nginx安装GODADDY证书
[root@longquan opt]# openssl genrsa -out domain.com.key 2048 //创建私钥
Generating RSA private key, 2048 bit long modulus
[root@longquan opt]# openssl req -new -key domain.com.key -out domain.com.csr //创建CSR (Certificate signing request)，需要指定刚才生成的私钥
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SH
Locality Name (eg, city) [Default City]:SH
Organization Name (eg, company) [Default Company Ltd]:厦门某某某有限公司
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:domain.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@longquan opt]# ls
domain.com.csr domain.com.key RAP rap_release_v0.11.3_20150727.war rh ROOT
[root@longquan opt]# cat domain.com.csr //把这一串粘帖到GODADDY那边
-----BEGIN CERTIFICATE REQUEST-----
...
...
...
...
...
-----END CERTIFICATE REQUEST-----
验证域名所有权限，2个方法
1、验证DNS
2、放到根目录上（用这个方法需要在上传后自己浏览器访问一下）
大概10分钟内就可以下载证书
[root@longquan opt]# mkdir -p /usr/local/nginx/conf/ssl/
[root@longquan opt]# cp domain.com.key /usr/local/nginx/conf/ssl/
[root@longquan opt]# cd /usr/local/nginx/conf/ssl/longquan/
[root@longquan opt]# rz //上传从GODADDY下载下来的2个crt文件
rz waiting to receive.
zmodem trl+C 100% 1 KB 1 KB/s 00:00:01 0 Errors.
100% 4 KB 4 KB/s 00:00:01 0 Errors
[root@longquan opt]# ll
总用量 16
-rw-r--r-- 1 root root 1838 10月 28 03:00 4f66c3613*.crt
-rw-r--r-- 1 root root 4795 10月 28 03:00 gd_bundle-g2-g1.crt
-rw-r--r-- 1 root root 1675 10月 28 19:25 domain.com.key
Fix Intermediate Certificate Chain
[root@longquan opt]# cat gd_bundle-g2-g1.crt >> 4f66c3613*.crt
[root@longquan opt]# cp 4f66c3613*.crt domain.com.crt //取个我们容易识别的CRT名称
在虚拟主机配置文件上的server段里面添加
ssl on;
ssl_certificate ssl/domain.com.crt;
ssl_certificate_key ssl/domain.com.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5:!EXPORT56:!EXP;
ssl_prefer_server_ciphers on;
[root@longquan opt]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@longquan opt]# nginx -s reload
注意：先在测试机上测试再上到正式线上