美文网首页
Nginx支持ssl如何配置

Nginx支持ssl如何配置

作者: lzhlovexz | 来源:发表于2019-01-08 12:12 被阅读0次

    安装nginx

    如用源码安装，需要先准备编译环境

    yum -y install gcc gcc-c++ ncurses-devel unzip patch perl*

    1）pcre安装

    下载地址http://sourceforge.net/projects/pcre/files/pcre/8.37/pcre-8.37.tar.gz

    [root@localhost local]# tar -zxvf pcre-8.37.tar.gz

[root@localhost local]# cd pcre-8.37

[root@localhost pcre-8.37]# ./configure 

[root@localhost pcre-8.37]# make

[root@localhost pcre-8.37]# make install

    2）安装zlib包

    下载地址http://zlib.net/zlib-1.2.8.tar.gz

    [root@localhost pcre-8.37]# cd /usr/local/

[root@localhost local]# tar -zxvf zlib-1.2.8.tar.gz 

[root@localhost local]# cd zlib-1.2.8

[root@localhost zlib-1.2.8]# ./configure

[root@localhost zlib-1.2.8]# make

[root@localhost zlib-1.2.8]# make install

    3）安装ssl

    下载地址：http://www.openssl.org/source/

    [root@localhost pcre-8.37]# cd /usr/local/ 

[root@localhost local]# tar -zxvf openssl-1.0.2c.tar.gz

    4)安装nginx_upstream_check_module模块 （健康监测）

    下载地址：https://github.com/yaoweibin/nginx_upstream_check_module/archive/master.zip

    [root@localhost local]# unzip nginx_upstream_check_module-master.zip
##5）安装nginx
下载地址http://nginx.org/download/
[root@localhost zlib-1.2.8]# cd /usr/local/

[root@localhost local]# tar -zxvf nginx-1.9.2.tar.gz 

[root@localhost local]# cd nginx-1.9.2

[root@unicorn01 nginx-1.9.2]# patch -p0 < /usr/local/nginx_upstream_check_module-master/check_1.9.2+.patch 

[root@localhost nginx-1.9.2]# ./configure --prefix=/usr/local/nginx --add-module=/usr/local/nginx_upstream_check_module-master --with-pcre=/usr/local/pcre-8.37 --with-zlib=/usr/local/zlib-1.2.8 --with-http_ssl_module --with-openssl=/usr/local/openssl-1.0.2c

[root@localhost nginx-1.9.2]# make [root@localhost nginx-1.9.2]# make install
##6）配置nginx
```shell
root@localhost local]# cd /usr/local/nginx/conf/

[root@localhost conf]# vim nginx.conf

    此处根据项目需求配置负载均衡和请求代理转发

    例如:

    upstream cluster {

            # simple round-robin

            server 192.168.0.1:80;

            server 192.168.0.2:80;

            check interval=5000 rise=1 fall=3 timeout=4000;

            #check interval=3000 rise=2 fall=5 timeout=1000 type=ssl_hello;

            #check interval=3000 rise=2 fall=5 timeout=1000 type=http;       

            #check_http_send "HEAD / HTTP/1.0\r\n\r\n";       

            #check_http_expect_alive http_2xx http_3xx;       

            } upstream group1 {       

            server 10.51.19.63:80;       

            }       

            server {       

            listen       80;       

            #listen 8602;       

            server_name  localhost;       

#proxy_redirect  http://localhost:80/M00 /M00;

#charset koi8-r;

        #access_log  logs/host.access.log  main;

        #location / {

        #    root   html;

        #    index  index.html index.htm;

        #} location / {

                    proxy_pass [http://cluster](http://cluster/);

        }

        location /nstatus {

        check_status;

        access_log off;

        #allow SOME.IP.ADD.RESS;

        #deny all;

        }

        location /group1/M00 {

            proxy_pass http://group1;

             #health_check match=not_redirect;

             proxy_redirect off;

             proxy_set_header Host $host;

             #proxy_cache cache_one;

             proxy_cache_valid 200 1h;

             # proxy_cache_valid 301 1d;

             # proxy_cache_valid any 1m;

             expires 30d;

             }

location / {

proxy_pass [http://10.51.19.66:15672](http://10.51.19.66:15672/);

}

location /message {

proxy_pass [http://10.51.19.66:8080](http://10.51.19.66:8080/);

}

        location /filews{        

                    proxy_pass [http://10.51.19.63:8081](http://10.51.19.63:8081/);        

        }        

        location /infows{

                 proxy_pass [http://10.51.19.63:8082](http://10.51.19.63:8082/);

        }

        location /cms{

                proxy_pass [http://10.51.19.63:8083](http://10.51.19.63:8083/);

        }

        location /cmsfile{

                 proxy_pass [http://10.51.19.63:8083](http://10.51.19.63:8083/);

        }

        location /cgiws{

                    proxy_pass [http://10.51.19.64:8081](http://10.51.19.64:8081/);

        }

        location /hexinstat{

                 proxy_pass [http://10.51.19.64:8082](http://10.51.19.64:8082/);

        }

       #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html

        #

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {             root   html;         }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80

        #

        #location ~ \.php$ {

                #    proxy_pass   [http://127.0.0.1](http://127.0.0.1/);

        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

        #

        #location ~ \.php$ {

        #    root           html;

        #    fastcgi_pass   127.0.0.1:9000;

        #    fastcgi_index  index.php;

        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;

        #    include        fastcgi_params;

        #}

        # deny access to .htaccess files, if Apache's document root

        # concurs with nginx's one

        #

        #location ~ /\.ht {

        #    deny  all;

        #}

        }    

        server {

        listen       443;

        server_name  localhost; ssl on;

        ssl_certificate      server.pem;

        ssl_certificate_key  server.key;

        #ssl_client_certificate ca.crt;

        #ssl_verify_client on;

        #ssl_session_cache    shared:SSL:1m;

        # ssl_session_timeout  5m;

        #ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

        ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

        ssl_prefer_server_ciphers  on;

        location /cgiws {

                    proxy_pass [http://10.51.19.64:8081/cgiws](http://10.51.19.64:8081/cgiws);

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header SSL_CERT $ssl_client_cert;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        }

        location /infows {

                   proxy_pass [http://10.51.19.63:8082](http://10.51.19.63:8082/);

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header SSL_CERT $ssl_client_cert;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        }

        location /group1/M00 {

            proxy_pass http://group1;

             #health_check match=not_redirect;

             proxy_redirect off;

             proxy_set_header Host $host;

             #proxy_cache cache_one;

             proxy_cache_valid 200 1h;

             # proxy_cache_valid 301 1d;

             # proxy_cache_valid any 1m;

             expires 30d;

             }

             #location / {

             #    root   html;

             #    index  index.html index.htm;

             #}

             }

    7）启动、重启、停止

    [root@localhost conf]# /usr/local/nginx/sbin/nginx

重启：
[root@localhost conf]# /usr/local/nginx/sbin/nginx -s reload

停止：
[root@localhost conf]# /usr/local/nginx/sbin/nginx -s stop

验证配置文件：
[root@localhost conf]# /usr/local/nginx/sbin/nginx -t

    8)nginx监控配置

    location /status { 

stub_status on; auth_basic "NginxStatus"; 

}

    http://localhost:8083/status

    Active connections: 2

    server accepts handled requests

    3 3 54

    Reading: 0 Writing: 1 Waiting: 1

    解析：

    Active connections //当前 Nginx 正处理的活动连接数。

    server accepts handled requests //总共处理了3 个连接 , 成功创建 3 次握手,总共处理了54个请求。

    Reading //nginx 读取到客户端的 Header 信息数。

    Writing //nginx 返回给客户端的 Header 信息数。

    Waiting //开启 keep-alive 的情况下，这个值等于 active - (reading + writing)，意思就是 Nginx 已经处理完正在等候下一次请求指令的驻留连接

    9）nginx出现异常开启日志分析

    log_format main 'remote_addr -remote_user [time_local] "request" '

    'statusbody_bytes_sent "$http_referer" '

    '"http_user_agent" "http_x_forwarded_for"'

    '"upstream_addr" "upstream_status" "upstream_response_time" "request_time"';

    access_log  logs/access.log  main;

    参数说明示例

    $remote_addr 客户端地址 211.28.65.253

    $remote_user 客户端用户名称 --

    $time_local 访问时间和时区 18/Jul/2012:17:00:01 +0800

    $request 请求的URI和HTTP协议 "GET /article-10000.html HTTP/1.1"

    $http_host 请求地址，即浏览器中你输入的地址（IP或域名） www.it300.com

    192.168.100.100

    $status HTTP请求状态 200

    $upstream_status upstream状态 200

    $body_bytes_sent 发送给客户端文件内容大小 1547

    $http_referer url跳转来源 https://www.baidu.com/

    http_user_agent 用户终端浏览器等信息 "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; GTB7.0; .NET4.0C;ssl_protocol SSL协议版本 TLSv1 ssl_cipher 交换数据中的算法 RC4-SHAupstream_addr 后台upstream的地址，即真正提供服务的主机地址 10.10.10.100:80 request_time 整个请求的总时间 0.205upstream_response_time 请求过程中，upstream响应时间 0.002

    切记：

    1、首先，确保安装了OpenSSL库，并且安装Nginx时使用了–with-http_ssl_module参数。

    2、证书拷至nginx目录，配置如下server

    3、第一次配置https时必须重启nginx才能生效，不能reload！

    相关文章

      网友评论

          本文标题：Nginx支持ssl如何配置

          本文链接：https://www.haomeiwen.com/subject/vbzyrqtx.html

          延伸阅读

          深度阅读

          • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

          栏目导航

          热点阅读

          关于我们|服务条款|联系我们|Nginx支持ssl如何配置|投稿指南|网站地图|RSS订阅|排版工具|手机版

          提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

          Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

          备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

          本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

          所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！