一、场景简介
某些场景中,我们需要保证业务的安全可靠,因此难免需要使用HTTPS加密保护数据,但是除了在公网做SSL加密之外,内网之间的传输加密倒是意义不大,因此nginx的SSL加密负载就可以派上用场了
二、拓扑
三、配置
1.配置自签名CA,并且给服务器证书签名
配置CA
#cd /etc/pki/CA 1.为CA生成i一个私钥 #(umask 077;openssl genrsa -out private/cakey.pem 2048) 2.生成自签名证书 openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 touch index.txt echo 01>serial
申请证书,并签名
# cd /etc/nginx/ # mkdir ssl # cd ssl 1.用户生成自己的私钥 #(umask 077;openssl genrsa 1024 >nginx.pri) 2.生成证书签署请求 # openssl req -new -key nginx.pri -out nginx.csr 3.CA为签署请求签名 # openssl ca -in nginx.csr -out nginx.crt -days 365
2.开启路由转发
# vi /etc/sysctl.conf net.ipv4.ip_forward = 1 # sysctl -p
3.配置nginx的配置文件 /etc/nginx.conf
#user nobody; worker_processes 3; #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; #pid logs/nginx.pid; events { use epoll; worker_connections 1024; } http { include mime.types; default_type application/octet-stream; #log_format main ‘$remote_addr - $remote_user [$time_local] "$request" ‘ # ‘$status $body_bytes_sent "$http_referer" ‘ # ‘"$http_user_agent" "$http_x_forwarded_for"‘; #access_log logs/access.log main; sendfile on; #tcp_nopush on; #keepalive_timeout 0; keepalive_timeout 65; #gzip on; server { listen 80; server_name localhost; #charset koi8-r; #access_log logs/host.access.log main; location / { root /var/www/html; index index.html index.htm; } #error_page 404 /404.html; error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } ###################具体配置################################# upstream https { #定义upstream模块 least_conn; #调度算法 server 192.168.112.131:80 weight=2 max_fails=4 fail_timeout=1; # server 127.0.0.1:80 backup; #本地作为备份服务器 } # HTTPS server # server { listen 443 ssl; server_name localhost; ssl_certificate ssl/nginx.crt; #证书位置 ssl_certificate_key ssl/nginx.pri; #私钥位置 ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location / { proxy_pass # 反向负载 add_header Real-Server $upstream_addr; ##响应报文添加rs地址 } } }
4.配置RS服务器
略
四、测试
本文出自 “Lu2Yu” 博客,请务必保留此出处http://lu2yu.blog.51cto.com/10009517/1626478
原文地址:http://lu2yu.blog.51cto.com/10009517/1626478