圆月山庄资源网 Design By www.vgjia.com
Nginx的SSL证书配置
1、使用openssl实现证书中心
由于是使用openssl架设私有证书中心,因此要保证以下字段在证书中心的证书、服务端证书、客户端证书中都相同
Country Name State or Province Name Locality Name Organization Name Organizational Unit Name Country Name State or Province Name Locality Name Organization Name Organizational Unit Name
编辑证书中心配置文件
vim /etc/pki/tls/openssl.cnf
[ CA_default ] dir = /etc/pki/CA certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. #unique_subject = no # Set to 'no' to allow creation of # several ctificates with same subject. new_certs_dir = $dir/newcerts # default place for new certs. certificate = $dir/cacert.pem # The CA certificate serial = $dir/serial # The current serial number crlnumber = $dir/crlnumber # the current crl number # must be commented out to leave a V1 CRL crl = $dir/crl.pem # The current CRL private_key = $dir/private/cakey.pem# The private key RANDFILE = $dir/private/.rand # private random number file [ req_distinguished_name ] countryName = Country Name(2 letter code) countryName_default = CN countryName_min = 2 countryName_max = 2 stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = FJ localityName = Locality Name (eg, city) localityName_default = FZ 0.organizationName = Organization Name (eg, company) 0.organizationName_default = zdz organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = zdz
创建证书私钥
cd /etc/pki/CA/private
(umask 077;openssl genrsa -out cakey.pem 2048
)
生成自签证书
cd /etc/pki/CA/ openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days=3655
mkdir /usr/local/nginx/ssl cd /usr/local/nginx/ssl
(umask 077;openssl genrsa -out nginx.key 1024)
openssl req -new -key nginx.key -out nginx.csr openssl ca -in nginx.csr -out nginx.crt -days=3650
3、创建客户端浏览器证书
(umask 077;openssl genrsa -out client.key 1024)
openssl req -new -key client.key -out client.csr openssl ca -in client.csr -out client.crt -days=3650
将文本格式的证书转换成可以导入浏览器的证书
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
4、配置nginx服务器验证
vim /usr/local/nginx/conf/nginx.conf
ssl on; ssl_certificate /usr/local/nginx/ssl/nginx.crt; ssl_certificate_key /usr/local/nginx/ssl/nginx.key; ssl_client_certificate /usr/local/nginx/ssl/cacert.pem; ssl_session_timeout 5m; #ssl_verify_client on; 服务器验证客户端,暂时不开启,让没有证书的客户端可以访问,先完成单向验证 ssl_protocols SSLv2 SSLv3 TLSv1;
SSL反向代理
1.修改nginx.conf配置
server { listen 443 ssl; server_name www.jb51.net; ssl_certificate ssl/www.jb51.net.crt; ssl_certificate_key ssl/www.jb51.net.key; ssl_prefer_server_ciphers on; keepalive_timeout 60; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; location / { proxy_pass https://www.jb51.net; proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; proxy_set_header Accept-Encoding ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; add_header Front-End-Https on; proxy_redirect off; } }
2.重启服务
# /usr/local/nginx/sbin/nginx -t # /usr/local/nginx/sbin/nginx -s reload
圆月山庄资源网 Design By www.vgjia.com
广告合作:本站广告合作请联系QQ:858582 申请时备注:广告合作(否则不回)
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件! 如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件! 如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
圆月山庄资源网 Design By www.vgjia.com
暂无评论...
更新日志
2024年09月20日
2024年09月20日
- 魏新雨《为你祈祷+新歌精逊2CD[WAV]
- 影心、明萨拉你选哪个?国外美女COS《博德3》
- 澳洲女子骑车跌入“自杀树”丛 疼痛持续9个月崩溃
- 育碧公布2024“她创力”计划:为女性游戏人提供辅导
- 刘美君.2017-千色·30总选3CD【环球】【WAV+CUE】
- 群星.2022-星河长明电视原声带【乐有奇思】【FLAC分轨】
- 陈淑桦.1995-淑桦盛开Forever【滚石】【WAV+CUE】
- 《再来一张》评测:出师成败皆系“赌”
- 《银河汉堡店》测评:我是银河走菜王!
- 《末日地带2》评测:酣畅淋漓的“和面”之旅
- 萧煌奇《没事的》[320K/MP3][96.22MB]
- 萧煌奇《没事的》[FLAC/分轨][263.38MB]
- 群星《音你而来 第6期》[320K/MP3][90.61MB]
- 交错战线爬塔攻略一览
- 战锤40K星际战士2全近战武器使用教学|近战武器连招表