部署自建CA頒發證書實現https加密

理論忽略：百度上很多

需求：自建證書並實現域名的https加密

部署：

在linux機器上執行以下命令生成私鑰

mkdir -p /opt/ssl-cert

cd  /opt/ssl-cert

1.#openssl genrsa -out server.key 2048

在linux機器上執行以下命令生成csr文件

2.#openssl req -new -key server.key -out server.csr

以下黑色標識文字僅供參考，請根據商戶自己實際情況進行填寫

Country Name： CN                      //您所在國家的ISO標准代號，中國為CN

State or Province Name：tianjin       //您單位所在地省/自治區/直轄市

Locality Name：tianjin                 //您單位所在地的市/縣/區

Organization Name： esgcc                //您單位/機構/企業合法的名稱 

Organizational Unit Name： yunwei         //部門名稱 

Common Name： 172.16.66.151     //通用名，例如：www.itrus.com.cn。此項必須與您訪問提供SSL服務的服務器時所應用的域名完全匹配或者直接寫nginx前端的IP地址

Email Address： [e-mail]                         //您的郵件地址，不必輸入，直接回車跳過

"extra"attributes                        //以下信息不必輸入，回車跳過直到命令執行完畢。

執行上面的命令后，在當前目錄下即可生成私鑰文件server.key和server.csr csr文件

3.備份一份服務器密鑰文件

cp server.key server.key.org

4.去除文件口令

openssl rsa -in server.key.org -out server.key

5.生成證書文件server.crt

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

二、HTTPS服務器配置

mkdir -p /opt/nginx/ssl

cp -r server.crt  server.key  /opt/nginx/ssl

1、 Nginx配置

user www www;

worker_processes auto;

error_log /opt/nginx/logs/nginx_error.log crit;

pid /opt/nginx/logs/nginx.pid;

worker_rlimit_nofile 51200;

events
{
use epoll;
worker_connections 51200;
multi_accept on;
}

http
{
include mime.types;
default_type application/octet-stream;

server_names_hash_bucket_size 128;
client_header_buffer_size 64k;
large_client_header_buffers 4 32k;
client_max_body_size 500M;

sendfile on;
tcp_nopush on;

keepalive_timeout 300;
#proxy超時時間
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;

tcp_nodelay on;

fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 64k;
fastcgi_buffers 4 64k;
fastcgi_busy_buffers_size 128k;
fastcgi_temp_file_write_size 256k;
#緩存配置
proxy_cache_key '$host:$server_port$request_uri';
proxy_temp_file_write_size 512k;
proxy_temp_path /opt/dev/shm/JieLiERP/proxy_temp_path;
proxy_cache_path /opt/dev/shm/JieLiERP/proxy_cache_path levels=1:2 keys_zone=cache_one:200m inactive=5d max_size=1g;
proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
#緩存配置結束
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.1;
gzip_comp_level 2;
gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss;
gzip_vary on;
gzip_proxied expired no-cache no-store private auth;
gzip_disable "MSIE [1-6]\.";

proxy_buffer_size 128k;
proxy_buffers 32 128k;
proxy_busy_buffers_size 128k;

#limit_conn_zone $binary_remote_addr zone=perip:10m;
##If enable limit_conn_zone,add "limit_conn perip 10;" to server section.

server_tokens off;
access_log off;

include vhost/*.conf;
}

 

2.ssl.conf

ssl on;  #開啟 還有證書的路徑
   	ssl_certificate       /opt/nginx/ssl/server.crt;
        ssl_certificate_key   /opt/nginx/ssl/server.key;

        ssl_session_cache  builtin:1000  shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 sslv3;
	ssl_ciphers "ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:DES-CBC3-SHA:RC4-MD5:AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:RC4-SHA:IDEA-CBC-MD5:IDEA-CBC-SHA:AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:DES-CBC3-MD5:E5-CBC3-MD5:EXP-RC4-MD5:DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:+HIGH:-MEDIUM:-LOW:-EXPORT:-aNULL:-eNULL";
	ssl_prefer_server_ciphers on;

　　

 

3.proxy.conf

proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

 vhost配置文件

server
{
	listen		443;
	server_name	wwww.aaa.com;
	access_log  /opt/nginx/logs/del_tm.access.log;
	error_log   /opt/nginx/logs/del_tm.error.log;
	include ssl.conf;
	#脫敏測試
	location ^~ /boss-tm   {
                include proxy.conf;
                proxy_pass http://172.16.2.162:8100;
        }
	location ^~ /third-tm   {
                include proxy.conf;
                proxy_pass http://172.16.2.162:8100;
        }
	location ^~ /platform-tm   {
                include proxy.conf;
                proxy_pass http://172.16.2.162:19017/;
        }
	location ^~ /sec_upload   {
                include proxy.conf;
                proxy_pass http://172.16.2.162:8100;
        }
}