nginx 配置ssl實現https

1.安裝nginx

2.申請ssl證書，由於個人域名是阿里申請的，阿里有提供免費的證書，因此我就到對應的域名平臺下生成證書就能夠了

填寫相關信息提交阿里審覈，審覈經過後就能夠下載證書密鑰等信息了，由於咱們這裏是對nginx配置，因此選擇對應nginx證書下載。

3.上面已經申請到證書，接下來就是對nginx進行配置：

首先80和443端口必須可用，在nginx的配置文件 conf下建一個文件夾cert存放申請下來的證書。如下是我nginx配置的兩個ssl證書，若是你只要配置一個就刪除一個server節點就能夠了。

server {

listen       443;
    server_name  你的域名;
    ssl on;

    root      /usr/local/tomcat-shaoguan-mini/webapps/sgmini/;//項目的位置

    location ~ .*\.(txt|js|css|jsp|png|jpg|JPEG)?$ {
         proxy_pass http://localhost:8066;//代理端口
        root  /usr/local/tomcat-shaoguan-mini/webapps/sgmini/;
        access_log off;
        expires 0;
    }

    ssl_certificate      cert/cert-1541409622473_sgmini.51educity.com.crt;
    ssl_certificate_key  cert/cert-1541409622473_sgmini.51educity.com.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers  on;

    location / {
        proxy_pass http://localhost:8066;
        proxy_redirect off;
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_read_timeout  30m;
        client_max_body_size       30m;
    }
}
複製代碼

server {

listen       443;
    server_name  你的域名;
    ssl on;

    root      /usr/local/tomcat-zhuhai-mini/webapps/mini/;

    location ~ .*\.(txt|js|css|jsp|png|jpg|JPEG)?$ {
         proxy_pass http://localhost:8067;
        root  /usr/local/tomcat-zhuhai-mini/webapps/mini/;
        access_log off;
        expires 0;
    }

    ssl_certificate      cert/cert-1541409603993_zhmini.51educity.com.crt;//證書路徑
    ssl_certificate_key  cert/cert-1541409603993_zhmini.51educity.com.key;//證書密鑰路徑

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers  on;

    location / {
        proxy_pass http://localhost:8067;//代理的端口
        proxy_redirect off;
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_read_timeout  30m;
        client_max_body_size       30m;
    }
}
複製代碼

server {

listen 80;

rewrite ^(.*)$ https://$host$1 permanent;//重置到https
複製代碼

}

4.上域名管理平臺作域名解析對應的服務器，而後啓動nginx，訪問你的域名就能夠實現https訪問了。