阿里云0元购买证书后，选择证书申请
image.png
image.png
填完基本信息后，因为域名不是阿里云购买，所以选择手工DNS验证
image.png
域名解析添加
image.png
image.png
验证通过然后提交申请
image.png
image.png
购买证书签发下来后，下载根据服务器类型是nginx选择下载！上传到nginx所在目录
image.png
image.png
image.png
阿里云-实例-更多-网络和安全组-添加安全组规则-入放向,确认443端口入方向有权限这一步很重要！！！
image.png
image.png
如果使用阿里云的高仿或者WAF，记得也要配置，选择已有证书
image.png
记得项目用到第三方回调的接口要改成https（比如微信支付要再商户后台设置），提供给第三方的http接口，联系对方更换https（比如工猫提现，提供给对方的回调接口）
微信公众号交互返回该公众号提供的服务出现故障，请稍后再试,基本配置里服务器地址(URL)http更换成https
image.png
image.png
nginx -V 查看是否开启模块--with-http_ssl_module
[root@iZbp19avc72hedcv12470iZ sbin]# ls
nginx
[root@iZbp19avc72hedcv12470iZ sbin]# nginx -V
nginx version: nginx/1.16.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC)
built with OpenSSL 1.1.1b 26 Feb 2019
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-openssl=/usr/local/lnmp1.6-full/src/openssl-1.1.1b --with-openssl-opt='enable-weak-ssl-ciphers'
然后打开vhost下域名配置文件，在server下追加一个server内容如下：
https可以访问了，但是是下载文件。说明没有配置php解析。后来直接复制一份80端口的配置黏贴下方，把下面内容追加进去，重启服务可以了。
server {
listen 443 default ssl;
server_name test.cn www.test.cn m.test.cn;
index default.html index.php index.html index.htm;
root /home/wwwroot/youmi/public;
ssl_certificate vhost/key/www.test.cn.pem;
ssl_certificate_key vhost/key/www.test.cn.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
access_log /home/wwwlogs/access_443.log;
error_log /home/wwwlogs/error_443.log;
}
www.test.cn.conf配置文件内容为两个server，一个http，一个https,其实两者可以合并成一个server
http配置
server
{
listen 80;
#listen [::]:80;
server_name test.cn www.test.cn m.test.cn;
index default.html index.php index.html index.htm;
root /home/wwwroot/youmi/public;
error_page 404 /404.html;
include none.conf;
include enable-php.conf;
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|sir)$ {
expires 30d;
}
location ~ .*\.(js|css)?$ {
expires 12h;
}
location ~ /\. {
deny all;
}
location / {
if (!-e $request_filename){
# PATHINFO变量名 用于兼容模式config中var_pathinfo值设为s
rewrite ^/(.*)$ /index.php?s=$1 last;
break;
}
}
access_log /home/wwwlogs/access_youmi.log;
error_log /home/wwwlogs/error_youmi.log;
}
http可以简写如下
server {
listen 80;
server_name test.com;
index index.html index.php index.htm;
access_log /home/wwwroot/test/public/logs/access.log;
error_log /home/wwwroot/test/public/logs/error.log;
return 301 https://$server_name$request_uri; #这是nginx最新支持的写法
location ~ / {
root /home/wwwroot/test/public;
index index.html index.php index.htm;
}
}
https配置
server {
listen 443 default ssl;
server_name test.cn www.test.cn m.test.cn;
index default.html index.php index.html index.htm;
root /home/wwwroot/youmi/public;
ssl_certificate vhost/key/www.test.cn.pem;
ssl_certificate_key vhost/key/www.test.cn.key;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
error_page 404 /404.html;
include none.conf;
include enable-php.conf;
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|sir)$ {
expires 30d;
}
location ~ .*\.(js|css)?$ {
expires 12h;
}
location ~ /\. {
deny all;
}
location / {
if (!-e $request_filename){
# PATHINFO变量名 用于兼容模式config中var_pathinfo值设为s
rewrite ^/(.*)$ /index.php?s=$1 last;
break;
}
}
access_log /home/wwwlogs/access_443.log;
error_log /home/wwwlogs/error_443.log;
}
如果是宝塔申请https证书更方便了，实名认证后，申请秒过，然后强制开启https...
server
{
listen 80;
listen 443 ssl http2;
server_name m.xxx.com admin.xxx.com;
index index.php index.html index.htm default.php default.htm default.html;
root /www/wwwroot/xxx/public;
#SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
#error_page 404/404.html;
#HTTP_TO_HTTPS_START
if ($server_port !~ 443){
rewrite ^(/.*)$ https://$host$1 permanent;
}
#HTTP_TO_HTTPS_END
ssl_certificate /www/server/panel/vhost/cert/m.xxx.com/fullchain.pem;
ssl_certificate_key /www/server/panel/vhost/cert/m.xxx.com/privkey.pem;
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
error_page 497 https://$host$request_uri;
#SSL-END
#ERROR-PAGE-START 错误页配置，可以注释、删除或修改
#error_page 404 /404.html;
#error_page 502 /502.html;
#ERROR-PAGE-END
#PHP-INFO-START PHP引用配置，可以注释或修改
include enable-php-56.conf;
#PHP-INFO-END
#REWRITE-START URL重写规则引用,修改后将导致面板设置的伪静态规则失效
include /www/server/panel/vhost/rewrite/m.xxx.com.conf;
#REWRITE-END
#禁止访问的文件或目录
location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|LICENSE|README.md)
{
return 404;
}
#一键申请SSL证书验证目录相关设置
location ~ \.well-known{
allow all;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
error_log off;
access_log /dev/null;
}
location ~ .*\.(js|css)?$
{
expires 12h;
error_log off;
access_log /dev/null;
}
access_log /www/wwwlogs/m.xxx.com.log;
error_log /www/wwwlogs/m.xxx.com.error.log;
}
image.png
网友评论