nginx接入let's encrypt

时间 2019-11-21

标签 nginx let's let encrypt 栏目 Nginx 繁體版

原文原文链接

按如下步骤：nginx

1、放开443端口git

个人是云服务器，默认没开放443端口，须要先在控制台放开github

2、使用let’s encrypt 生成证书服务器

执行如下命令：session

git clone https://github.com/letsencrypt/letsencrypt

cd letsencrypt/

./letsencrypt-auto certonly --standalone --email 123917244@qq.com -d coolfirer.com -d www.coolfirer.com

邮箱和域名换成本身的便可。spa

看到上图就说明成功，nginx用到fullchain.pem和privkey.pem两个。code

3、配置nginxserver

修改/etc/nginx/sites-available/default文件, 增长443端口blog

server {

    listen 443 ssl;

    server_name www.coolfirer.com coolfirer.com;

    ssl on;

    ssl_certificate /etc/letsencrypt/live/coolfirer.com/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/coolfirer.com/privkey.pem;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1;

    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;

    ssl_prefer_server_ciphers on;

    location / {

        proxy_pass http://127.0.0.1:8090;

        proxy_set_header Host $host;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}

同时，配置80端口跳转到443：ip

server {

    listen   80;

    server_name www.coolfirer.com coolfirer.com;

    return 301 https://$server_name$request_uri;

}

4、从新加载nginx

nginx -s reload