1，https證書生成

# 生成金鑰server.key，需要輸入密碼pass
openssl genrsa -des3 -out server.key 2048
# 去除server.key中的密碼，防止以後重複輸入
openssl rsa -in server.key -out server.key
# 建立伺服器證書的申請檔案server.csr
openssl req -new -key server.key -out server.csr
# 建立CA證書 ca.crt
openssl req -new -x509 -key server.key -out ca.crt -days 3650
 

# 建立自當前日期起有效期為期十年的伺服器證書server.crt
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey server.key -CAcreateserial -out server.crt

2，nginx配置

server {

  listen 443;
  server_name www.server.com;
  ssl on;
  ssl_certificate /path/to/server.crt;#配置證書位置
  ssl_certificate_key /path/to/server.key;#配置祕鑰位置
  #ssl_client_certificate ca.crt;#雙向認證
  #ssl_verify_client on; #雙向認證
  ssl_session_timeout 5m;
  ssl_protocols SSLv2 SSLv3 TLSv1;
  ssl_ciphers ALL:
 
!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
  ssl_prefer_server_ciphers on;
  location / {
            root   html;
            index  index.html index.htm;
        }

}