Nginx安装
1.ׁ依赖环境安装
yum -y install gcc-c++
yum -y install pcre pcre-devel
yum -y install zlib zlib-devel
yum -y install openssl openssl-devel
2.下载nginx源码
wget http://nginx.org/download/nginx-1.19.0.tar.gz
3.解压源码
tar -zxvf nginx-1.19.0.tar.gz
4.执行编译
进入源码目录执行:
cd nginx-1.19.0
./configure
./configure --with-http_ssl_module --with-http_stub_status_module -prefix=/usr/local/nginx --with-http_v2_module --with-http_gzip_static_module -with-http_realip_module --with-http_flv_module --with-http_mp4_module -with-pcre-jit --with-pcre --with-stream
make
make install
执行完成后默认安装在 /usr/local/nginx 目录下
5.启动和停止
cd /usr/local/nginx/sbin
./nginx # 启动命令
./nginx -s stop # 停止命令
./nginx -s reload # 重启命令
Nginx 配置
Nginx开机自启动
Centos 7为例
1.进入系统service目录下, 配置启动service文件
vi /lib/systemd/system/nginx.service
[Unit]
Description=nginx service
After=network.target
[Service]
Type=forking
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s quit
PrivateTmp=true
[Install]
WantedBy=multi-user.target
保存退出
[Unit] 服务的生命
Description:服务描述
After: 描述服务类别
[Service] 服务运行参数设置
Type=forking 是后台运行的形式
ExecStart 为服务得具体运行命令
ExecReload 重启命令
ExecStop 为停止命令
PrivateTmp=True 表示给服务分配独立的临时空间
注意: [Service] 的启动,重启, 停止命令全部要求绝对路径
[Install]运行级别下服务安装的相关设置, 可设置为多用户,即系统运行级别3
2.加入或取消开机自启动
systemctl enable nginx #加入开机自启动
systemctl disable nginx #取消开机自启动
其他常用命令
systemctl start nginx.service #启动nginx服务
systemctl stop nginx.service̴ #停止服务
systemctl restart nginx.service̴ #重新启动服务
systemctl list-units --type=service #查看所有已启动的服务
systemctl status nginx.service #查看服务当前状态
systemctl enable nginx.service #设置开机自启动
systemctl disable nginx.service #停止开机自启动
https://www.cnblogs.com/uglyliu/p/8534473.html 支持lua
https://www.cnblogs.com/love3556/p/5962388.html
配置双向SSL 证书
先查看openssl
openssl version -a
结果
LibreSSL 2.6.5
built on: date not available
platform: information not available
options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: information not available
OPENSSLDIR: "/private/etc/ssl"
进入OPENSSLDIR配置的路径 /private/etc/ssl 查看 openssl.cnf文件
cd /private/etc/ssl
vi openssl.cnf
找到CA_default, 后续我生成的文件在dir配置的路劲下
[ CA_default ]
dir = /home/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial numbe
新建工作目录[CA_default]的dir， certs， crl_dir， database，new_certs_dir， serial
并将‘01’写入serial文件
mkdir certs
mkdir crl
mkdir newcerts
touch index.txt
echo '01'>serial
然后进入openssl, 在控制台输入
cd /etc/pki/CA
openssl
进入openssl
1.生成自己的CA
req -new -x509 -keyout ngca.key -out ngca.crt -config openssl.cnf
会要求输入ngca.key密码,密码自己定义.
生成会话会让你填入一些参数,根据实际情况填写。执行完会发现工作目录下会有ca.crt ca.key两个文件。
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:Tsyun
Organizational Unit Name (eg, section) []:Tsyun CA
Common Name (eg, your name or your server's hostname) []:Tsyun CA
Email Address []:
2.接下来生成server端证书
首先生成server端私钥。执行后会要求输入解析私钥文件的密码，根据个人喜好设置。生成ngserver.key。
genrsa -des3 -out ngserver.key 2048
会要求输入ngserver.key密码, 密码自己定义.
生成证书请求。生成会话会提示输入一些请求信息，成功后生成ngserver.csr。
req -new -key ngserver.key -out ngserver.csr -config openssl.cnf
会要求输入上面输入的ngserver.key密码
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:Tsyun
Organizational Unit Name (eg, section) []:WERT
Common Name (eg, your name or your server's hostname) []:192.168.0.1
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
注意红色下划线的部分, 输入域名或者需要部署ssl服务器的IP地址.否则签发的证书会被浏览器视为不是本站点的证书。其他根据情况。
现在用生成的CA给证书请求（ngserver.csr）签发证书。根据提示输入相关密码（之前设置好的）和y（yes），成功后生成证书ngserver.crt
ca -in ngserver.csr -out ngserver.crt -cert ngca.crt -keyfile ngca.key -config openssl.cnf
3.生成client端私钥
genrsa -des3 -out ngclient.key 2048
会要求设置ngclient.key的密码
生成证书请求。生成会话会提示输入一些请求信息，成功后生成ngclient.csr。
req -new -key ngclient.key -out ngclient.csr -config openssl.cnf
根据提示填写：
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:Tsyun
Organizational Unit Name (eg, section) []:WERT
Common Name (eg, your name or your server's hostname) []:Client
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
现在用之前生成的CA给证书请求（ngclient.csr）签发证书。根据提示输入相关密码（之前设置好的）和y（yes），成功后生成证书ngclient.crt
ca -in ngclient.csr -out ngclient.crt -cert ngca.crt -keyfile ngca.key -config openssl.cnf
把client.crt转化为client.p12格式
pkcs12 -export -clcerts -in ngclient.crt -inkey ngclient.key -out ngclient.p12
可以根据需要转pem格式
cat ca.crt ca.key > ca.pem
cat server.crt server.key > server.pem
cat client.crt client.key > client.pem
将ngca.crt 导入浏览器证书的受信任的根目录, ngclient.p12导入浏览器证书的个人目录下.
配置nginx的SSL
vi /usr/local/nginx/conf/nginx.conf
修改配置
包含SSL配置和转发http配置
server {
listen 9999 ssl;
server_name localhost;
charset utf-8;
ssl_certificate /etc/pki/CA/ngserver.crt; #配置证书位置
ssl_certificate_key /etc/pki/CA/ngserver.key; #配置秘钥位置
ssl_client_certificate /etc/pki/CA/ngca.crt;#双向认证
ssl_verify_client on; #双向认证
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html index.htm;
}
location /search.html { #转发http配置
proxy_pass http://ip:port/search.html;
}
}
保存后启动nginx, 会要求输入server端私钥密码, 即上面你设置的ngserver.key密码.但是浏览器访问链接的时候,可能访问不了,报400. nginx的error.log报:(可能的坑)
[emerg] 562201#0: cannot load certificate key "/etc/pki/CA/ngserver.key": PEM_read_bio_PrivateKey() failed (SSL: error:2807106B:UI routines:UI_process:processing error:while reading strings error:0906406D:PEM routines:PEM_def_callback:problems getting password error:0906A068:PEM routines:PEM_do_header:bad password read)
回到证书目录, 执行以下:
cp ngserver.key ngserver.key.org
进入openssl,执行:
rsa -in ngserver.key.org -out ngserver.key
会要求输入ngserver.key密码, 重启nginx的时候, 不需要再输入密码.也不会再报错bad password read