{"id":662,"date":"2022-03-03T15:09:45","date_gmt":"2022-03-03T07:09:45","guid":{"rendered":"https:\/\/www.buyao007.icu\/?p=662"},"modified":"2022-03-03T15:09:45","modified_gmt":"2022-03-03T07:09:45","slug":"12-nginx%e7%9a%84https%e5%ae%89%e5%85%a8web%e6%9c%8d%e5%8a%a1","status":"publish","type":"post","link":"https:\/\/www.buyao007.icu\/?p=662","title":{"rendered":"12.Nginx\u7684HTTPS\u5b89\u5168web\u670d\u52a1"},"content":{"rendered":"\n

\u5b59\u5bcc\u9633\uff0c \u6c5f\u6e56\u4eba\u79f0\u6ca1\u4eba\u79f0\u3002\u591a\u5e74\u4e92\u8054\u7f51\u8fd0\u7ef4\u5de5\u4f5c\u7ecf\u9a8c\uff0c\u66fe\u8d1f\u8d23\u8fc7\u5b59\u5e03\u65af\u5927\u89c4\u6a21\u96c6\u7fa4\u67b6\u6784\u81ea\u52a8\u5316\u8fd0\u7ef4\u7ba1\u7406\u5de5\u4f5c\u3002\u64c5\u957fWeb\u96c6\u7fa4\u67b6\u6784\u4e0e\u81ea\u52a8\u5316\u8fd0\u7ef4\uff0c\u66fe\u8d1f\u8d23\u56fd\u5185\u67d0\u5927\u578b\u535a\u5ba2\u7f51\u7ad9\u8fd0\u7ef4\u5de5\u4f5c\u3002<\/p>\n\n\n\n

1.https\u57fa\u672c\u6982\u8ff0<\/h2>\n\n\n\n

1.\u4e3a\u4ec0\u4e48\u9700\u8981\u4f7f\u7528HTTPS\uff1f<\/em><\/strong><\/p>\n\n\n\n

\u56e0\u4e3aHTTP\u4e0d\u5b89\u5168\u3002\u5f53\u6211\u4eec\u4f7f\u7528http\u7f51\u7ad9\u65f6\uff0c\u4f1a\u906d\u5230 \u52ab\u6301\u548c\u7be1\u6539\uff0c\u5982\u679c\u91c7\u7528https\u534f\u8bae\uff0c\u90a3\u4e48\u6570\u636e\u5728\u4f20\u8f93\u8fc7\u7a0b\u4e2d\u662f\u52a0\u5bc6\u7684\uff0c\u6240\u4ee5 \u9ed1\u5ba2\u65e0\u6cd5\u7a83\u53d6\u6216\u8005\u7be1\u6539\u6570\u636e\u62a5\u6587\u4fe1\u606f\uff0c\u540c\u65f6\u4e5f\u907f\u514d\u7f51\u7ad9\u4f20\u8f93\u65f6\u4fe1\u606f\u6cc4\u9732\u3002<\/p>\n\n\n\n

2.\u4ec0\u4e48\u662fhttps\uff1f<\/em><\/strong><\/p>\n\n\n\n

https\u5b89\u5168\u7684\u8d85\u6587\u672c\u4f20\u8f93\u534f\u8bae\uff0c\u6211\u4eec\u73b0\u5728\u5927\u90e8\u5206\u7ad9\u70b9\u90fd\u662f\u901a\u8fc7https\u6765\u5b9e\u73b0\u7ad9\u70b9\u6570\u636e\u5b89\u5168\u3002\u65e9\u671f\u4e92\u8054\u7f51\u516c\u53f8\u8bbe\u8ba1\u4e86SSL\u5b89\u5168\u5957\u9636\u5c42\u534f\u8bae\uff0c\u4e3b\u8981\u7528\u4e8e\u5bf9http\u534f\u8bae\u4f20\u8f93\u7684\u6570\u636e\u8fdb\u884c\u52a0\u5bc6\u3002\u90a3\u5982\u4f55\u5c06\u7ad9\u70b9\u53d8\u6210\u5b89\u5168\u7684https\u7ad9\u70b9\u5462\uff1f\u6211\u4eec\u9700\u8981\u4e86\u89e3ssl\u534f\u8bae\u3002
\u800c\u73b0\u5728\u5f88\u591a\u65f6\u5019\u6211\u4eec\u5728\u4f7f\u7528TLS\u4f20\u8f93\u5c42\u5b89\u5168\u534f\u8bae\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

3.\u90a3\u4e48TLS\u662f\u600e\u4e48\u4fdd\u8bc1\u660e\u6587\u6d88\u606f\u88ab\u52a0\u5bc6\u7684\u5462\uff1f<\/em><\/strong><\/p>\n\n\n\n

\u5728OSI\u4e03\u5c42\u6a21\u578b\u4e2d\uff0c\u5e94\u7528\u5c42\u662fhttp \u534f\u8bae\uff0c\u90a3\u4e48\u5728\u5e94\u7528\u5c42\u534f\u8bae\u4e4b\u4e0b\uff0c\u6211\u4eec\u7684\u8868\u793a\u5c42\uff0c\u662fssl\u534f\u8bae\u6240\u53d1\u6325\u4f5c\u7528\u7684\u4e00 \u5c42\uff0c\u5b83\u901a\u8fc7\uff08\u63e1\u624b\u3001\u4ea4\u6362\u79d8\u94a5\u3001\u544a\u8b66\u3001\u52a0\u5bc6\uff09\u7b49\u65b9\u5f0f\uff0c\u4f7f\u5e94\u7528\u5c42http\u534f\u8bae\u6ca1 \u6709\u611f\u77e5\u7684\u60c5\u51b5\u4e0b\u505a\u5230\u4e86\u6570\u636e\u7684\u5b89\u5168\u52a0\u5bc6\u3002<\/p>\n\n\n\n

4.\u8bc1\u4e66\u6743\u5a01\u751f\u6210\u673a\u6784<\/em><\/strong><\/p>\n\n\n\n

\u90a3\u4e48\u5728\u6570\u636e\u8fdb\u884c\u52a0\u5bc6\u4e0e\u89e3\u5bc6\u8fc7\u7a0b\u4e2d\uff0c\u5982\u4f55\u786e\u5b9a\u53cc\u65b9\u7684\u8eab\u4efd\uff0c\u6b64\u65f6\u5c31\u9700\u8981\u6709 \u4e00\u4e2a\u6743\u5a01\u673a\u6784\u6765\u9a8c\u8bc1\u53cc\u65b9\u7701\u4efd\u3002\u90a3\u4e48\u8fd9\u4e2a\u6743\u5a01\u673a\u6784\u5219\u662fCA\u673a\u6784\u3002\u90a3CA\u673a\u6784 \u53c8\u662f\u5982\u4f55\u9881\u53d1\u8bc1\u4e66<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

5.https\u901a\u8baf\u8fc7\u7a0b<\/em><\/strong><\/p>\n\n\n\n

\u5982\u56fe\u6240\u793a<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

6.https\u8bc1\u4e66\u7c7b\u578b<\/em><\/strong><\/p>\n\n\n\n

DV\u8bc1\u4e66 \u4e2a\u4eba\u4f7f\u7528,\u514d\u8d39
OV\u8bc1\u4e66 \u4e2d\u5c0f\u4f01\u4e1a\u4f7f\u7528(\u5927\u90e8\u5206)
EV\u8bc1\u4e66 (\u5de8\u884c\u4f01\u4e1a\u4f7f\u7528)
\u5355\u57df\u540d www
\u591a\u57df\u540d www images cdn test m
\u901a\u914d\u7b26\u57df\u540d *.sfy.com \u517c\u5bb9 bbs.sfy.com anc.sfy.com
Https\u4e0d\u652f\u6301\u7eed\u8d39,\u8bc1\u4e66\u5230\u671f\u9700\u91cd\u65b0\u7533\u8bf7\u65b0\u5e76\u8fdb\u884c\u66ff\u6362.
Https\u4e0d\u652f\u6301\u4e09\u7ea7\u57df\u540d\u89e3\u6790\uff0c\u5982test.m.oldboy.com m.oldboy.com abc.oldboy.com a.b.c.abc.oldboy.com
Https\u663e\u793a\u7eff\u8272\uff0c\u8bf4\u660e\u6574\u4e2a\u7f51\u7ad9\u7684url\u90fd\u662fhttps\u7684\uff0c\u5e76\u4e14\u90fd\u662f\u5b89\u5168\u7684\u3002
Https\u663e\u793a\u9ec4\u8272\uff0c\u8bf4\u660e\u7f51\u7ad9\u4ee3\u7801\u4e2d\u6709\u90e8\u5206URL\u5730\u5740\u662fhttp\u4e0d\u5b89\u5168\u534f\u8bae\u7684\u3002
Https\u663e\u793a\u7ea2\u8272\uff0c\u8981\u4e48\u8bc1\u4e66\u662f\u5047\u7684\uff0c\u8981\u4e48\u8bc1\u4e66\u5df2\u7ecf\u8fc7\u671f\u3002<\/p>\n\n\n\n

2.nginx\u5355\u53f0\u5b9e\u73b0https<\/h2>\n\n\n\n

1.\u73af\u5883\u51c6\u5907<\/em><\/strong><\/p>\n\n\n\n

#nginx\u5fc5\u987b\u6709ssl\u6a21\u5757\n\r[root@Nginx ~]# nginx -V\r \n--with-http_ssl_module\r\n#\u521b\u5efa\u5b58\u653essl\u8bc1\u4e66\u7684\u8def\u5f84\r\n[root@Nginx ~]# mkdir -p \/etc\/nginx\/ssl_key\n\r[root@Nginx ~]# cd \/etc\/nginx\/ssl_key\r<\/code><\/pre>\n\n\n\n
2.\u4f7f\u7528openssl\u547d\u4ee4\u5145\u5f53CA\u6743\u5a01\u673a\u6784\u521b\u5efa\u8bc1\u4e66(\u751f\u4ea7\u4e0d\u4f7f\u7528\u6b64\u65b9\u5f0f\u751f\u6210\u8bc1\u4e66)<\/em><\/strong><\/p>\n\n\n\n
[root@Nginx ssh_key]# openssl genrsa -idea -out server.key 2048\r\nGenerating RSA private key, 2048 bit long modulus \r\n+++ #\u8bb0\u4f4f\u914d\u7f6e\u5bc6\u7801, \u6211\u8fd9\u91cc\u662f1234\r\nEnter pass phrase for server.key:\r\nVerifying - Enter pass phrase for server.key:\r<\/code><\/pre>\n\n\n\n
3.\u751f\u6210\u81ea\u7b7e\u8bc1\u4e66\uff0c\u540c\u65f6\u53bb\u6389\u79c1\u94a5\u7684\u5bc6\u7801<\/em><\/strong><\/p>\n\n\n\n
[root@Nginx ssl_key]# openssl req -days 36500 -x509 \\ \r\n-sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt\r\n###\u56e0\u4e3a\u662f\u9ed1\u6237\u6240\u4ee5\u4e0b\u9762\u968f\u4fbf\u8f93\u5165\u5373\u53ef\r<\/code><\/pre>\n\n\n\n
4.\u8bc1\u4e66\u7533\u8bf7\u5b8c\u6210\u540e\u9700\u8981\u4e86\u89e3Nginx\u5982\u4f55\u914d\u7f6eHttps<\/em><\/strong><\/p>\n\n\n\n
#ssl\u542f\u52a8\u6a21\u5757<\/p>\n\n\n\n
Syntax:<\/th>ssl<\/strong> on | off;<\/code><\/td><\/tr>
Default:<\/th>ssl off;<\/td><\/tr>
Context:<\/th>http<\/code>, server<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
#\u8bc1\u4e66\u6587\u4ef6\u6a21\u5757<\/p>\n\n\n\n
Syntax:<\/th>ssl_certificate<\/strong> file<\/em>;<\/code><\/td><\/tr>
Default:<\/th>\u2014<\/td><\/tr>
Context:<\/th>http<\/code>, server<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
#\u5bc6\u94a5\u6587\u4ef6\u6a21\u5757<\/p>\n\n\n\n
Syntax:<\/th>ssl_certificate_key<\/strong> file<\/em>;<\/code><\/td><\/tr>
Default:<\/th>\u2014<\/td><\/tr>
Context:<\/th>http<\/code>, server<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
5.\u914d\u7f6eNginx\u914d\u7f6eHttps\u5b9e\u4f8b<\/em><\/strong><\/p>\n\n\n\n
#nginx\u914d\u7f6e<\/strong>\n[root@Nginx ~]# cat \/etc\/nginx\/conf.d\/ssl.conf\r\nserver {\r\n\tlisten 443 ssl;  ###\u5f00\u542fssl\u529f\u80fd\r\n\tserver_name ssl.sfy.com;\r\n\tssl_certificate   ssl_key\/server.crt;###ssl\u8bc1\u4e66\u8def\u5f84\r\n\tssl_certificate_key ssl_key\/server.key;###ssl\u79d8\u94a5\u8def\u5f84\r\nlocation \/ {\r\nroot \/code\/ssl;\r\nindex index.html;\r\n\t}\r\n}\r\n#\u51c6\u5907\u5bf9\u5e94\u7684\u7ad9\u70b9\u76ee\u5f55, \u5e76\u91cd\u542fNginx\u670d\u52a1<\/strong>\r\n[root@Nginx ~]# mkdir -p \/code\r\n[root@Nginx ~]# echo \"Https\" > \/code\/index.html\r\n[root@Nginx ~]# systemctl restart nginx\r\n##\u6d4f\u89c8\u5668\u8f93\u5165 https:\/\/ssl.com \u8bbf\u95ee, \u7531\u4e8e\u8be5\u8bc1\u4e66\u975e\u7b2c\u4e09\u65b9\u6743\u5a01\u673a\u6784\u9881\u53d1\uff0c\u800c\u662f\u6211\u4eec\u81ea\u5df1\u7b7e\u53d1\u7684\uff0c\u6240\u4ee5\u6d4f\u89c8\u5668\u4f1a\u8b66\u544a<\/strong>\r\n<\/code><\/pre>\n\n\n\n
6.\u7528\u6237\u5fd8\u8bb0\u5728\u6d4f\u89c8\u5668\u5730\u5740\u680f\u8f93\u5165 https:\/\/ \u600e\u4e48\u529e<\/em><\/strong><\/p>\n\n\n\n
#\u5efa\u8bae\u914d\u7f6e\u5c06\u7528\u6237\u8bbf\u95ee http\u8bf7\u6c42\u5f3a\u5236\u8df3\u8f6chttps<\/strong>\r\n[root@Nginx ~]# cat \/etc\/nginx\/conf.d\/ssl.conf\r\nserver {\r\n\tlisten 443 ssl;  ###\u5f00\u542fssl\u529f\u80fd\r\n\tserver_name ssl.sfy.com;\r\n\tssl_certificate   ssl_key\/server.crt;###ssl\u8bc1\u4e66\u8def\u5f84\r\n\tssl_certificate_key ssl_key\/server.key;###ssl\u79d8\u94a5\u8def\u5f84\r\nlocation \/ {\r\nroot \/code\/ssl;\r\nindex index.html;\r\n\t}\r\n}\r\nserver {\r\n\tlisten 80;\r\nserver_name s.oldboy.com;\r\nrewrite ^(.*)$ https:\/\/$server_name$1 redirect;\r\n##\u57fa\u4e8erewrite\u8df3\u8f6c\r\n #return 302 https:\/\/$server_name$request_uri;\r\n##\u57fa\u4e8ereturn\u8df3\u8f6c\r\n}<\/code><\/pre>\n\n\n\n
3.Nginx\u96c6\u7fa4\u5b9e\u73b0HTTPS<\/h2>\n\n\n\n
1.\u73af\u5883\u51c6\u5907<\/em><\/strong><\/p>\n\n\n\n
\u4e3b\u673a\u540d<\/td>\u5916\u7f51IP(NAT)<\/td>\u5185\u7f51IP(LAN)<\/td>\u89d2\u8272<\/td><\/tr>
lb01<\/td>eth0:10.0.0.5<\/td>eth1:172.16.1.5<\/td>nginx-proxy<\/td><\/tr>
web01<\/td>eth0:10.0.0.7<\/td>eth1:172.16.1.7<\/td>nginx-web01<\/td><\/tr>
web02<\/td>eth0:10.0.0.8<\/td>eth1:172.16.1.8<\/td>nginx-web02<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
2.\u914d\u7f6e\u540e\u7aef\u4e24\u53f0web\u8282\u70b9\u76d1\u542c80\u7aef\u53e3<\/em><\/strong><\/p>\n\n\n\n
#web01 web02\u76f8\u540c\u914d\u7f6e<\/strong>\r\n[root@web01 conf.d]# cat blog.sfy.com.conf\r\nserver {\r\n\tlisten 80;\r\n\tserver_name blog.sfy.com;\r\n\troot \/code\/wordpress;\r\n\tindex index.php index.html;\r\n\tlocation ~ \\.php$ {\r\n\troot \/code\/wordpress;\r\n\tfastcgi_pass   127.0.0.1:9000;\r\n\tfastcgi_index index.php;\r\n\tfastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\r\n\tfastcgi_param HTTPS on;###\u5f00\u542f\u652f\u6301https\r\n\tinclude   fastcgi_params;\r\n\tindex index.html;\r\n\t}\r\n}\r\nNginx\u8d1f\u8f7d\u5747\u8861\u5148\u751f\u6210\u8bc1\u4e66\r\n#Nginx\u8d1f\u8f7d\u5747\u8861\u914d\u7f6e\u6587\u4ef6\u5982\u4e0b\r\n[root@lb01 ~]# cat \/etc\/nginx\/conf.d\/proxy.conf\r\n# \u5b9a\u4e49\u540e\u7aef\u8d44\u6e90\u6c60\r\nupstream site {\r\n\tserver 172.16.1.7:80 max_fails=2 fail_timeout=10s;\r\n\tserver 172.16.1.8:80 max_fails=2 fail_timeout=10s;\r\n}\r\n# https\u914d\u7f6e\r\nserver {\r\n\tlisten 443 ssl;\r\n\tserver_name blog.sfy.com;\r\n\tssl_certificate ssl_key\/server.crt;\r\n\tssl_certificate_key ssl_key\/server.key;\r\n\tlocation \/ {\r\n\t\tproxy_pass http:\/\/site;\r\n\t\tinclude proxy_params;\r\n\t}\r\n}\r\n# \u7528\u6237http\u8bf7\u6c42\u8df3\u8f6c\u81f3https\r\nserver {\r\n\tlisten 80;\r\n\tserver_name blog.sfy.com;\r\nreturn 302 https:\/\/$server_name$request_uri;\r\n}\r\n<\/code><\/pre>\n\n\n\n
4.https\u4f18\u5316<\/h2>\n\n\n\n
\u8bbe\u7f6e worker_processes \u7b49\u4e8e cpu\u6838\u5fc3\u603b\u6570 lscpu
\u5f00\u542f keepalived\u957f\u8fde\u63a5 keepalive_timeout \u8bbe\u7f6e\u957f\u4e00\u4e9b 70 keepalive_timeout 70;
enable the shared session cache, \u5f00\u542f\u5185\u5b58\u4e2d\u7684\u5171\u4eab\u7a7a\u95f4,\u5b58 \u653esession\u7f13\u5b58
disable the built-in session cache \u5173\u95ed\u5185\u7f6esession\u7f13\u5b58
\u589e\u52a0session\u8fc7\u671f\u65f6\u95f4
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #\u6307\u5b9atls\u7248\u672c
ssl_ciphers AES128-SHA:AES256-SHA:RC4- SHA:DES-CBC3-SHA:RC4-MD5; #\u6307\u5b9a\u53ef\u4ee5\u7528\u52a0\u5bc6\u683c\u5f0f<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5b59\u5bcc\u9633\uff0c \u6c5f\u6e56\u4eba\u79f0\u6ca1\u4eba\u79f0\u3002\u591a\u5e74\u4e92\u8054\u7f51\u8fd0\u7ef4\u5de5\u4f5c\u7ecf\u9a8c\uff0c\u66fe\u8d1f\u8d23\u8fc7\u5b59\u5e03\u65af\u5927\u89c4\u6a21\u96c6\u7fa4\u67b6\u6784\u81ea\u52a8\u5316\u8fd0\u7ef4\u7ba1\u7406\u5de5\u4f5c\u3002\u64c5\u957fWeb\u96c6 […]<\/p>\n","protected":false},"author":1,"featured_media":246,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"_links":{"self":[{"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/posts\/662"}],"collection":[{"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=662"}],"version-history":[{"count":1,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/posts\/662\/revisions"}],"predecessor-version":[{"id":666,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/posts\/662\/revisions\/666"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=\/wp\/v2\/media\/246"}],"wp:attachment":[{"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.buyao007.icu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}