Nginx配置https

1、開啓nginx的ssl模塊
1.未安裝過nginx，編譯安裝配置參數以下：
./configure
--prefix=/usr/local/nginx
--with-pcre
--with-http_ssl_module #ssl模塊
--with-http_stub_status_module
--with-http_gzip_static_module
備註：
未開啓ssl模塊，nginx配置ssl後啓動會出現問題the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:37
緣由是nginx缺乏http_ssl_module模塊，編譯安裝時帶上--with-http_ssl_module配置就能夠了

2.已經安裝過nginx,想要添加模塊
中止nginx：/usr/local/nginx/sbin/nginx -s stop
查看nginx原有的模塊：/usr/local/nginx/sbin/nginx -V
切換到nginx源碼包從新配置：
./configure
--prefix=/usr/local/nginx
--with-pcre
--with-http_ssl_module #ssl模塊
--with-http_stub_status_module
--with-http_gzip_static_module
從新編譯make，但不須要make install安裝
備份原有已經安裝好的nginx：cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak
將編譯好的nginx覆蓋掉原來的nginx：cp ./objs/nginx /usr/local/nginx/sbin/
啓動nginx，查看nginx模塊是否添加：/usr/local/nginx/sbin/nginx -V　

2、建立https簽名證書
建立證書存放目錄：mkdir /usr/local/nginx/cert
建立私鑰：openssl genrsa -des3 -out server.key 1024
建立簽名請求證書：openssl req -new -key server.key -out server.csr
備份私鑰：cp server.key server.key.org
去除私鑰口令：openssl rsa -in server.key.org -out server.key
建立簽名證書：openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

3、配置nginx的https
　　配置文件nginx.conf：
server {
listen 443 ssl;
server_name localhost;

ssl on
ssl_certificate /usr/local/nginx/cert/server.crt;
ssl_certificate_key /usr/local/nginx/cert/server.key;
ssl_session_timeout 1m;
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3;

location / {
root html;
index index.html index.htm;
}
}

4、完成
檢查配置文件是否正確：/usr/local/nginx/sbin/nginx -t
啓動nginx：/usr/local/nginx/sbin/nginx
平滑重啓nginx:/usr/local/nginx/sbin/nginx -s reload