SSL證書生成及Nginx配置（親測可用）

一、服務端證書制作（針對B/S項目）

1.在Centos7上新建一個空目錄，創建mySsl.conf的配置文件，包含如下內容：

[ req ]
default_bits    = 2048
distinguished_name = req_distinguished_name
req_extensions   = req_ext

[ req_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = cn
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = sc
localityName         = Locality Name (eg, city)
localityName_default     = cd
organizationName       = Organization Name (eg, company)
organizationName_default   = my
organizationalUnitName       = Organizational Unit Name (eg, section)
organizationalUnitName_default   = as
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_max        = 64
commonName_default      = yang.com

[ req_ext ]
subjectAltName = @alt_names

# 可配置多域名，用於訪問的域名或ip一定要包含在此列表
[alt_names]
IP.1   = 192.168.50.62 # 服務端主機ip
DNS.1  = yang.com # 服務端域名1
DNS.2  = yang.net # 服務端域名2

2.依次執行下列命令生成服務端證書：

penssl genrsa -out server.key 2048
openssl req -new -sha256 -out server.csr -key server.key -config mySsl.conf
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt -extensions req_ext -extfile mySsl.conf

二、Nginx證書配置

# 前端項目部署http
server {
    listen    80;
    server_name  front;
    return 301 https://$host$request_uri;  # 自動將80的請求轉發到443
}

# 前端項目部署https
server {
	ssl on;
	listen    443 ssl;
	server_name  front;

	keepalive_timeout 100;
	ssl_session_timeout 10M;
	ssl_session_cache shared:SSL:10M;

	ssl_certificate  \\myconf\\ssl\\server.crt;
	ssl_certificate_key \\myconf\\ssl\\server.key;

	location / {
		root  D:\\zzCloudDvd\\outer\\dist\\;
		index  index.html index.htm;
	}
	
	error_page  500 502 503 504  /50x.html;
        location = /50x.html {
        root  html;
	} 
}

# 后端接口反向代理
server {
	ssl on;
	listen    8881 ssl;
	server_name  back;	
	keepalive_timeout 100;
	
 	ssl_session_timeout 10M;
	ssl_session_cache shared:SSL:10M;

	ssl_certificate  \\myconf\\ssl\\server.crt;
	ssl_certificate_key \\myconf\\ssl\\server.key;

	location / {
		proxy_pass http://192.168.50.62:8880;
	}
}

三、瀏覽器端配置

1. 在瀏覽器本地雙擊server.crt文件，將證書安裝到【受信任的根證書頒發機構下】。
2. 修改瀏覽器本地hosts文件，將證書包含的域名映射到服務端的ip。
3. 使用PostMan等客戶端工具測試https接口時，由於沒有在客戶端配證書，所以需要關閉PostMan的ssl功能方可請求成功。