技術標籤：nginxnginxhttps

目錄

一、生成ssl證書

二、準備nginx配置檔案

三、建立資料夾

四、建立nginx

五、測試

一、生成ssl證書

1.openssl生成私鑰檔案,並輸入密碼

[[email protected] home]# ll
總用量 0
drwxr-xr-x 4 root root 33 1月   4 15:13 es
drwxr-xr-x 6 root root 53 1月   5 16:57 nginx

[[email protected] home]# openssl genrsa -des3 -out server.key 2048
Generating RSA private key, 2048 bit long modulus
..........+++
..........................+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
 

2.去除口令

[[email protected] home]# mv server.key server.key.back

[[email protected] home]# openssl rsa -in server.key.back -out server.key
Enter pass phrase for server.key.back:
writing RSA key

3.建立請求證書

[[email protected] home]# openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:haidian
Organizational Unit Name (eg, section) []:zhongguancun
Common Name (eg, your name or your server's hostname) []:dream
Email Address []:
 
[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:zk

[[email protected] home]# ll
總用量 12
drwxr-xr-x 4 root root   33 1月   4 15:13 es
drwxr-xr-x 6 root root   53 1月   5 16:57 nginx
-rw-r--r-- 1 root root 1102 1月   6 11:09 server.csr
-rw-r--r-- 1 root root 1675 1月   6 11:06 server.key
-rw-r--r-- 1 root root 1743 1月   6 11:06 server.key.back
 

4.生成證書檔案

[[email protected] home]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=CN/ST=BeiJing/L=BeiJING/O=haidian/OU=zhongguancun/CN=dream/[email protected]
Getting Private key

5.檢視已經生成的檔案

[[email protected] home]# ll
總用量 16
drwxr-xr-x 4 root root   33 1月   4 15:13 es
drwxr-xr-x 6 root root   53 1月   5 16:57 nginx
-rw-r--r-- 1 root root 1285 1月   6 11:10 server.crt
-rw-r--r-- 1 root root 1102 1月   6 11:09 server.csr
-rw-r--r-- 1 root root 1675 1月   6 11:06 server.key
-rw-r--r-- 1 root root 1743 1月   6 11:06 server.key.back

二、準備nginx配置檔案

default.conf 內容如下:

server {
    listen       8081;
    #listen  [::]:8081;
    server_name  localhost;

    listen 443 ssl; #偵聽443埠，用於SSL
    # 注意檔案位置，是從/etc/nginx/下開始算起的
    #ssl  on;
    ssl_certificate ssl/server.crt;
    ssl_certificate_key ssl/server.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;

    # gzip config
    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 9;
    gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript applic
ation/x-httpd-php image/jpeg image/gif image/png;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
        try_files $uri $uri/ /index.html;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

三、建立資料夾

1.建立資料夾

[[email protected] nginx]# mkdir conf
[[email protected] nginx]# mkdir html
[[email protected] nginx]# mkdir logs
[[email protected] nginx]# mkdir ssl
[[email protected] nginx]# ll
總用量 0
drwxr-xr-x 3 root root 20 1月   5 16:57 conf
drwxr-xr-x 2 root root 24 1月   5 16:24 html
drwxr-xr-x 2 root root 41 1月   5 16:23 logs
drwxr-xr-x 2 root root 42 1月   6 10:25 ssl

2.將 default.conf 放入 /home/nginx/conf/conf.d 資料夾

[[email protected] nginx]# cd conf/conf.d
[[email protected] conf.d]# ll
總用量 4
-rw-r--r-- 1 root root 1840 1月   6 10:45 default.conf

3.將 server.crt 和 server.key 放入/home/nginx/ssl資料夾中

[[email protected] nginx]# cd ssl/
[[email protected] ssl]# ll
總用量 8
-rw-r--r-- 1 root root 1330 1月   5 17:03 server.crt
-rw-r--r-- 1 root root 1679 1月   5 17:02 server.key
[[email protected] ssl]# 

4.在/home/nginx/html放入專案或測試訪問檔案

四、建立nginx

1.拉取映象

docker pull nginx

2.建立容器

docker run --d --name newnginx \
-p 443:443 \
-p 8081:8081 \
--privileged=true \
-v /home/nginx/html:/usr/share/nginx/html:rw \
-v /home/nginx/conf/conf.d:/etc/nginx/conf.d:rw \
-v /home/nginx/logs:/var/log/nginx/:rw \
-v /home/nginx/ssl:/etc/nginx/ssl:rw \
-d nginx

五、測試

訪問https://192.168.51.187