Nginx配置4-Https網站設定
阿新 • • 發佈：2020-07-17
Nginx配置4 Https網站設定
1 檢查是否支援ssl模組
[root@nginx-node01 1.16.0]# ./nginx -V 2>&1 | sed 's/ /\n/g' |grep ssl
--with-http_ssl_module
如果nginx沒有http_ssl_module支援，則需要在編譯時加入ssl支援，具體參考：Shell編譯安裝nginx
2 配置Server
將公私鑰、CA證書生成中製作好的nginx-node01.crt證書檔案和nginx私鑰檔案放入ssl目錄
# HTTPS server #增加HTTP強制跳轉功能 server{ listen 80; server_name www.kov.com; return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name www.kov.com; ssl_certificate ssl/nginx-node01.crt; ssl_certificate_key ssl/nginx-node01.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location / { root html; index index.html index.htm; } }
3 客戶端設定域名
[root@ca CA]# echo 192.168.56.104 www.kov.com >> /etc/hosts [root@ca CA]# cat /etc/hosts ## # Host Database # # localhost is used to configure the loopback interface # when the system is booting. Do not change this entry. ## 127.0.0.1 localhost 255.255.255.255 broadcasthost ::1 localhost fe80::1%lo0 localhost ...... 192.168.56.104 www.kov.com
4 客戶端curl測試
客戶端新增證書前
[root@ca CA]# curl https://www.kov.com curl: (60) Peer's Certificate issuer is not recognized. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.
客戶端新增證書後
[root@ca CA]# curl --cacert cacert.pem https://www.kov.com
<!DOCTYPE html>
<html>
<head>
<title>Welcome to www.kov.com!</title>
</head>
<body>
<h1>Welcome to nginx ssl!</h1>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
5 客戶端瀏覽器驗證
1. NET::ERR_CERT_AUTHORITY_INVALID錯誤
解決方法：在keychain中將證書改為信任（下圖）
2. NET::ERR_CERT_COMMON_NAME_INVALID錯誤
解決方法：參考《公私鑰、證書生成》CA簽署證書中補充，重新CA簽署多域名證書後，重新在keychain中將證書改為信任。