國密Nginx容器實戰
阿新 • • 發佈：2021-09-14
國密Nginx容器實戰
1.背景
目前國密SSL（TLCP）已經逐步開始推廣並實際使用，國密SSL實驗室（www.gmssl.cn）提供了國密版OpenSSL，並且可以與Nginx整合，可以比較方便的搭建國密SSL反向代理或者國密SSL伺服器。
國密SSL實驗室並沒有提供Docker的樣例，考慮到Docker的廣泛性，本文描述了在Docker裡面部署國密SSL的Nginx的的完整構建過程，僅供學習和參考之用。
執行環境為Centos7 X86_64。
2.安裝docker
#安裝docker 17.03.0 #安裝docker依賴三個yum源:Base,Extras,docker-ce [root@localhost ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo [root@localhost ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo [root@localhost ~]# wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo #重新生成yum快取 [root@localhost ~]# yum clean all [root@localhost ~]# yum makecache #安裝docker所需依賴包 [root@localhost ~]# yum -y install https://mirrors.aliyun.com/docker-ce/linux/centos/7/x86_64/stable/Packages/docker-ce-selinux-17.03.0.ce-1.el7.centos.noarch.rpm #安裝docker [root@localhost ~]# yum -y install docker-ce-17.03.0.ce-1.el7.centos
3.配置映象加速
[root@localhost ~]# mkdir /etc/docker
[root@localhost ~]# cat > /etc/docker/daemon.json<<EOF
> {
> "registry-mirrors": ["https://si7y70hh.mirror.aliyuncs.com"]
> }
> EOF
[root@localhost ~]# systemctl enable --now docker
4.準備容器環境
#拉取centos映象 [root@localhost ~]# docker pull centos:centos7.9.2009 #執行容器 [root@localhost ~]# docker run -itd --name nginx centos:centos7.9.2009 [root@localhost ~]# docker exec -it nginx /bin/bash [root@308fdeaaa058 /]# yum -y install wget gcc make pcre-devel [root@308fdeaaa058 ~]# wget http://nginx.org/download/nginx-1.20.1.tar.gz [root@308fdeaaa058 ~]# tar xf nginx-1.20.1.tar.gz
5.編譯nginx
下載gmssl_openssl_1.1_b4.tar.gz與nginx（參見資源與下載），然後編譯。
[root@308fdeaaa058 ~]# exit [root@localhost ~]# ls anaconda-ks.cfg gmssl_openssl_1.1_b4.tar.gz #把下載好的gmssl包拷貝到容器裡 [root@localhost ~]# docker cp gmssl_openssl_1.1_b4.tar.gz nginx:/root/ [root@localhost ~]# docker exec -it nginx /bin/bash [root@308fdeaaa058 /]# cd [root@308fdeaaa058 ~]# tar xf gmssl_openssl_1.1_b4.tar.gz -C /usr/local/ [root@308fdeaaa058 ~]# cd nginx-1.20.1 [root@308fdeaaa058 nginx-1.20.1]# vi auto/lib/openssl/conf #將將全部$OPENSSL/.openssl/修改為$OPENSSL/並儲存 #編譯配置 [root@308fdeaaa058 nginx-1.20.1]# ./configure \ > --without-http_gzip_module \ > --with-http_ssl_module \ > --with-http_stub_status_module \ > --with-http_v2_module \ > --with-file-aio \ > --with-openssl="/usr/local/gmssl" \ > --with-cc-opt="-I/usr/local/gmssl/include" \ > --with-ld-opt="-lm" [root@308fdeaaa058 nginx-1.20.1]# make install [root@308fdeaaa058 nginx-1.20.1]# ln -s /usr/local/nginx/sbin/nginx /usr/sbin/ #建立證書和子配置檔案目錄 [root@308fdeaaa058 nginx-1.20.1]# cd /usr/local/nginx/conf/ [root@308fdeaaa058 conf]# vi nginx.conf include /usr/local/nginx/conf/conf.d/*.conf; #將此條新增到http裡 [root@308fdeaaa058 conf]# mkdir ssl [root@308fdeaaa058 conf]# mkdir conf.d [root@308fdeaaa058 conf]# exit
6.製作映象
#編譯好的容器，打包成映象
[root@localhost ~]# docker commit nginx nginx
sha256:742fe82c7114f8272883f3f6a528fc62498cd5044b5ef942acd0bb4014a03467
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 742fe82c7114 8 seconds ago 489 MB
centos centos7.9.2009 8652b9f0cb4c 9 months ago 204 MB
#編寫Dockerfile
[root@localhost ~]# vim Dockerfile
[root@localhost ~]# cat Dockerfile
FROM nginx
LABEL version="1.0"
EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"]
#製作映象
[root@localhost ~]# docker build -t "gmssl_nginx" .
Sending build context to Docker daemon 6.277 MB
Step 1/4 : FROM nginx
---> 742fe82c7114
Step 2/4 : LABEL version "1.0"
---> Running in efef92a82f76
---> b4305df3867a
Removing intermediate container efef92a82f76
Step 3/4 : EXPOSE 80 443
---> Running in c7addc9e5623
---> 63050d82a45a
Removing intermediate container c7addc9e5623
Step 4/4 : CMD nginx -g daemon off;
---> Running in ed1b4c9789c8
---> 8dfbfa5182f9
Removing intermediate container ed1b4c9789c8
Successfully built 8dfbfa5182f9
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
gmssl_nginx latest 8dfbfa5182f9 About a minute ago 489 MB
nginx latest 742fe82c7114 4 minutes ago 489 MB
centos centos7.9.2009 8652b9f0cb4c 9 months ago 204 MB
7.啟動容器
生成國密雙證書（參見資源與下載）並配置nginx。
#配置目錄
[root@localhost ~]# cd conf.d/
[root@localhost conf.d]# cat ssl.conf
server
{
listen 0.0.0.0:443 ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECDHE-SM4-GCM-SM3;
ssl_verify_client off;
ssl_certificate /usr/local/nginx/conf/ssl/sm2.test.c.sig.crt.pem;
ssl_certificate_key /usr/local/nginx/conf/ssl/sm2.test.c.sig.key.pem;
ssl_certificate_key /usr/local/nginx/conf/ssl/sm2.test.c.enc.key.pem;
ssl_certificate /usr/local/nginx/conf/ssl/sm2.test.c.enc.crt.pem;
location /
{
root html;
index index.html index.htm;
}
}
[root@localhost conf.d]# cd
#證書目錄
[root@localhost ~]# cd sm2.test.c/
[root@localhost sm2.test.c]# ls
password.txt sm2.rca.pem sm2.test.c.enc.cer sm2.test.c.enc.key sm2.test.c.enc.key.crypted.bin sm2.test.c.enc.key.pem sm2.test.c.sig.cer sm2.test.c.sig.key sm2.test.c.sig.key.pem
sm2.oca.pem sm2.test.c.both.pfx sm2.test.c.enc.crt.pem sm2.test.c.enc.key.crypted.b64 sm2.test.c.enc.key.p8 sm2.test.c.enc.pfx sm2.test.c.sig.crt.pem sm2.test.c.sig.key.p8 sm2.test.c.sig.pfx
[root@localhost sm2.test.c]# cd
#啟動容器
[root@localhost ~]# docker run -itd -p 443:443 -v /root/sm2.test.c/:/usr/local/nginx/conf/ssl/ -v /root/conf.d/:/usr/local/nginx/conf/conf.d --name gmssl_nginx gmssl_nginx
[root@localhost ~]# docker logs -f gmssl_nginx
OpenSSL(GM version) by www.gmssl.cn. Test Only!!!
OpenSSL(GM version) by www.gmssl.cn. Test Only!!!
OpenSSL(GM version) by www.gmssl.cn. Test Only!!!
OpenSSL(GM version) by www.gmssl.cn. Test Only!!!
8.使用國密瀏覽器訪問
下載奇安信國密瀏覽器（參見資源與下載） 。
匯入國密根證書：開啟瀏覽器>設定>高階設定>證書管理>匯入證書。匯入證書鏈
修改本地解析：C:\Windows\System32\drivers\etc\hosts 。hosts檔案中加入解析地址
開啟瀏覽器訪問
9.完整的Dockerfile
容器已上傳dockerhub（參見資源與下載） 。
[root@localhost nginx]# ls
Dockerfile gmssl_openssl_1.1_b4.tar.gz nginx-1.20.1.tar.gz
[root@localhost nginx]# cat Dockerfile
FROM centos:centos7.9.2009 #基於centos7.9.2009映象
RUN yum install -y gcc make pcre-devel #安裝依賴環境包
ADD nginx-1.20.1.tar.gz /root/ #將原始碼複製到指定目錄，並解壓
ADD gmssl_openssl_1.1_b4.tar.gz /usr/local/
WORKDIR /root/nginx-1.20.1/ #為下面的指令指定執行目錄
RUN sed -in "s/\.openssl\///g" auto/lib/openssl/conf && \
./configure --without-http_gzip_module --with-http_ssl_module --with-http_stub_status_module --with-http_v2_module --with-file-aio --with-openssl="/usr/local/gmssl" --with-cc-opt="-I/usr/local/gmssl/include" --with-ld-opt="-lm" && \
make install && \
mkdir /usr/local/nginx/conf/conf.d && \
mkdir /usr/local/nginx/conf/ssl && \
sed -i '$i \ include /usr/local/nginx/conf/conf.d/*.conf;' /usr/local/nginx/conf/nginx.conf
EXPOSE 80 443 #宣告暴露埠
VOLUME ["/usr/local/nginx/conf/conf.d/","/usr/local/nginx/conf/ssl/"] #指定掛載點
CMD ["/usr/local/nginx/sbin/nginx","-g","daemon off;"] #為了保持nginx的容器不退出，關閉nginx後臺執行
[root@localhost nginx]# docker build -t gmssl_nginx:v1 . #使用當前目錄下的檔案構建標籤gmssl_nginx:v0的映象
10.資源與下載
1)國密版OpenSSL下載：
https://www.gmssl.cn/gmssl/Tool_Down?File=gmssl_openssl_1.1_b4.tar.gz
2)Nginx最新版下載：
http://nginx.org/download/nginx-1.20.1.tar.gz
3)國密雙證書生成：
https://www.gmssl.cn/gmssl/index.jsp?go=CA
4)奇安信國密瀏覽器下載：
https://www.gmssl.cn/gmssl/Tool_Down?File=qaxbrowser_1.1.32574.52_gmssl.exe
5)國密Nginx容器下載：
docker pull keyaas2021/gmssl_nginx:v1.0