使用openssl生成證書，並通過Nginx配置

 

創建服務器證書密鑰文件 server.key

openssl genrsa -des3 -out server.key 2048

這個時候會提示輸入密碼 這個密碼要記住

 

openssl語法

openssl  genrsa [-out filename] [-passout arg] [-f4] [-3] [-rand file(s)] [-engine id] [numbits] [-des] [-des3] [-idea]

 

usage: genrsa [args] [numbits]
 -des            encrypt the generated key with DES in cbc mode
 -des3           encrypt the generated key with DES in ede cbc mode (168 bit key)
 -idea           encrypt the generated key with IDEA in cbc mode
 -seed
                 encrypt PEM output with cbc seed
 -aes128, -aes192, -aes256
                 encrypt PEM output with cbc aes
 -camellia128, -camellia192, -camellia256
                 encrypt PEM output with cbc camellia
 -out file       output the key to 'file
 -passout arg    output file pass phrase source
 -f4             use F4 (0x10001) for the E value
 -3              use 3 for the E value
 -engine e       use engine e, possibly a hardware device.
 -rand file:file:...
                 load the file (or the files in the directory) into
                 the random number generator

 

 

 

創建服務器證書的申請文件 server.csr

openssl req -new -key server.key -out server.csr

會要求輸入下面內容

輸出內容為：

Enter pass phrase  for  root.key: 輸入前面創建的密碼

Country Name ( 2  letter code) [AU]:CN   國家代號，中國輸入CN

State or Province Name (full name) [Some-State]:BeiJing   省的全名，拼音

Locality Name (eg, city) []:BeiJing  市的全名，拼音

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Yvioo  公司英文名(可以隨便輸入)

Organizational Unit Name (eg, section) []:  單位名 可以不輸入

Common Name (eg, YOUR name) []: 輸入你的名字

Email Address []:admin @mycompany .com  電子郵箱隨便填

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []:  可以不輸入

An optional company name []:   可以不輸入

 

 

備份一份服務器密鑰文件

cp server.key server.key.org

 

去除文件口令

openssl rsa -in server.key.org -out server.key

會要求輸入之前的密碼 輸入一開始的密碼

 

生成證書文件server.crt

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

 

然后文件夾下會有四個文件 

 

 

 

 

配置Nginx的證書

 

 這個路徑根據自己的來

# HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  localhost;

        ssl_certificate      /usr/share/nginx/html/ssl/server.crt;
        ssl_certificate_key  /usr/share/nginx/html/ssl/server.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
    }