nginx https 相关配置

https

依赖

• 实现https访问，必须要安装http_ssl_module模块，可以通过以下命令查看：

./nginx -V

• 如果configure arguments 参数里没有 –with-http_ssl_module，重新安装nginx。

生成密钥

1. 创建一个私钥

openssl genrsa -des3 -out server.key 2048

1. 生成 CSR Common Name 要输入域名

openssl req -new -key server.key -out server.csr

1. 删除私钥中的密码, 有利于自动化部署

openssl rsa -in server.key -out server.key

1. 生成自签名证书

openssl x509 -req -days 10000 -in server.csr -signkey server.key -out server.crt

1. 生成 PEM 格式的证书

openssl x509 -in server.crt -out server.pem -outform PEM

nginx 配置

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    client_max_body_size 100M;

    # 负载均衡 
    upstream data-gateway {
        server 192.168.1.1:8090;
        server 192.168.1.2:8090;
    }


    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    gzip  on;

server {
    # 修改为实际端口
    listen  8080  ssl;
    listen  [::]:8180 ssl;
    server_name  10.73.1.1;
    keepalive_timeout  70;

    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    # 证书路径需要根据实际情况修改
    ssl_certificate  /apps/https-pem/server.pem;
    ssl_certificate_key  /apps/https-pem/server.key;
    ssl_session_cache  shared:SSL:10m;
    ssl_session_timeout  10m;

    location / {
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # 负载均衡配置
        proxy_pass http://data-gateway;
    }
}


    # vue 前端
    server {
        listen       9201;
        server_name  localhost;

        location / {
            root   /apps/web/dist;
            try_files $uri $uri/ @router;
            index  index.html index.htm;
        }


        location @router {
            rewrite ^.*$ /index.html last;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

    }

    include vhosts/*.conf;

}