基於Nginx的https服務

1、HTTPS協議的實現

1、為什么需要HTTPS？

原因：HTTP不安全

• 1、傳輸數據被中間人盜用、信息泄露
• 2、數據內容劫持、篡改

對傳輸內容進行加密以及身份驗證

2、對稱加密

非對稱加密

3、HTTPS加密協議原理

4、中間人偽造客戶端和服務端

證書是在客戶端的，進行校驗。

2、生成密鑰和CA證書

#openssl version

OpenSSL 1.0.1e-fips 11 Feb 2013

#nginx-v

-with-http_ssl_module

步驟一、生成key密鑰

[root@web-01 ssl_key]# openssl genrsa -idea -out lewen.key 1024
Generating RSA private key, 1024 bit long modulus
......................................++++++
..............................++++++
e is 65537 (0x10001)
Enter pass phrase for lewen.key:                #密碼要寫.或者不寫
Verifying - Enter pass phrase for lewen.key:

步驟二、生成證書簽名請求文件（csr文件）

[root@web-01 ssl_key]# openssl req -new -key lewen.key -out lewen.csr
Enter pass phrase for lewen.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SZ
Locality Name (eg, city) [Default City]:futian
Organization Name (eg, company) [Default Company Ltd]:fadewalk
Organizational Unit Name (eg, section) []:fadewalk.com
Common Name (eg, your name or your server's hostname) []:fadewalk.com
Email Address []:[e-mail]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:        #沒有要求就為空
An optional company name []:
[root@web-01 ssl_key]# ls
lewen.csr lewen.key

步驟三、生成證書簽名文件（CA文件）

[root@web-01 ssl_key]# openssl x509 -req -days 3650 -in lewen.csr -signkey lewen.key -out lewen.crt
Signature ok
subject=/C=CN/ST=SZ/L=futian/O=fadewalk/OU=fadewalk.com/CN=fadewalk.com/emailAddress=[e-mail]
Getting Private key
Enter pass phrase for lewen.key:
[root@web-01 ssl_key]# ls
lewen.crt lewen.csr lewen.key

3、Nginx的HTTPS語法配置

  例子
  server {
        listen              443 ssl;
        keepalive_timeout   70;

        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
        ssl_certificate     /usr/local/nginx/conf/cert.pem;
        ssl_certificate_key /usr/local/nginx/conf/cert.key;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;

        ...
    }

[root@web-01 ~]# nginx -s reload

nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/cp4/test_https.conf:4

key設置了密碼，每次重啟都要輸入密碼很麻煩

4、場景-配置蘋果要求的證書

a、服務器所有的連接使用TLS1.2以上版本（openssl 1.0.2）

b、HTTPS證書必須使用SHA 256以上哈希算法簽名

C、HTTPS證書必須使用RSA 2048位或ECC256位以上公鑰算法

d、使用前向加密技術

查看證書信息

[root@web-01 ssl_key]# openssl x509 -noout -text -in ./lewen_apple.crt

一鍵生成證書

[root@web-01 ssl_key]# openssl req -days 3650 -x509 -sha256 -nodes -newkey rsa:2048 -keyout lewen.key -out lewen_apple.crt
Generating a 2048 bit RSA private key
......................................................................................+++
..+++
writing new private key to 'lewen.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:guangdong
Locality Name (eg, city) [Default City]:sz
Organization Name (eg, company) [Default Company Ltd]:fadewlak
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
[root@web-01 ssl_key]# ls
lewen_apple.crt  lewen.key

nginx 1.15 以后開啟ssl的正確姿勢

2019/06/17 17:06:54 [warn] 36807#36807: the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/cp4/test_https.conf:4
不推薦使用“ssl”指令，而是在/etc/nginx/conf.d/cp4/test_https中使用“listen ... ssl”指令。CONF：4
ssl on 這種方式開啟ssl已經不行了
listen 443 ssl     采用這種

測試網頁自己生成的證書，會被提示不安全

去掉之前分步生成輸入的保護碼

openssl rsa -in ./lewen.key -out ./lewen_nopassword.key

5、HTTPS服務優化

方法一、激活keepalive長連接

方法二、設置ssl session緩存

server {
    listen 443 ssl;
    server_name web01.fadewalk.com;
    # ssl on;  nginx 1.15之后這樣配置無效

    keepalive_timeout 100;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_certificate /etc/nginx/ssl_key/lewen_apple.crt;
    ssl_certificate_key /etc/nginx/ssl_key/lewen.key;
    #ssl_certificate_key /etc/nginx/ssl_key/lewen_nopass.key;

    location / {
        root  /opt/app/code/cp4/code;
        index lewen.html lewen.htm;
    }
}