[root@web01 ~]# mkdir /etc/nginx/ssl_key
[root@web01 ~]# cd /etc/nginx/ssl_key/
3.造假证书
1）生成私钥
#使用openssl命令充当CA权威机构创建证书（生产不使用此方式生成证书，不被互联网认可的黑户证书）
[root@web01 ssl_key]# openssl genrsa -idea -out server.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
........+++
e is 65537 (0x10001)
Enter pass phrase for server.key: 123456
Verifying - Enter pass phrase for server.key: 123456
[root@web01 ssl_key]# ll
total 4
-rw-r--r--. 1 root root 1739 Dec 9 11:27 server.key
2）生成公钥
#生成自签证书(公钥)，同时去掉私钥的密码
[root@web01 ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
Generating a 2048 bit RSA private key
.....................................+++
............+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:china
string is too long, it needs to be less than 2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:meiguo
Locality Name (eg, city) [Default City]:riben
Organization Name (eg, company) [Default Company Ltd]:heishoudang
Organizational Unit Name (eg, section) []:oldboy
Common Name (eg, your name or your server's hostname) []:oldboy
Email Address []:123@qq.com
# req --> 用于创建新的证书
# new --> 表示创建的是新证书
# x509 --> 表示定义证书的格式为标准格式
# key --> 表示调用的私钥文件信息
# out --> 表示输出证书文件信息
# days --> 表示证书的有效期
# sha256 --> 加密方式
3）查看生成的证书
[root@web01 ssl_key]# ll
total 8
-rw-r--r--. 1 root root 1395 Dec 9 11:31 server.crt
-rw-r--r--. 1 root root 1708 Dec 9 11:31 server.key
4.配置证书语法
#1.开启证书
Syntax: ssl on | off;
Default: ssl off;
Context: http, server
#2.指定证书文件
Syntax: ssl_certificate file;
Default: —
Context: http, server
#3.指定私钥文件
Syntax: ssl_certificate_key file;
Default: —
Context: http, server
5.配置nginx证书
[root@web01 ~]# vim /etc/nginx/conf.d/linux.ssl.com.conf
server {
listen 443 ssl;
server_name linux.ssl.com;
ssl_certificate /etc/nginx/ssl_key/server.crt;
ssl_certificate_key /etc/nginx/ssl_key/server.key;
location / {
root /code;
index index.html;
}
}
[root@web01 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@web01 ~]# systemctl restart nginx
6.配置hosts访问
10.0.0.7 linux.ssl.com
访问：https://linux.ssl.com/
7.配置http自动跳转https
[root@web01 ~]# vim /etc/nginx/conf.d/linux.ssl.com.conf
server {
listen 443 ssl;
server_name linux.ssl.com;
ssl_certificate /etc/nginx/ssl_key/server.crt;
ssl_certificate_key /etc/nginx/ssl_key/server.key;
location / {
root /code;
index index.html;
}
}
server {
listen 80;
server_name linux.ssl.com;
rewrite (.*) https://$server_name$1;
#return 302 https://$server_name$request_uri;
}
[root@web01 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@web01 ~]# systemctl restart nginx
三、全站HTTPS
1.环境准备
主机
内网IP
外网IP
身份
lb01
172.16.1.4
10.0.0.4
负载均衡
web01
172.16.1.7
web服务器
web02
172.16.1.8
web服务器
2.配置web服务器
1）配置nginx
[root@web01 ~]# vim /etc/nginx/conf.d/linux.https.com.conf
server {
listen 80;
server_name linux.https.com;
location / {
root /code/https;
index index.html;
}
}
[root@web01 ~]# systemctl restart nginx
[root@web02 ~]# vim /etc/nginx/conf.d/linux.https.com.conf
server {
listen 80;
server_name linux.https.com;
location / {
root /code/https;
index index.html;
}
}
[root@web01 ~]# systemctl restart nginx