nginx结合openssl实现https的方法

在未使用ssl证书对服务器数据进行加密认证的情况下，用户的数据将会以明文的形式进行传输，这样一来使用抓包工具是可以获取到用户密码信息的，非常危险。而且也无法验证数据一致性和完整性，不能确保数据在传输过程中没被改变。所以网站如果有涉及用户账户等重要信息的情况下通常要配置使用ssl证书，实现https协议。

在生产环境中的ssl证书都需要通过第三方认证机构购买，分为专业版ov证书（浏览器地址栏上不显示企业名称）和高级版ev（可以显示企业名称）证书，证书所保护的域名数不同也会影响价格（比如只对www认证和通配*认证，价格是不一样的），且不支持三级域名。测试中可以自己作为证书颁发机构来制作证书，浏览器会显示为红色，代表证书过期或者无效，如果是黄色的话代表网站有部分连接使用的仍然是http协议。

不管使用哪种方法，在拿到证书后对nginx的配置都是一样的，所以这里以搭建openssl并制作证书来进行完整说明

一、准备环境

1）nginx服务

2）ssl模块

[root@ns3 ~]# systemctl stop firewalld
[root@ns3 ~]# iptables -f
[root@ns3 ~]# setenforce 0
[root@ns3 ~]# yum -y install pcre zlib pcre-devel zlib-devel
[root@ns3 ~]# tar xf nginx-1.16.0.tar.gz -c /usr/src/
[root@ns3 ~]#cd /usr/src/nginx-1.16.0
[root@ns3 ~]#./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_stub_status_module --with-http_ssl_module --with-http_flv_module --with-http_gzip_static_module&&make && make install #后续需要的模块一次性安装

3）检测openssl是否安装

[root@ns3 ~]# rpm -qa openssl 2 openssl-1.0.1e-42.el7.x86_64

若没有安装

[root@ns3 ~]# yum -y install openssl openssl-devel

二、创建根证书ca

1、生成ca私钥

[root@ns3 ~]# cd zhengshu/
[root@ns3 zhengshu]# openssl genrsa -out local.key 2048
generating rsa private key, 2048 bit long modulus
...........................................................................................................................................................................................................................+++
............................................................................................................................................................................................+++
e is 65537 (0x10001)
[root@ns3 zhengshu]# ls
local.key

　2、生成ca证书请求

[root@ns3 zhengshu]# openssl req -new -key local.key -out local.csr
you are about to be asked to enter information that will be incorporated
into your certificate request.
what you are about to enter is what is called a distinguished name or a dn.
there are quite a few fields but you can leave some blank
for some fields there will be a default value,
if you enter '.', the field will be left blank.
-----
country name (2 letter code) [xx]:cn  #国家
state or province name (full name) []:bj   #省份
locality name (eg, city) [default city]:bj  #城市
organization name (eg, company) [default company ltd]:
organizational unit name (eg, section) []:test   #部门
common name (eg, your name or your server's hostname) []:test   #主机名
email address []:[e-mail]  #邮箱

please enter the following 'extra' attributes
to be sent with your certificate request
a challenge password []:wuminyan  #密码
an optional company name []:wuminyan  #姓名
[root@ns3 zhengshu]# ls
local.csr  local.key

req: 这是一个大命令，提供生成证书请求文件，验证证书，和创建根ca
 -new: 表示新生成一个证书请求
 -x509: 直接输出证书
 -key: 生成证书请求时用到的私钥文件
 -out：输出文件

3、生成ca根证书

这个生成ca证书的命令会让人迷惑
1.通过秘钥 生成证书请求文件
2.通过证书请求文件 生成最终的证书
 -in 使用证书请求文件生成证书，-signkey 指定私钥，这是一个还没搞懂的参数
[root@ns3 zhengshu]# openssl x509 -req -in local.csr -extensions v3_ca -signkey local.key -out local.crt
signature ok
subject=/c=cn/st=bj/l=bj/o=default company ltd/ou=test/cn=test/emailaddress=[e-mail]
getting private key

三、根据ca证书创建server端证书

1、生成server私匙

[root@ns3 zhengshu]# openssl genrsa -out my_server.key 2048
generating rsa private key, 2048 bit long modulus
.................................+++
.........................................+++
e is 65537 (0x10001)
[root@ns3 zhengshu]# ls
local.crt  local.csr  local.key  my_server.key

2、生成server证书请求

[root@ns3 zhengshu]# openssl x509 -req -in local.csr -extensions v3_ca -signkey local.key -out local.crt
signature ok
subject=/c=cn/st=bj/l=bj/o=default company ltd/ou=test/cn=test/emailaddress=[e-mail]
getting private key
[root@ns3 zhengshu]# openssl genrsa -out my_server.key 2048
generating rsa private key, 2048 bit long modulus
.................................+++
.........................................+++
e is 65537 (0x10001)
[root@ns3 zhengshu]# openssl req -new -key my_server.key -out my_server.csr
you are about to be asked to enter information that will be incorporated
into your certificate request.
what you are about to enter is what is called a distinguished name or a dn.
there are quite a few fields but you can leave some blank
for some fields there will be a default value,
if you enter '.', the field will be left blank.
-----
country name (2 letter code) [xx]:cn
state or province name (full name) []:bj
locality name (eg, city) [default city]:bj
organization name (eg, company) [default company ltd]:
organizational unit name (eg, section) []:test
common name (eg, your name or your server's hostname) []:test
email address []:[e-mail]

please enter the following 'extra' attributes
to be sent with your certificate request
a challenge password []:wuminyan
an optional company name []:wuminyan
[root@ns3 zhengshu]# ls
local.crt  local.csr  local.key  my_server.csr  my_server.key

3、生成server证书

[root@ns3 zhengshu]# openssl x509 -days 365 -req -in my_server.csr -extensions v3_req -cakey local.key -ca local.crt -cacreateserial -out my_server.crt
 signature ok
 subject=/c=cn/st=bj/l=bj/o=default company ltd/ou=test/cn=test/emailaddress=[e-mail]
 getting ca private key

四、配置nginx支持ssl

[root@ns3 ~]# vim /etc/nginx.cof      #这里设置了一个软连接:lln -s /usr/local/nginx/sbin/nginx /usr/local/sbin/
server {
        listen 80;
        listen       443 default  ssl;  #监听433端口
                keepalive_timeout 100;  #开启keepalive 激活keepalive长连接，减少客户端请求次数

                   ssl_certificate      /root/zhengshu/local.crt;   #server端证书位置
                   ssl_certificate_key  /root/zhengshu/local.key;   #server端私钥位置

                        ssl_session_cache    shared:ssl:10m;         #缓存session会话
                        ssl_session_timeout  10m;                    # session会话    10分钟过期

                   ssl_ciphers  high:!anull:!md5;
                   ssl_prefer_server_ciphers  on;

        server_name   test.com;
        charset utf-8;

        location / {
            root   html;
            index  index.html index.htm;
        }

    }
}

五、测试

输入https：//192.168.200.115

到此这篇关于nginx结合openssl实现https的文章就介绍到这了,更多相关nginx实现https内容请搜索以前的文章或继续浏览下面的相关文章希望大家以后多多支持！