码迷,mamicode.com
首页 > Web开发 > 详细

CentOS使用nginx部署https服务

时间:2019-04-05 18:08:15      阅读:222      评论:0      收藏:0      [点我收藏+]

标签:yml   erro   www.   proxy   conf   null   pcr   proc   err   

nginx安装参考:https://www.cnblogs.com/taiyonghai/p/6728707.html

自签证书生成参考:https://gmd20.github.io/blog/openssl%E7%94%9F%E6%88%90RSA%E5%92%8C%E6%A4%AD%E5%9C%86%E6%9B%B2%E7%BA%BF%E5%8A%A0%E5%AF%86%E5%85%AC%E9%92%A5%E5%AF%86%E9%92%A5%E5%88%9B%E5%BB%BA%E6%A0%B9CA%E7%AD%BE%E5%90%8DHTTPS%E6%9C%8D%E5%8A%A1%E5%99%A8%E8%AF%81%E4%B9%A6%E7%AD%BE%E5%90%8D/

 

一:Nginx 安装

openssl安装

[root@localhost src]# tar zxvf openssl-fips-2.0.10.tar.gz
省略安装内容...

[root@localhost src]# cd openssl-fips-2.0.10

[root@localhost openssl-fips-2.0.10]# ./config && make && make install
省略安装内容...

pcre安装

[root@localhost src]# tar zxvf pcre-8.40.tar.gz
省略安装内容...

[root@localhost src]# cd pcre-8.40

[root@localhost pcre-8.40]# ./configure && make && make install
省略安装内容...

zlib安装

[root@localhost src]# tar zxvf zlib-1.2.11.tar.gz
省略安装内容...

[root@localhost src]# cd zlib-1.2.11

[root@localhost zlib-1.2.11]# ./configure && make && make install
省略安装内容...

 

SSL模块安装

[root@localhost src]# yum install openssl-devel
省略安装内容...

nginx安装

[root@localhost src]# tar zxvf nginx-1.10.2.tar.gz
省略安装内容...

[root@localhost src]# cd nginx-1.10.2

[root@localhost nginx-1.10.2]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module && make && make install
省略安装内容...

 

 

二、证书和私钥的生成

注意:将生成的服务器证书和私钥, 拷贝到/usr/local/nginx/conf/目录下, 测试可以使用自签证书。使用openssl自签即可。

 建议使用ECC加密证书

[root@localhost conf]# ls -al
total 84
drwxr-xr-x.  3 root root 4096 Apr  5 15:29 .
drwxr-xr-x. 11 root root  151 Apr  5 13:34 ..
省略
-rw-r--r--.  1 root root  615 Apr  5 15:29 server.crt
-rw-r--r--.  1 root root  302 Apr  5 15:29 server.key
省略

                                  

 

三、配置文件

1.下面为配置文件 /usr/local/nginx/conf/nginx.conf  , 将HTTPS部分的server配置注释去掉,并设置正确的证书证书和私钥

 

[root@localhost conf]# cat nginx.conf

 

#user  nobody;

worker_processes  1;

 

#error_log  logs/error.log;

#error_log  logs/error.log  notice;

#error_log  logs/error.log  info;

 

#pid        logs/nginx.pid;

 

 

events {

    worker_connections  1024;

}

 

 

http {

    include       mime.types;

    default_type  application/octet-stream;

 

    #log_format  main  ‘$remote_addr - $remote_user [$time_local] "$request" ‘

    #                  ‘$status $body_bytes_sent "$http_referer" ‘

    #                  ‘"$http_user_agent" "$http_x_forwarded_for"‘;

 

    #access_log  logs/access.log  main;

 

    sendfile        on;

    #tcp_nopush     on;

 

    #keepalive_timeout  0;

    keepalive_timeout  65;

 

    #gzip  on;

 

    server {

        listen       80;

        server_name  localhost;

 

        #charset koi8-r;

 

        #access_log  logs/host.access.log  main;

 

        location / {

            root   html;

            index  index.html index.htm;

        }

 

        #error_page  404              /404.html;

 

        # redirect server error pages to the static page /50x.html

        #

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

 

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80

        #

        #location ~ \.php$ {

        #    proxy_pass   http://127.0.0.1;

        #}

 

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

        #

        #location ~ \.php$ {

        #    root           html;

        #    fastcgi_pass   127.0.0.1:9000;

        #    fastcgi_index  index.php;

        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;

        #    include        fastcgi_params;

        #}

 

        # deny access to .htaccess files, if Apache‘s document root

        # concurs with nginx‘s one

        #

        #location ~ /\.ht {

        #    deny  all;

        #}

    }

 

 

    # another virtual host using mix of IP-, name-, and port-based configuration

    #

    server {

        listen       8000;

    #    listen       somename:8080;

    #    server_name  somename  alias  another.alias;

 

        location / {

            root   html;

            index  index.html index.htm;

        }

    }

 

 

    # HTTPS server

    #

    server {

        listen       443 ssl;

        server_name  localhost;

 

        ssl_certificate      server.crt;

        ssl_certificate_key  server.key;

 

        ssl_session_cache    shared:SSL:1m;

        ssl_session_timeout  5m;

 

        ssl_ciphers  HIGH:!aNULL:!MD5;

        ssl_prefer_server_ciphers  on;

 

        location / {

            root   html;

            index  index.html index.htm;

        }

    }

 

}

 

 

四、开启nginx 服务器

 

开启nginx服务器 和查看服务器状态

[root@localhost conf]# /usr/local/nginx/sbin/nginx

 

 

[root@localhost conf]# /usr/local/nginx/sbin/nginx -t

nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

 

关闭nginx 服务器

[root@localhost conf]# ps -aux | grep nginx

root     11821  0.0  0.0  46936  1168 ?        Ss   15:29   0:00 nginx: master process ./nginx

nobody   11822  0.0  0.0  49552  3552 ?        S    15:29   0:00 nginx: worker process

root     12229  0.0  0.0 112712   972 pts/0    S+   17:19   0:00 grep --color=auto nginx

[root@localhost conf]# kill 11821

[root@localhost conf]# ps -aux | grep nginx

root     12231  0.0  0.0 112712   968 pts/0    S+   17:19   0:00 grep --color=auto nginx

 

 

五、关闭CentOS防火墙

 

关闭CentOS防火墙

 

[root@localhost conf]#

[root@localhost conf]# systemctl stop firewalld          

[root@localhost conf]#

[root@localhost conf]# systemctl disable  firewalld

Removed symlink /etc/systemd/system/basic.target.wants/firewalld.service.

Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

 

六:客户端测试访问

 

大功告成:

  技术图片

 

CentOS使用nginx部署https服务

标签:yml   erro   www.   proxy   conf   null   pcr   proc   err   

原文地址:https://www.cnblogs.com/cnmumian/p/10659289.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!