Nginx实现ssl一级、二级域名证书部署并用https访问代理转发服务器

vim /usr/local/nginx/conf/nginx.conf

http {
　　include mime.types;
　　default_type application/octet-stream;

　　#配置https网站配置文件夹
　　include /usr/local/nginx/conf/sites-enabled/*.conf;

　　...

　　server  {

　　　　listen 80;

　　　　#http 带www和不带www的入口
　　　　server_name devcult.com www.devcult.com;

　　　　#可选，这里是把所有http请求全部重定向到https
　　　　return 301 https://www.devcult.com$request_uri;


　　　　location / {
　　　　　　root html;
　　　　　　index index.html index.htm;
　　　　}
　　　　...
　　}
}

mkdir /usr/local/nginx/conf/sites-enabled

[root@aliyun ~]# cat /usr/local/nginx/conf/sites-enabled/www.devcult.com.conf
server {
        listen       443 ssl;

　　　　 #填写绑定证书的域名
        server_name  devcult.com;

　　　　　#跳转www：把https://devcult.con 重定向到 http://www.devcult.com
        return 301 http://www.devcult.com$request_uri;

　　　　　#证书名称，需要跟证书文件名一致
        ssl_certificate      1_devcult.com_bundle.crt;
        ssl_certificate_key  2_devcult.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }
server {
        listen       443 ssl;

　　　　　#填写绑定证书的域名
        server_name  www.devcult.com;

　　　　　#证书名称，需要跟证书文件名一致
        ssl_certificate      1_devcult.com_bundle.crt;
        ssl_certificate_key  2_devcult.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }

cat /usr/local/nginx/conf/sites-enabled/automa.devops-cultural.club.conf 
server {
        listen       443 ssl;
        server_name  automa.devcult.com;
        server_name_in_redirect off;
        ssl_certificate      1_automa.devcult.com_bundle.crt;
        ssl_certificate_key  2_automa.devcult.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers  on;

        location / {
          tcp_nodelay     on;
          proxy_set_header Host            $host;
          proxy_set_header X-Real-IP       $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_pass https://www.automa.com;
        }
    }

rewrite ^(.*) https://$host$1 permanent;

return 301 https://www.devcult.com$request_uri;