Nginx代理https(使用自签证书)

Linux中使用nginx代理https

生成自签名证书

# 生成一对秘钥，把公钥做成证书
[root@localhost crt]# openssl  genrsa -out /home/ca.key 2048
Generating RSA private key, 2048 bit long modulus
....................................+++
.........+++
e is 65537 (0x10001)
[root@localhost crt]# ls
[root@localhost crt]# openssl  genrsa -out /home/crt/ca.key 2048
Generating RSA private key, 2048 bit long modulus
.......................................................................................................................+++
.............................................................................................+++
e is 65537 (0x10001)
[root@localhost crt]# ls
ca.key

# 生成证书CRT
[root@localhost crt]# openssl req -new  -x509 -key  /home/crt/ca.key  -out /home/crt/server.crt  -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:l^H^H^H
string is too long, it needs to be less than  2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GS
Locality Name (eg, city) [Default City]:LZ
Organization Name (eg, company) [Default Company Ltd]:LDEY
Organizational Unit Name (eg, section) []:YF
Common Name (eg, your name or your server's hostname) []:CZD
Email Address []:[email protected]
[root@localhost crt]# ls
ca.key  server.crt

 

生成成功以后 /home目录下生成ca.key和server.crt文件

此时配置Nginx如下：

 server {
	  listen 443 ssl;
	  root /;
	  server_name  102.108.10.30;
	  ssl_certificate   /home/server.crt;
	  ssl_certificate_key  /home/ca.key;
	  ssl_session_timeout 5m;
	  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	  location / {
			proxy_pass https://182.63.200.29:8090/;
        }
	}

重启Nginx: service nginx restart

此时在次访问：

详情参考Nginx 配置 HTTPS自签名证书