Nginx-https

1.检查当前环境
[root@localhost nginx]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

2.检查nginx是否有ssl模块
[root@localhost nginx]# nginx -V
--with-http_ssl_module

3.创建证书存放目录
[root@jxl ~]# mkdir -p /etc/nginx/ssl_key
[root@jxl ~]# cd /etc/nginx/ssl_key

4.使用openssl充当CA权威机构创建私钥，生产环境不能使用此方式生成证书，不被互联网CA认可
[root@localhost ssl_key]# openssl genrsa -idea -out know.key 2048 
Generating RSA private key, 2048 bit long modulus
.................................................+++
.........+++
e is 65537 (0x10001)
Enter pass phrase for know.key:           //输入认证密码
Verifying - Enter pass phrase for know.key:       //再次输入密码

5.生成自签证书，同时去掉私钥密码
[root@jxl ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout know.key -out know.crt
Generating a 2048 bit RSA private key
.........................................................................................+++
......................+++
writing new private key to 'know.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN      //国家
State or Province Name (full name) []:BJ    //州   
Locality Name (eg, city) [Default City]:CP      //城市
Organization Name (eg, company) [Default Company Ltd]:linux       //单位 
Organizational Unit Name (eg, section) []:edu   //主机名 
Common Name (eg, your name or your server's hostname) []:know.com   //域名
Email Address []:jxl@know.com   //邮箱

参数详解
req     用于创建新证书
newkey    表示创建的是新证书
x509    表示定义证书的格式是标准格式
keyout    表示调用的私钥文件信息
out     表示输出证书文件信息
days    表示证书的有效期

1.编辑站点配置文件
[root@localhost conf.d]# vim https_know.conf
#https_know
server {
  listen 443;
  server_name edu.know.com;
  ssl on;
  ssl_certificate ssl_key/know.crt;
  ssl_certificate_key ssl_key/know.key;

  location / {
    root /web;
    index index.html;
  }
}

2.注意事项，如果在检测语法提示如下内容,不过也不影响使用
nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/https_know.conf:4
处理方法：
编辑配置文件将ssl on一行删除，修改listen一行为listen 443 ssl;

3.重载服务
[root@localhost conf.d]# nginx -t 
[root@localhost conf.d]# systemctl reload nginx

实现方式1.
server {
        listen 443 ssl;
        server_name edu.know.com;
        ssl_certificate ssl_key/know.crt;
        ssl_certificate_key ssl_key/know.key;

        location / {
                root /web/know;
                index index.html;
        }
}

server {
        listen 80;
        server_name edu.know.com;
        rewrite .* https://edu.know.com;
}

方式2
rewrite .* https://$server_name$request_uri;

方式3
rewrite .* https://$host$request_uri;

方式4
rewrite (.*)  https://$server_name$1;

[root@localhost conf.d]# vim https_know.conf
server {
        listen 443 ssl;
        server_name edu.know.com;
        #ssl on;
        ssl_certificate ssl_key/know.crt;
        ssl_certificate_key ssl_key/know.key;

        location / {
                root /web/know;
                index index.html;
        }
}
server {
        listen 80;
        server_name know.com;
        rewrite (.*) https://edu.know.com;
}

1.shangmei.com
[root@localhost ~]# cd /etc/nginx/ssl_key/
[root@localhost ssl_key]# openssl genrsa -idea -out shangmei.key
[root@localhost ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout shangmei.key -out shangmei.crt

2.know.com
[root@localhost ~]# cd /etc/nginx/ssl_key/
[root@localhost ssl_key]# openssl genrsa -idea -out know.key
[root@localhost ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout know.key -out know.crt

1.shangmei.com
[root@localhost conf.d]# cat https_shangmei.conf 
#shangmei.com
server {
  listen 443 ssl;
  server_name gw.shangmei.com;
  ssl_certificate ssl_key/shangmei.crt;
  ssl_certificate_key ssl_key/shangmei.key;
  
  location / {
    root /web/shangmei;
    index index.html;
  }
}
[root@localhost conf.d]# cat https_know.conf 
#https_know
server {
  listen 443 ssl;
  server_name edu.know.com;
  #ssl on;
  ssl_certificate ssl_key/know.crt;
  ssl_certificate_key ssl_key/know.key;

  location / {
    root /web/know;
    index index.html;
  }
}

shangmei.com
[root@localhost conf.d]# cat https_shangmei.conf 
#shangmei.com
server {
  listen 443 ssl;
  server_name gw.shangmei.com;
  ssl_certificate ssl_key/shangmei.crt;
  ssl_certificate_key ssl_key/shangmei.key;
  
  location / {
    root /web/shangmei;
    index index.html;
  }
}

server {
  listen 80;
  server_name shangmei.com;
  rewrite (.*) https://gw.shangmei.com$1;
}

know.com
[root@localhost conf.d]# cat https_know.conf 
#https_know
server {
  listen 443 ssl;
  server_name edu.know.com;
  #ssl on;
  ssl_certificate ssl_key/know.crt;
  ssl_certificate_key ssl_key/know.key;

  location / {
    root /web/know;
    index index.html;
  }
}
server {
  listen 80;
  server_name know.com;
  rewrite (.*) https://edu.know.com;
}

web01
[root@jxl conf.d]# vim https_know.conf
#https_know
server {
        listen 80;
        server_name edu.know.com;
        #ssl on;
        #ssl_certificate ssl_key/know.crt;
        #ssl_certificate_key ssl_key/know.key;

        location / {
                root /web/know;
                index index.html;
        }
}

web02
[root@localhost conf.d]# vim https_know.conf
#https_know
server {
        listen 80;
        server_name edu.know.com;
        root /web/know;
        index index.html;
}

节点测试
[root@localhost conf.d]# echo "127.0.0.1 edu.know.com" > /etc/hosts
[root@localhost conf.d]# curl edu.know.com | less

1.开启rewrite日志
[root@localhost conf.d]# vim ../nginx.conf
http {
  .....
  error_log  /var/log/nginx/error.log notice;
  rewrite_log on;
  .....
}

2.配置负载均衡
[root@localhost conf.d]# vim lb_https_know.conf
#lb_https_know
upstream lb_https_know  {
        server 192.168.81.220 weight=1 max_fails=3 fail_timeout=60s;
        server 192.168.81.230 weight=1 max_fails=3 fail_timeout=60s;
}
server {
        listen 443 ssl;
        server_name edu.know.com;
        ssl_certificate ssl_key/know.crt;
        ssl_certificate_key ssl_key/know.key;
        access_log /nginx_log/lb_edu_know_access.log main;

        location / {
                proxy_pass http://lb_https_know;
                proxy_set_header HOST $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_connect_timeout 60;
                proxy_send_timeout 30;
                proxy_read_timeout 30;
                proxy_buffering on;
                proxy_buffer_size 256k;
                proxy_buffers 4 256k;
        }
}

[root@localhost conf.d]# vim lb_https_know.conf
server {
        listen 80;
        server_name know.com;
        rewrite (.*) https://edu.know.com$1;
}