vlambda博客
学习文章列表

yum install -y gcc gcc-c++ autoconf automake make zlib zlib-devel openssl openssl-devel pcre pcre-devel

tar -xf nginx-1.13.6.tar.gzcd nginx-1.13.6./configure --prefix=/usr/local/nginx --with-pcre --with-http_stub_status_module --with-http_gzip_static_module --with-http_ssl_modulemake && make install

[root@localhost ~]# yum install nginx -y #默认yum安装已经支持SSL，如果是自己编译的可以通过 nginx -V 查看当前Nginx是否支持SSL[root@localhost ~]# cd /etc/nginx/[root@localhost nginx]# mkdir ssl[root@localhost nginx]# cd ssl/

[root@localhost ssl]# openssl genrsa -des3 -out nginx.key 1024 #实际使用中看服务器性能，如果足够好也可以使用4096位秘钥Generating RSA private key, 1024 bit long modulus.......++++++...++++++e is 65537 (0x10001)Enter pass phrase for nginx.key: #输入密码，自定义，不少于4个字符Verifying - Enter pass phrase for nginx.key: #确认密码

[root@localhost ssl]# openssl req -new -key nginx.key -out nginx.csrEnter pass phrase for nginx.key: #输入刚刚创建的秘密码You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:CN #国家名称State or Province Name (full name) []:ShangHai #省Locality Name (eg, city) [Default City]:ShangHai #市Organization Name (eg, company) [Default Company Ltd]:ACBC #公司Organizational Unit Name (eg, section) []:Tech #部门Common Name (eg, your name or your server's hostname) []:*.mydomain.com #注意，此处应当填写你要部署的域名，如果是单个则直接添加即可，如果不确定，使用*，表示可以对所有mydomain.com的子域名做认证Email Address []:[email protected] #以域名结尾即可
Please enter the following 'extra' attributesto be sent with your certificate request A challenge password []: #是否设置密码，可以不写直接回车 An optional company name []: #其他公司名称 可不写

[root@localhost ssl]# openssl rsa -in nginx.key -out nginx_nopass.keyEnter pass phrase for nginx.key: #之前RSA秘钥创建时的密码writing RSA key

[root@localhost ssl]# openssl x509 -req -days 3650 -in nginx.csr -signkey nginx.key -out nginx.crt Signature oksubject=/C=CN/ST=ShangHai/L=ShangHai/O=ACBC/OU=Tech/CN=*.mydomain.com/[email protected]Getting Private keyEnter pass phrase for nginx.key: #RSA创建时的密码

# For more information on configuration, see:# * Official English Documentation: http://nginx.org/en/docs/# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;worker_processes auto;error_log /var/log/nginx/error.log;pid /run/nginx.pid;# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.include /usr/share/nginx/modules/*.conf;
events { worker_connections 1024;}
http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main;
 sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048;
 include /etc/nginx/mime.types; default_type application/octet-stream;
 include /etc/nginx/conf.d/*.conf; server { listen 80 default_server; listen [::]:80 default_server; server_name test.mydomain.com; #配置自己的域名 注意要以自己申请证书时填写的域名一致 root /usr/share/nginx/html;
 # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf;
 location / { }
 error_page 404 /404.html; location = /40x.html { }
 error_page 500 502 503 504 /50x.html; location = /50x.html { } }
# Settings for a TLS enabled server. server { listen 443 ssl http2 default_server; listen [::]:443 ssl http2 default_server; server_name test.mydomain.com; #与申请时的域名保持一致，否则会报错 root /usr/share/nginx/html;
 ssl_certificate "/etc/nginx/ssl/nginx.crt"; # ssl_certificate_key "/etc/nginx/ssl/nginx_nopass.key"; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;
 # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf;
 location / { }
 error_page 404 /404.html; location = /40x.html { }
 error_page 500 502 503 504 /50x.html; location = /50x.html { } }
}

ssl_certificate证书 其实是个公钥，它会被发送到连接服务器的每个客户端，ssl_certificate_key私钥是用来解密的，所以它的权限要得到保护但nginx的主进程能够读取。当然私钥和证书可以放在一个证书文件中，这种方式也只有公钥证书才发送到client。ssl_session_timeout 客户端可以重用会话缓存中ssl参数的过期时间，内网系统默认5分钟太短了，可以设成30m即30分钟甚至4h。ssl_protocols指令 用于启动特定的加密协议，nginx在1.1.13和1.0.12版本后默认是ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2，TLSv1.1与TLSv1.2要确保OpenSSL >= 1.0.1 ，SSLv3 现在还有很多地方在用但有不少被攻击的漏洞。ssl_ciphers 选择加密套件，不同的浏览器所支持的套件（和顺序）可能会不同。这里指定的是OpenSSL库能够识别的写法，你可以通过 openssl -v cipher ‘RC4:HIGH:!aNULL:!MD5’（后面是你所指定的套件加密算法） 来看所支持算法。ssl_prefer_server_ciphers on 设置协商加密算法时，优先使用我们服务端的加密套件，而不是客户端浏览器的加密套件。

[root@localhost nginx]# nginx -tnginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful[root@localhost nginx]# echo "This test page" > /usr/share/nginx/html/test.html #创建一个测试页面[root@localhost nginx]# systemctl restart nginx

server { listen 80 default_server; listen [::]:80 default_server; server_name test.mydomain.com; root /usr/share/nginx/html;
 # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; return 301 https://$server_name$request_uri; #在80监听端口 配置跳转

[root@localhost nginx]# cd /mnt/[root@localhost mnt]# tar xf apache-tomcat-7.0.96.tar.gz [root@localhost mnt]# cd apache-tomcat-7.0.96/bin/[root@localhost bin]# ./startup.sh [root@localhost bin]# curl -I http://172.16.150.132:8080 #如果在他为200 OK则正常

[root@localhost bin]# cd /etc/nginx/[root@localhost nginx]# vim nginx.conf server { listen 443 ssl http2 default_server; listen [::]:443 ssl http2 default_server; server_name test.mydomain.com; root /usr/share/nginx/html;
 ssl_certificate "/etc/nginx/ssl/nginx.crt"; ssl_certificate_key "/etc/nginx/ssl/nginx_nopass.key"; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;
 # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf;
 location / { proxy_pass http://localhost:8080; #使用proxy_pass 直接代理 }

[root@localhost bin]# cd /etc/nginx/[root@localhost nginx]# vim nginx.conf[root@localhost nginx]# systemctl restart nginx

[root@localhost nginx]# vim nginx.conf location / { #删除之前的8080代理 index index.html index.htm; }
 location ~ \.(jsp|jspx|do|action)(\/.*)?$ { proxy_set_header real_ip $remote_addr; proxy_pass http://localhost:8080; }
[root@localhost nginx]# nginx -t[root@localhost nginx]# systemctl restart nginx

proxy_set_header Host $http_host; #避免http请求中丢失Host头部的情况下Host不被重写的失误proxy_set_header X-Forwarded-For $http_x_forwarded_for; #代表客户端，也就是HTTP的请求端真实的IPproxy_set_header X-Real-IP $remote_addr; #将$remote_addr的值放进变量X-Real-IP中，此变量名可变，$remote_addr的值为客户端的ipadd_header Access-Control-Allow-Origin *; #表示允许访问的外域请求add_header Access-Control-Allow-Headers X-Requested-With; #首部字段用于预检请求的响应。其指明了实际请求中允许携带的首部字段。add_header Access-Control-Allow-Methods GET,POST,OPTIONS; #首部字段用于预检请求的响应。其指明了实际请求所允许使用的 HTTP 方法。add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"; #防止中间人攻击add_header X-Frame-Options:ALLOW-FROM http://www.growingio.com; # 避免点击劫持 (clickjacking) 的攻击add_header X-Content-Type-Options nosniff; #不允许浏览器任何猜测的行为
ssi on; #开启SSIssi_silent_errors on;ssi_types *;
proxy_redirect http:// $scheme://; #修改从被代理服务器传来的应答头中的"Location"和"Refresh"字段，将http修改为httpsport_in_redirect on; #告诉nginx，遇到跳转的时候，不要加上自己的端口号
#可配置参数由openssl 的ciphers定义  openssl ciphers -v #查看支持的配置参数ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_stapling on; #启用或禁用 服务器对OCSP响应的装订 #检验证书合法性的在线查询服务  ssl_stapling_verify on; #启用或禁用服务器对OCSP响应的验证
#如果启用了ssl_stapling，则以file PEM格式 指定具有受信任CA证书的证书，用于验证客户端证书和OCSP响应。顺序为 站点证书、中间证书（1张或多张）、根证书ssl_trusted_certificate /path/to/file;
#使用Diffie-Hellman方法让访问者的浏览器和服务器安全的交换密钥  #使用 openssl dhparam -out /usr/ssl/dhparam.pem 2048 命令生成需要的pem文件 其中默认为1024位ssl_dhparam /etc/ssl/certs/dhparam.pem;

#!/usr/bin/env bashfunction verified_for_certificate(){ host=$1 port=${2:-"443"}
 end_date=`echo | timeout 6 openssl s_client -servername ${host} -connect ${host}:${port} 2>/dev/null | openssl x509 -noout -dates | grep notAfter | awk -F "=" '{print $NF}'`
 if [ -n "$end_date" ]; then # 把时间转换为时间戳 end_date_seconds=`date '+%s' --date "$end_date"` # 获取当前时间 now_seconds=`date '+%s'` valid_days=$(echo "($end_date_seconds-$now_seconds)/24/3600" | bc) echo "${host}剩余有效期天数为：${valid_days}天" fi}
function main(){ verified_for_certificate $1 $2}

main $1 $2

server { listen 80 default_server; listen [::]:80 default_server; server_name c.a.com;
 #charset koi8-r; #access_log /var/log/nginx/log/host.access.log main;
 root /usr/share/nginx/c.a.com/public; index index.php index.html index.htm;
 return 301 https://$server_name$request_uri; #在80监听端口 配置跳转
 client_max_body_size 80m;
 location / { if (!-e $request_filename) { rewrite ^(.*)$ /index.php?s=/$1 last; break; } client_max_body_size 50m; }
 location /img { proxy_pass http://172.17.0.3/img; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_redirect off; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
 #error_page 404 /404.html; #redirect server error pages to the static page /50x.html
 error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; }
 # error_page 404 /404.html; # location = /40x.html { # } # # error_page 500 502 503 504 /50x.html; # location = /50x.html { # }

 location ~\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; client_max_body_size 50m; fastcgi_buffer_size 64k; fastcgi_buffers 8 64k; }}

# Settings for a TLS enabled server.server { listen 443 ssl http2 default_server; listen [::]:443 ssl http2 default_server; server_name c.a.com;
 #charset koi8-r; #access_log /var/log/nginx/log/host.access.log main;
 ssl_certificate "/etc/nginx/ssl/nginx.crt"; ssl_certificate_key "/etc/nginx/ssl/nginx_nopass.key"; ssl_session_cache shared:SSL:1m; ssl_session_timeout 10m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; ssl_protocols TLSv1.2;
 root /usr/share/nginx/c.a.com/public; index index.php index.html index.htm;
 client_max_body_size 80m;
 location / { #allow 192.168.11.54; ##allow 33.56.32.1/100; #deny all; if (!-e $request_filename) { rewrite ^(.*)$ /index.php?s=/$1 last; break; } client_max_body_size 50m; }
 location /img { proxy_pass http://172.17.0.3/img; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_redirect off; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
 #error_page 404 /404.html; #redirect server error pages to the static page /50x.html
 error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; }
 # error_page 404 /404.html; # location = /40x.html { # } # # error_page 500 502 503 504 /50x.html; # location = /50x.html { # }

 location ~\.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; client_max_body_size 50m; fastcgi_buffer_size 64k; fastcgi_buffers 8 64k; }}