要给项目装https,记录一下避免本身忘记。https在tomcat上也能够作,但缺点就是只给一个tomcat用,非专业的软件作了专业的事情,感受仍是nginx来配置更好些。
当咱们用客户端访问https网站时,这个客户端会生成对称密钥对咱们输入的数据进行加密。服务端会将nginx配置的公钥和私钥中的公钥下发给客户端,客户端用这个公钥来把对称密钥进行加密,而后传到服务端,服务端用私钥来解密获得对称密钥的密码而后再解密成明文。为何不直接用公钥来加密呢,由于若是传输大的文件用算法加密会很是的慢。nginx的https的默认端口时443
下面下载:php
wget http://zlib.net/zlib-1.2.11.tar.gz wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.39.tar.gz wget https://www.openssl.org/source/openssl-1.0.1t.tar.gz
上面三个是依赖包,都是先configure而后make,make install安装(没装编译工具的话 须要安装一下 yum -y install gcc gcc-c++
)html
wget http://nginx.org/download/nginx-1.9.0.tar.gz
安装 ./configure --prefix=/usr/local/nginx --with-http_ssl_module
报错找不到库文件nginx
yum -y install openssl openssl-devel
安装一下就能够了而后再make,make install。
也是同上面同样的安装方式,启动报错找不着库文件。去 /lib64 建立一下软链接 ln -s /lib64/libpcre.so.0.0.1 /lib64/libpcre.so.1
而后建个目录生成证书就能够了。
先生成一个私钥c++
openssl genrsa -des3 -out server.key 2048
再生成一个根证书算法
openssl req -new -key server.key -out server.csr
而后去除密码tomcat
cp server.key server.key.org openssl rsa -in server.key.org -out server.key
签署签名session
openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt
而后对文件进行配置就没问题了,必定要注意开启防火墙端口,443。app
#user nobody; worker_processes 1; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main; sendfile on; #tcp_nopush on; #keepalive_timeout 0; keepalive_timeout 65; #gzip on; server { listen 80; server_name localhost; #charset koi8-r; #access_log logs/host.access.log main; location / { proxy_pass https://127.0.0.1:8080/usso; } #error_page 404 /404.html; # redirect server error pages to the static page /50x.html # error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } # proxy the PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ { # proxy_pass http://127.0.0.1; #} # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # #location ~ \.php$ { # root html; # fastcgi_pass 127.0.0.1:9000; # fastcgi_index index.php; # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; # include fastcgi_params; #} # deny access to .htaccess files, if Apache's document root # concurs with nginx's one # #location ~ /\.ht { # deny all; #} } # HTTPS server # server { listen 443 ssl; # server_name localhost; ssl_certificate /usr/local/nginx/ssl/server.crt; ssl_certificate_key /usr/local/nginx/ssl/server.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #这三行是为了防止nessus检测支持中等算法漏洞 ssl_prefer_server_ciphers on; ssl_ciphers 'AES128+EECDH:AES128+EDH'; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; location / { proxy_pass http://127.0.0.1:8080; proxy_set_header X-Real-IP $remote_addr; #这两行是用来获取真实ip proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } server { listen 444 ssl; # server_name localhost; ssl_certificate /usr/local/nginx/ssl/server.crt; ssl_certificate_key /usr/local/nginx/ssl/server.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'AES128+EECDH:AES128+EDH'; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; location / { proxy_pass http://127.0.0.1:8081; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } server { listen 445 ssl; # server_name localhost; ssl_certificate /usr/local/nginx/ssl/server.crt; ssl_certificate_key /usr/local/nginx/ssl/server.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'AES128+EECDH:AES128+EDH'; # ssl_session_cache shared:SSL:1m; # ssl_session_timeout 5m; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; location / { proxy_pass http://127.0.0.1:8180; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } }