系统环境
我使用的是一台刚安装的干净环境的centos7.9系统，这样实验环境可以更加纯净，LNMP环境全部为yum方式安装，简单快捷省事。
实验目的
将一个aaa.com的域名配置为https，并且实现http到https的跳转
申请证书
1、上腾讯云申请一个免费的SSL证书，在控制台搜索SSL证书，然后验证下网站的所有权，一个是DNS验证一个是文件验证，我采用文件验证，直接在Web网站根目录编辑一个文件进行验证,过几分钟就会收到短信提示，然后去把那个压缩包下载下来上传到网站就好了。
2、利用OpenSSL自己生成一个SSL证书，这个证书不被浏览器认可有风险提示，需要点击高级，接受风险并继续。
本次实验采用第2种方法
新建一个目录用来存放接下来的3个文件
mkdir SSL cd SSL
生成一个key
openssl genrsa -out server.key 2048
生成一个秘钥，运行这一步需要输入很多信息，包括国家、省份、城市、公司组织、部门、名称、密码、邮箱之类的，可以随意填，反正测试用途。
openssl req -new -key server.key -out csr.pem
生成一个一年有效期的crt证书
openssl x509 -req -days 365 -in csr.pem -signkey server.key -out server.crt
验证一下你的证书都有哪些信息，基本就是第2步你刚输入的那些
[root@aaa SSL]# ls csr.pem server.crt server.key
至此，私有证书就算有了
配置http
基本和搭建LNMP环境一样，可以不用安装数据库
先配置域名解析，把aaa.com解析到centos7的IP地址上，可以自己用局域网DNS服务器配置，也可以直接修改hosts文件
echo 10.10.10.34 aaa.com www.aaa.com >> /etc/hosts
以下是我的nginx 80端口配置文件，不要动默认的nginx.conf文件，我在conf.d下新建一个配置文件
cd /etc/nginx/conf.d/ vim aaa.conf
server {
listen 80;
listen [::]:80;
server_name aaa.com www.aaa.com;
root /usr/share/nginx/html/aaa;
index index.html index.htm index.php;
#开启php支持
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /$document_root$fastcgi_script_name;
include fastcgi_params;
}
}测试配置，没问题就重载nginx
nginx -t nginx -s reload
创建php测试文件
vi /usr/share/nginx/html/index.php
<?php phpinfo(); ?>
接着查看web的头文件
[root@aaa conf.d]# curl --head aaa.com HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 09 Jul 2023 07:19:22 GMT Content-Type: text/html Connection: keep-alive X-Powered-By: PHP/5.4.16
可以看到获取成功，用centos7的浏览器输入aaa.com应该就可以看到php测试文件了
配置https
这两个文件是你刚才生成的crt文件，要写绝对路径
ssl_certificate "/usr/share/nginx/html/aaa/ssl/server.crt"; ssl_certificate_key "/usr/share/nginx/html/aaa/ssl/server.key";
下面是我配置好的https，直接添加到aaa.conf文件的http配置后面
#https配置，与http模块并列
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name aaa.com www.aaa.com;
root /usr/share/nginx/html/aaa;
index index.html index.htm index.php;
ssl_certificate "/usr/share/nginx/html/aaa/ssl/server.crt";
ssl_certificate_key "/usr/share/nginx/html/aaa/ssl/server.key";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
#开启php支持
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /$document_root$fastcgi_script_name;
include fastcgi_params;
}
}测试配置，没问题就重载nginx
nginx -t nginx -s reload
此时再次测试https的访问
[root@aaa conf.d]# curl -I https://aaa.com curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.
此时也能看到信息说明https配置好了，但是由于自建的私有crt证书，不被浏览器认可，但至少配置没问题了，网址已经是https开头了，点那个Advanced高级，接受并继续就好了
配置跳转
跳转就在aaa.conf加一条配置就好了
vim aaa.conf nginx -t nginx -s reload
加这条到http的server配置里面
return 301 https://$server_name$request_uri;
完整版的conf文件如下
[root@aaa conf.d]# cat aaa.conf
server {
listen 80;
listen [::]:80;
server_name aaa.com www.aaa.com;
root /usr/share/nginx/html/aaa;
index index.html index.htm index.php;
return 301 https://$server_name$request_uri;
#开启php支持
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /$document_root$fastcgi_script_name;
include fastcgi_params;
}
}
#https配置，与http模块并列
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name aaa.com www.aaa.com;
root /usr/share/nginx/html/aaa;
index index.html index.htm index.php;
ssl_certificate "/usr/share/nginx/html/aaa/ssl/server.crt";
ssl_certificate_key "/usr/share/nginx/html/aaa/ssl/server.key";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
#开启php支持
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /$document_root$fastcgi_script_name;
include fastcgi_params;
}
}查看结果，明显已经变成了https
centos7火狐浏览器也正常跳转了
两点要注意：
1、在conf.d目录下新建aaa.conf配置文件，不动主配置文件不操作全局
2、先配置http，再配置https，还没开始配置跳转的时候，http和https应该是都可以独立访问的。
另外还有一个静态化的配置贴一下，对于已经部署好的网站需要静态化的有用
server {
listen 80;
server_name alex123.cn www.alex123.cn;
root /usr/share/nginx/html/x;
index index.html index.htm index.php;
client_max_body_size 300m;
client_body_timeout 120;
#配置http跳转https
return 301 https://$server_name$request_uri;
#rewrite ^(.*) https://$server_name$1 permanent;
#配置php支持
location ~\.php$ {
#fastcgi_pass unix:/run/php/php7.0-fpm.sock;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
#开启re_write模块，也就是伪静态
if (-f $request_filename/index.html){
rewrite (.*) $1/index.html break;
}
if (-f $request_filename/index.php){
rewrite (.*) $1/index.php;
}
if (!-f $request_filename){
rewrite (.*) /index.php;
}
}
#配置https，这个server与80同级别
server {
listen 443 http2 ssl default_server;
server_name alexp123.cn wwww.alex123.cn;
root /usr/share/nginx/html/;
index index.html index.htm index.php;
client_max_body_size 300m;
client_body_timeout 120;
#配置php支持
location ~\.php$ {
#fastcgi_pass unix:/run/php/php7.0-fpm.sock;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
#开启re_write模块，也就是伪静态
if (-f $request_filename/index.html){
rewrite (.*) $1/index.html break;
}
if (-f $request_filename/index.php){
rewrite (.*) $1/index.php;
}
if (!-f $request_filename){
rewrite (.*) /index.php;
}
#配置https证书，主要是上面两行，要写绝对路径
ssl_certificate /usr/share/nginx/html/ssl/alex.crt;
ssl_certificate_key /usr/share/nginx/html/ssl/alex.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
}
发表评论