Nginx使用自签证书发布https网站

安装Nginx

# 更换阿里云yum源
yum install -y wget
mv /etc/yum.repos.d /etc/yum.repos.d.bak
mkdir yum.repos.d
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum makecache
# 安装nginx
yum install -y nginx
# 启动nginx
systemctl start nginx && systemctl enable nginx && systemctl status nginx
# curl测试
curl http://127.0.0.1

使用OpenSSL创建证书

# 创建nginx ca证书存放目录
mkdir -p /etc/pki/nginx
cd /etc/pki/nginx
# 生成秘钥和自签名证书，CN为服务器域名
openssl req -newkey rsa:4096 -nodes -sha512 -keyout ca.key -x509 -days 3650 -subj "/CN=mytest.com" -out ca.crt
# 生成证书签名请求
openssl req -newkey rsa:4096 -nodes -sha512 -keyout server.key -subj "/CN=mytest.com" -out server.csr
# 生成服务器证书
openssl x509 -req -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt

Nginx配置ssl

# 确认nginx可使用ssl模块
nginx -V 2>&1 |grep with-http_ssl_module -o
# 修改nginx.conf
vi /etc/nginx/nginx.conf

参考如下：

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80;
        listen       [::]:80;
        server_name  mytest.com www.mytest.com;             # 指定域名
        # https重定向
        return       301 https://www.mytest.com$request_uri;
    }

# Settings for a TLS enabled server.

    server {
        listen       443 ssl http2;
        listen       [::]:443 ssl http2;
        server_name  www.mytest.com;                        # 指定域名
        root         /usr/share/nginx/html;

        ssl_certificate "/etc/pki/nginx/server.crt";        # 指定自签证书文件
        ssl_certificate_key "/etc/pki/nginx/server.key";    # 指定自签证书文件
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

    # https重定向
    server {
        listen      443;
        server_name mytest.com;
        return      301 https://www.mytest.com$request_uri;
    }
}

测试验证

重启nginx

# 检查nginx配置
nginx -t
# 重启nginx
systemctl restart nginx
# 添加本地hosts，curl测试
echo "192.168.58.128 www.mytest.com mytest.com" >> /etc/hosts
curl http://www.mytest.com
curl -k https://www.mytest.com

浏览器访问测试

预期效果：以下任何形式的地址访问，均可跳转至 https://www.mytest.com

• http://mytest.com
• http://www.mytest.com
• https://mytest.com

参考链接

http://nginx.org/en/docs/http/converting_rewrite_rules.html