nginx配置https證書

一，配置流程

1，准備證書文件

本人以阿里雲服務器下載的免費證書資源包為例(每個賬號可申請一年的免費證書)：

5131387_www.goking.site.key

5131387_www.goking.site.pem

2，在nginx安裝目錄下創建證書文件夾cert，並把兩個證書文件放到里面

cd /usr/local/nginx/conf

mkdir cert

如圖把證書放到 /usr/local/nginx/conf/cert下

 

 

 3，修改nginx.conf文件，增加https配置項

server {
        listen 443 ssl;
        server_name www.goking.site;
        ssl_certificate cert/5131387_www.goking.site.pem;
        ssl_certificate_key cert/5131387_www.goking.site.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        location / {
           proxy_pass   http://127.0.0.1:80;
           # root   html;
           # index  index.html index.htm;
        }
    }

4，保存配置文件,重啟nginx

/user/local/nginx/sbin/nginx -s reload

5，如果使用的是阿里雲服務器，請打開對外端口443

 

6，https已配置成功！

 

二，問題總結

啟動nginx時，報錯如下：

nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:37

需要Nginx開啟SSL模塊，解決如下：

1，進入nginx源碼包文件夾

cd /usr/local/nginx-1.16.1/

2, 查看nginx已開啟的模塊

/usr/local/nginx/sbin/nginx -V

下圖是我已開啟后的，未開啟的沒有 --with-http_ssl_module

 

 

 3，增加configure參數如下，確認目錄並執行

./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module

4，進行編譯

make

5，拷貝源碼編譯后的nginx，並先進行備份

cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak

cp ./objs/nginx /usr/local/nginx/sbin/

6，查看是否添加成功

/usr/local/nginx/sbin/nginx -V

 7，重啟nginx，ok

/user/local/nginx/sbin/nginx -s reload

 

三，貼出配置的nginx.conf

以下僅為簡單配置，覆蓋以下知識點：

1，log日志自定義格式化

2，PHP配置項

3，http、https域名配置

4，nginx代理轉發

 

nginx.conf配置文件如下：

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';
    
    log_format json_combined escape=json '{"@timestamp":"$time_iso8601",'
                      '"@source":"$server_addr",'
                      '"@nginx_fields":{'
                      '"remote_addr":"$remote_addr",'
                      '"remote_user":"$remote_user",'
                      '"body_bytes_sent":"$body_bytes_sent",'
                      '"request_time":"$request_time",'
                      '"status":"$status",'
                      '"host":"$host",'
                      '"uri":"$uri",'
                      '"server":"$server_name",'
                      '"port":"$server_port",'
                      '"protocol":"$server_protocol",'
                      '"request_uri":"$request_uri",'
                      '"request_body":"$request_body",'
                      '"request_method":"$request_method",'
                      '"http_referrer":"$http_referer",'
                      '"body_bytes_sent":"$body_bytes_sent",'
                      '"http_x_forwarded_for":"$http_x_forwarded_for",'
                      '"http_user_agent":"$http_user_agent",'
                      '"upstream_response_time":"$upstream_response_time",'
                      '"upstream_addr":"$upstream_addr"}}';
    access_log  logs/access.log  json_combined;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   /var/www/html;
            index  index.html index.htm index.php;
            try_files $uri $uri/ /napir-cms/index.html;
        }
        location /crm {
            rewrite  ^.+crm/?(.*)$ /$1 break;
            proxy_pass  http://103.228.204.49:8089/ISV/CrmInsideService.svc;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location /forum {
        #    try_files $uri $uri/ /forum/index.php;
        #}
        location ~* \.php$ {
            #root           html;
            root   /var/www/html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            include        fastcgi_params;
            fastcgi_param   SCRIPT_FILENAME    $document_root$fastcgi_script_name;
            fastcgi_param   SCRIPT_NAME        $fastcgi_script_name;
            #fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        }

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #    nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /usr/local/nginx/conf/nginx.conf:108    index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    server {
        #listen 80 default backlog=2048;
        listen 443 ssl;
        #ssl on;
        server_name www.goking.site;
        #root /var/www/html;

        ssl_certificate cert/5131387_www.goking.site.pem;
        ssl_certificate_key cert/5131387_www.goking.site.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        location / {
           proxy_pass   http://127.0.0.1:80;
           # root   html;
           # index  index.html index.htm;
        }
        location /forum {
            try_files $uri $uri /forum/index.php;
        }
        location ~* \.php$ {
            root   /var/www/html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            include        fastcgi_params;
            fastcgi_param   SCRIPT_FILENAME    $document_root$fastcgi_script_name;
            fastcgi_param   SCRIPT_NAME        $fastcgi_script_name;
        }
    }
}