Django博客优化 配置ssl证书

前言

网站持续优化中,先把简单的工作解决掉!
由于之前买的域名是在阿里买的,所以这次证书也在阿里选购,方便管理.
简单介绍

购买证书:

进入控制台-->选择ssl证书产品-->购买证书-->根据需求选择想要的证书类型等级等

image.png

我这里选择的是免费证书,如果你有更高的需求也可选择其他证书

购买后状态,需要申请!

image.png

根据要求填写解析记录

image.png
正确解析即可提交审核完成签发!
image.png

配置证书

点击下载证书会出现不同服务器类型列表,并提供配置帮助文档,我这里使用的是nginx,所以选择下载nginx版证书

根据帮助文档你可以轻松配置https,我这里贴出我的配置文件

• 下载证书至nginx配置文件目录并创建cert目录

mkidr -p cert
[root@runtb cert]# pwd
/etc/nginx/conf.d/cert

• 传入刚下载并解压好的证书文件

[root@runtb cert]# ll
total 8
-rw-r--r-- 1 root root 1675 Dec  7 10:00 4880143_www.runtb.com.key
-rw-r--r-- 1 root root 3667 Dec  7 10:00 4880143_www.runtb.com.pem

• 修改配置文件

记得先备份

[root@runtb cert]# cat /etc/nginx/nginx.conf
events {
    worker_connections  1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
      server{
        listen       443 ssl;
        server_name  wwww.runtb.com;
        ssl_certificate /etc/nginx/conf.d/cert/4880143_www.runtb.com.pem;
        ssl_certificate_key /etc/nginx/conf.d/cert/4880143_www.runtb.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
        ssl_prefer_server_ciphers on;
        client_max_body_size 100M;

        location / {
           include uwsgi_params;
           uwsgi_pass 127.0.0.1:8000; 
           uwsgi_param UWSGI_SCRIPT run.wsgi;
           uwsgi_param UWSGI_CHDIR /xxx/xxx/runtb/; #项目路径

        }
        location /static/ {
        alias /xxx/xxx/runtb/static/; #静态资源路径
        }
    }
}

• 检查nginx是否存在语法错误并重启

[root@runtb cert]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@runtb cert]# nginx -s reload

重新访问网站,发现可以通过https进行访问,但是80端口无法访问

image.png

• 重新修改nginx配置文件,使用rewrite规则把所有http访问都强制跳转到https中

完整版配置文件

[root@runtb cert]# cat /etc/nginx/nginx.conf
events {
    worker_connections  1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    server {
        listen 80;
        server_name  runtb.com; #改为自己的域名，没域名修改为127.0.0.1:80
        charset utf-8;
    rewrite ^/(.*)$ https://www.runtb.com:443/$1 permanent;
    }
      server{
        listen       443 ssl;
        server_name  wwww.runtb.com;
        ssl_certificate /etc/nginx/conf.d/cert/4880143_www.runtb.com.pem;
        ssl_certificate_key /etc/nginx/conf.d/cert/4880143_www.runtb.com.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
        ssl_prefer_server_ciphers on;
        client_max_body_size 100M;
# 此处是我静态资源与程序配置
        location / {
           include uwsgi_params;
           uwsgi_pass 127.0.0.1:8000;  
           uwsgi_param UWSGI_SCRIPT run.wsgi; 
           uwsgi_param UWSGI_CHDIR /xxx/xxx/runtb/; #项目路径

        }
        location /static/ {
        alias /xxx/xxx/runtb/static/; #静态资源路径
        }
    }
}

• 检查nginx语法并启动测试页面是否可正常跳转与访问

[root@runtb cert]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@runtb cert]# nginx -s reload

image.png
一切正常! 撒花!