ssl-nginx配置

nginx安装及配置

1.1）安装yum依赖包

yum install perl gcc-c++ make elinks zlib-devel openssl openssl-devel -y

1.2）解压pcre即可

tar -zxf /root/pcre-8.40.tar.gz -C /usr/local/

1.3）解压nginx安装包

tar -zxf /root/nginx-1.8.0.tar.gz -C /root

1.4）开始编译安装nginx-1.8.0
cd /root/nginx-1.8.0

./configure --prefix=/usr/local/nginx --with-pcre=/usr/local/pcre-8.40 --with-http_stub_status_module --with-http_ssl_module && make && make install

1.5）修改nginx.conf配置文件

mkdir /usr/local/nginx/conf/conf.d
sed -i '116s/$/include \/usr\/local\/nginx\/conf\/conf.d\/*.conf;/g' /usr/local/nginx/conf/nginx.conf

1.6)配置nginx支持php
vim /usr/local/nginx/conf/conf.d/test.com.conf

upstream test.com {
         ip_hash;
                 server 127.0.0.1:9006;
                 server 127.0.0.1:9007;
             }

server {
        listen       443;
        server_name  test.com;

    ssl on;
        index index.html index.htm;
        ssl_certificate   /usr/local/nginx/conf/conf.d/ssl/test.pem;  #文件放的路径 
        ssl_certificate_key  /usr/local/nginx/conf/conf.d/ssl/test.key;  #文件放的路径
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;


        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
}

1.7)启动nginx

/usr/local/nginx/sbin/nginx

1.8)查看80端口

netstat -ntpl |grep "80"

1.9)添加防火墙策略，允许所有访问80端口并重启防火墙使之生效

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80  -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443  -j ACCEPT

访问php，https://192.168.1.99/

补充：nginx 强制https (单独添加一个80的server)

server {
    listen 80;
    server_name www.wufangfang.cn;
    rewrite ^(.*) https://$server_name$1 permanent;
}