nginx websocket ssl tomcat proxy

1.tomcat 修改配置：

1.修改端口 <Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1" redirectPort="443" proxyPort="443"/> 2.修改host節點下的valve。 <Valve className="org.apache.catalina.valves.RemoteIpValve"           remoteIpHeader="x-forwarded-for"          remoteIpProxiesHeader="x-forwarded-by"          protocolHeader="x-forwarded-proto"/>

2.nginx.conf

在http{}內添加

upstream tomcat {     server 127.0.0.1:8080 fail_timeout=0; } # HTTPS server server {     listen       443 ssl;     server_name  localhost;     ssl_certificate      d:\openssl\bin\client.pem;     ssl_certificate_key  d:\openssl\bin\client.key;     ssl_session_cache    shared:SSL:1m;     ssl_session_timeout  5m;     ssl_ciphers  HIGH:!aNULL:!MD5;     ssl_prefer_server_ciphers  on;     location / {         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header Host $http_host;         proxy_set_header X-Forwarded-Proto https;         proxy_http_version 1.1;         proxy_set_header Upgrade $http_upgrade;         proxy_set_header Connection "Upgrade";         proxy_redirect off;         proxy_connect_timeout      240;         proxy_send_timeout         240;         proxy_read_timeout         240;         # note, there is not SSL here! plain HTTP is used         proxy_pass http://tomcat;     } } 3.openssl生成密鑰文件 1.建立網站證書存放目錄 shell> mkdir /usr/local/nginx/conf/ssl shell> cd /usr/local/nginx/conf/ssl 2.製做CA證書 shell> openssl genrsa -des3 -out ca.key 2048 shell> openssl req -new -x509 -days 7305 -key ca.key -out ca.crt 3.生成nginx服務器所需證書，並用CA簽名 shell> openssl genrsa -des3 -out client.key 1024 shell> openssl req -new -key client.key -out client.csr shell> openssl x509 -req -in client.csr -out client.pem -signkey client.key -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 4.查看證書文件 shell> pwd /usr/local/nginx/conf/ssl shell> ls ca.crt  ca.key  ca.srl  client.csr  client.key  client.pem 在加載SSL支持的Nginx並使用上述私鑰時除去必須的口令： $ cp client.key client.key.org $ openssl rsa -in client.key.org -out client.key