nginx搭建https单向证书
一）默认情况下ssl模块并未被安装，如果使用该模块则需要在编译nginx的时指定--with-http_ssl_module参数。wget http://nginx.org/download/nginx-1.3.16.tar.gz
tar -xf nginx-1.3.16.tar.gz -C /usr/local/
cd /usr/local/nginx-1.3.16/
./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre
make
make install
http://192.168.254.103/ 测试
cd /usr/loca/nginx/conf进入到想创建证书和私钥的目录
# openssl genrsa -des3 -out server.key 1024 创建服务器私钥，输入一个口令
Enter pass phrase for server.key:123456
Verifying - Enter pass phrase for server.key:123456
# openssl req -new -key server.key -out server.csr 创建签名请求的证书（CSR）
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) :ChangPing
Organization Name (eg, company) :Leay
Organizational Unit Name (eg, section) []:Linux
Common Name (eg, your name or your server's hostname) []:ca.Leay.com
Email Address []:caadmin@Leay.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:Leay
在加载ssl支持的nginx并使用上述私钥时除去必须的口令：
#cp server.key server.key.org
# openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:123456
writing RSA key
最后标记证书使用上述私钥的CSR：
# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=ChangPing/O=Leay/OU=Linux/CN=ca.Leay.com/emailAddress=caadmin@Leay.com
Getting Private key
修改nginx的配置文件，让其包含新标记的证书和私钥
server {
listen 80;
server_namewww.bill.com;
#charset koi8-r;
#access_loglogs/host.access.logmain;
location / {
root html;
indexindex.html index.htm;
}
# HTTPS server
#
server {
listen 443;
server_namewww.bill.com;
ssl on;
ssl_certificate /usr/local/nginx/conf/server.crt;
ssl_certificate_key/usr/local/nginx/conf/server.key;
# ssl_session_timeout5m;
# ssl_protocolsSSLv2 SSLv3 TLSv1;
# ssl_ciphersHIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
location / {
root html;
indexindex.html index.htm;
}
}
}
重启nginx
# /usr/local/nginx/sbin/nginx -s> 物理机访问的时候需要在本地的hosts文件中添加域名的解析
http://www.bill.com 访问的是80端口
通过https://www.bill.com访问的是443端口
页:
[1]