放证书和服务器私钥（可根据自己情况而定）。
[root@ZYL conf]# pwd
/usr/local/openresty/nginx/conf
[root@ZYL conf]# ls
cert fastcgi_params koi-win nginx.conf nginx.conf-99-9 scgi_params.default win-utf
fastcgi.conf fastcgi_params.default mime.types nginx.conf_198 nginx.conf.default uwsgi_params
fastcgi.conf.default koi-utf
2、进入cert目录下， 创建服务器私钥，命令会提醒输入一个密码
生成4096字节的服务器私钥：openssl genrsa -des3 -out server.key 4096
[root@ZYL cert]# openssl genrsa -des3 -out server.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.......................++++
..................................................................................++++
e is 65537 (0x010001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
3、创建签名请求的证书（CSR）
openssl req -new -key server.key -out server.csr
[root@ZYL cert]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:GUIZHOU
Locality Name (eg, city) []:Duyun
Organization Name (eg, company) [Internet Widgits Pty Ltd]:sy
Organizational Unit Name (eg, section) []:gt
Common Name (e.g. server FQDN or YOUR name) []:www.localhost.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:syf
邮箱地址可不用填，直接回车即可（我是没有填）。
4、在加载SSL支持的Nginx服务器上，使用上述私钥时除去必须的口令（注意，所谓除去，其实就是将必须的私钥密码写入到了私钥文件里面了，更新了原来的私钥文件）
[root@ZYL cert]# cp server.key server.key.org
[root@ZYL cert]# openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:
writing RSA key
5、通过openssl的x509指令生成证书文件
[root@ZYL cert]# openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=C = CN, ST = GUIZHOU, L = Duyun, O = shineyue, OU = gt, CN = localhost
Getting Private key
6、配置nginx.conf文件
server {
listen 443 ssl;
server_name localhost;
#ssl on;
ssl_certificate /usr/local/openresty/nginx/conf/cert/server.crt;
ssl_certificate_key /usr/local/openresty/nginx/conf/cert/server.key;
ssl_session_cache shared:SSL:5m;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
location / {
alias html/;
index index.html index.htm;
try_files $uri $uri/ /index.html;
client_max_body_size 100M;
}
......
}
7、重启nginx,访问https://192.168.60.128
可以看到红色https字样
二、对https抓包查看是否进行了加密传输
对http进行抓包：
可以看到是HTTP传输，并没有加密。
对https进行抓包：
使用了https后传输的文本进行了加密。
三、http请求转换为https请求
把http的域名请求转成https
......
server {
listen 80;
#填写绑定证书的域名
server_name localhost;
#把http的域名请求转成https
rewrite ^(.*)$ https://$host$1 permanent;
}
server {
listen 443 ssl;
server_name localhost;
#ssl on;
ssl_certificate /usr/local/openresty/nginx/conf/cert/server.crt;
ssl_certificate_key /usr/local/openresty/nginx/conf/cert/server.key;
ssl_session_cache shared:SSL:5m;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
location / {
alias html/;
index index.html index.htm;
try_files $uri $uri/ /index.html;
client_max_body_size 100M;
}
......
}
这样进行i访问时就会自动转为https。