https協議
是一種通過計算機網絡進行安全通信的傳輸協議。HTTPS經由HTTP進行通信，但利用SSL/TLS來加密數據包。HTTPS開發的主要目的，是提供對網站服務器的身份認證，保護交換數據的隱私與完整性。這個協議由網景公司（Netscape）在1994年首次提出，隨后擴展到互聯網上。
簡單來說，HTTPS 是 HTTP 的安全版，是使用 SSL/TLS 加密的 HTTP 協議。通過 TLS/SSL 協議的的身份驗證、信息加密和完整性校驗的功能，從而避免信息竊聽、信息篡改和信息劫持的風險。
HTTPS 提供了加密 (Encryption)、認證 (Verification)、鑒定 (Identification) 三種功能
- 🍕私密性(Confidentiality/Privacy):
也就是提供信息加密，保證數據傳輸的安全； - 🍔可信性(Authentication):
身份驗證，主要是服務器端的，確認網站的真實性，有些銀行也會對客戶端進行認證； - 🍟完整性(Message Integrity):
保證信息傳輸過程中的完整性，防止被修改；
HTTPS就是在應用層和傳輸層中間加了一道驗證的門檻以保證數據安全
部署服務
准備環境
| 主機名 | IP地址 | 作用 |
| web03 | 10.0.0.9 | 網站服務 |
| lb01 | 10.0.0.6 | 負載均衡 |
server { listen 443 ssl; ssl算法協議 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl算法方式 證書機構 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; * 指定公鑰文件（證書） ssl_certificate /etc/nginx/conf.d/cert.pem; * 指定私鑰文件 ssl_certificate_key /etc/nginx/conf.d/cert.key; }
創建私鑰文件
[root@web03 ~]# openssl genrsa -idea -out /etc/nginx/conf.d/server.key 2048 #位數決定私鑰的長度,加-idea 需要輸入密碼 #說明：密鑰文件也可以進行加密的，並且支持后期手工加密，但不建議加密，每次使用密鑰都需要解密，比較麻煩 [root@web03 ~]# chmod 600 /etc/nginx/conf.d/server.key
創建公鑰文件（假證）
[root@web03 /etc/nginx/conf.d]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt # -out 生成證書 Generating a 2048 bit RSA private key .....................+++ ......................+++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN #公司信息 State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]:BJ Organization Name (eg, company) [Default Company Ltd]:edu Organizational Unit Name (eg, section) []:IT Common Name (eg, your name or your server's hostname) []:web Email Address []:1354586***@qq.com
阿里雲SSL證書地址：
vim /etc/yum.repos.d/nginx.repo [nginx-stable] name=nginx stable repo baseurl=http://nginx.org/packages/centos/$releasever/$basearch/ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key
2. 重新配置完yum源信息，建議清除一些yum緩存信息
yum clean all yum makecache
3. 安裝軟件程序
yum install nginx -y
4. 編寫程序配置文件
cd /etc/nginx/conf.d mv default.conf default.conf.bak vim xxx.conf
5. 編寫擴展配置文件
server { listen 443 ssl; #開啟ssl功能 server_name www.oldboy.com; ssl_certificate /etc/nginx/conf.d/server.crt; #公鑰文件地址 ssl_certificate_key /etc/nginx/conf.d/server.key; #私鑰文件地址 location / { root /html/www; index index.html index.htm; } }
user nginx; worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; #tcp_nopush on; keepalive_timeout 65; #gzip on; include /etc/nginx/conf.d/www.conf; }
模塊信息： --with-http_ssl_module
server { listen 80; server_name www.oldboy.com; rewrite ^(.*)$ https://$host$1 permanent; #直接跳轉到https上 }
cat /etc/nginx/confi.d/www.conf
server { listen 80; server_name www.oldboy.com; rewrite ^(.*)$ https://$host$1 permanent; } server { listen 443 ssl; server_name www.oldboy.com; ssl_certificate /etc/nginx/conf.d/server.crt; ssl_certificate_key /etc/nginx/conf.d/server.key; location / { root /html/www; index index.html index.htm; } }
說明：在https配置server基礎上再添加http跳轉server
情況二：
server { listen 443; listen 80; ssl on; server_name www.etiantian.org; ssl_certificate /application/nginx/conf/key/server.crt; ssl_certificate_key /application/nginx/conf/key/server.key; location / { root html/www; index index.html index.htm; } error_page 497 https://$host$uri; }
#將公鑰和密鑰傳輸到負載均衡上 [root@web03 /html]# scp -rp /etc/nginx/conf.d/server.* 172.16.1.5:/etc/nginx/conf.d/ [root@lb01 ~]# vim /etc/nginx/nginx.conf worker_processes 1; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; server { listen 80; server_name www.oldboy.com; rewrite ^(.*)$ https://$host$1 permanent; } upstream oldboy { server 10.0.0.7:443; } server { listen 443 ssl; server_name localhost; ssl_certificate /etc/nginx/conf.d/server.crt; ssl_certificate_key /etc/nginx/conf.d/server.key; location / { root html; index index.html index.htm; proxy_pass https://oldboy; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; proxy_next_upstream error timeout invalid_header http_403 http_502; } } }
后端web網站配置，跳轉已經讓負載均衡完成
[root@web03 /]# vim /etc/nginx/conf.d/www.conf server { listen 80; server_name www.oldboy.com; location / { root /html/www; index index.html index.htm; } }