{"id":1391,"date":"2025-03-17T19:37:30","date_gmt":"2025-03-17T11:37:30","guid":{"rendered":"http:\/\/113.45.254.23\/?p=1391"},"modified":"2025-03-18T20:15:00","modified_gmt":"2025-03-18T12:15:00","slug":"%e5%88%9b%e5%bb%basslssl-https%e5%8a%a0%e5%af%86%e7%9a%84nginx%e7%9a%84nginx%e7%bd%91%e7%ab%99","status":"publish","type":"post","link":"http:\/\/113.45.254.23\/?p=1391","title":{"rendered":"\u521b\u5efaSSL(ssl https\u52a0\u5bc6)\u7684nginx\u7f51\u7ad9"},"content":{"rendered":"\n

\u4e00\u3001\u5b89\u88c5nginx<\/h2>\n\n\n\n
[root@server10 ~]# dnf -y install nginx\t\t\t\t\t\t\t\u5b89\u88c5nginx<\/code><\/pre>\n\n\n\n
\u4e8c\u3001\u5907\u4efdnginx\u7684\u914d\u7f6e\u6587\u4ef6<\/h2>\n\n\n\n
[root@server10 ~]# cp \/etc\/nginx\/nginx.conf \/etc\/nginx\/nginx.conf.bak\t\u5907\u4efdnginx\u7684\u914d\u7f6e\u6587\u4ef6<\/code><\/pre>\n\n\n\n
\u4e09\u3001\u542f\u52a8nginx\u5e76\u8bbe\u7f6enginx\u5f00\u673a\u542f\u52a8<\/h2>\n\n\n\n
[root@server10 ~]# systemctl enable --now nginx\t\t\t\t\t\u542f\u52a8nginx\u5e76\u8bbe\u7f6enginx\u5f00\u673a\u542f\u52a8\nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/nginx.service \u2192 \/usr\/lib\/systemd\/system\/nginx.service.<\/code><\/pre>\n\n\n\n
\u56db\u3001\u542f\u52a8\u9632\u706b\u5899<\/h2>\n\n\n\n
[root@server10 ~]# systemctl enable --now firewalld\t\t\t\t\u542f\u52a8\u9632\u706b\u5899\nCreated symlink \/etc\/systemd\/system\/dbus-org.fedoraproject.FirewallD1.service \u2192 \/usr\/lib\/systemd\/system\/firewalld.service.\nCreated symlink \/etc\/systemd\/system\/multi-user.target.wants\/firewalld.service \u2192 \/usr\/lib\/systemd\/system\/firewalld.service.<\/code><\/pre>\n\n\n\n
\u4e94\u3001\u5728\u9632\u706b\u5899\u91cc\u6dfb\u52a0\u670d\u52a1<\/h2>\n\n\n\n
[root@server10 ~]# firewall-cmd --add-service=http\t\t\t\t\u5728\u9632\u706b\u5899\u91cc\u6dfb\u52a0http\uff08\u8d85\u6587\u672c\u94fe\u63a5\u534f\u8bae\uff09\u670d\u52a1\nsuccess\n[root@server10 ~]# firewall-cmd --add-service=https             \u5728\u9632\u706b\u5899\u91cc\u6dfb\u52a0https\u670d\u52a1\uff08\u52a0\u5bc6\u5b89\u5168\u7684\u8d85\u6587\u672c\u94fe\u63a5\u534f\u8bae\uff09\nsuccess\n[root@server10 ~]# firewall-cmd --runtime-to-permanent\t\t\t\u5728\u9632\u706b\u5899\u91cc\u6c38\u4e45\u6dfb\u52a0\u8fd0\u884c\u65f6<\/code><\/pre>\n\n\n\n
\u516d\u3001\u5b89\u88c5ssl\uff08\u5b89\u5168\u5957\u9636\u5c42\u534f\u8bae\uff09<\/h2>\n\n\n\n
[root@server10 ~]# dnf -y install openssl-devel\t\t\t\t\t\u5b89\u88c5ssl\uff08\u5b89\u5168\u5957\u9636\u5c42\u534f\u8bae\uff09<\/code><\/pre>\n\n\n\n
\u4e03\u3001\u521b\u5efa\u79c1\u6709\u76ee\u5f55\u6dfb\u52a0\u6743\u9650<\/h2>\n\n\n\n
[root@server10 ~]# mkdir \/etc\/ssl\/private\t\t\t\t\t\t\u521b\u5efa\u79c1\u6709\u76ee\u5f55\n[root@server10 ~]# chmod 700 \/etc\/ssl\/private\/\t\t\t\t\t\u5c06\u79c1\u6709\u76ee\u5f55\u6dfb\u52a0700\u6743\u9650\n[root@server10 ~]# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/ssl\/private\/nginx-selfsigned.key -out \/etc\/ssl\/certs\/nginx-selfsigned.crt\n\u7528openssl\u751f\u6210\u79c1\u6709\u5bc6\u94a5\u548c\u8bc1\u4e66\uff0c\n\n-----\nCountry Name (2 letter code) [XX]:CN\t\t\t\t\t\t\t\nState or Province Name (full name) []:BJ\nLocality Name (eg, city) [Default City]:BJ\nOrganization Name (eg, company) [Default Company Ltd]:www.itcloud.net\t\u516c\u53f8\u540d\u79f0\uff1awww.itcloud.net\nOrganizational Unit Name (eg, section) []:IT\t\t\t\t\t\u90e8\u95e8\uff1aIT\nCommon Name (eg, your name or your server's hostname) []:lee    \u540d\u5b57\nEmail Address []:2823629811@qq.com\t\t\t\t\t\t\t\t\u90ae\u7bb1<\/code><\/pre>\n\n\n\n
\u516b\u3001\u751f\u6210\u5bc6\u94a5\u4ea4\u6362\u6587\u4ef6<\/h2>\n\n\n\n
[root@server10 ~]# openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048\t\t\u751f\u6210\u5bc6\u94a5\u4ea4\u6362\u6587\u4ef6<\/code><\/pre>\n\n\n\n
\u4e5d\u3001\u521b\u5efassl\u7684\u865a\u62df\u4e3b\u673a\u7684\u914d\u7f6e\u6587\u4ef6<\/h2>\n\n\n\n
[root@server10 ~]# vim \/etc\/nginx\/conf.d\/ssl.conf\t\t\t\t\u521b\u5efassl\u7684\u865a\u62df\u4e3b\u673a\u7684\u914d\u7f6e\u6587\u4ef6\nserver {\t\t\t\t\t\t\t\t\t\t\t\t\t\t\u5b9a\u4e49\u670d\u52a1\u5668\n     listen 443 http2 ssl;\t\t\t\t\t\t\t\t\t\t\u76d1\u542cipv4\u7f51\u7ad9https\u7684443\u7aef\u53e3\n     listen [::]:443 http2 ssl;\t\t\t\t\t\t\t\t\t\u76d1\u542cipv6\u7f51\u7ad9https\u7684443\u7aef\u53e3\n     server_name 192.168.7.10;\t\t\t\t\t\t\t\t\t\u670d\u52a1\u5668\u7684\u540d\u79f0\u53ef\u4ee5\u5199\u57df\u540d\u6216IP\n     ssl_certificate \/etc\/ssl\/certs\/nginx-selfsigned.crt;\t\t\u6307\u5b9a\u8bc1\u4e66\u6587\u4ef6\u7684\u4f4d\u7f6e\n     ssl_certificate_key \/etc\/ssl\/private\/nginx-selfsigned.key;\t\u6307\u5b9a\u5bc6\u94a5\u6587\u4ef6\u7684\u4f4d\u7f6e\n     ssl_dhparam \/etc\/ssl\/certs\/dhparam.pem;\t\t\t\t\t\u6307\u5b9a\u5bc6\u94a5\u4ea4\u6362\u6587\u4ef6\u7684\u4f4d\u7f6e\n     \n     root \/usr\/share\/nginx\/html;\t\t\t\t\t\t\t\t\u6307\u5b9a\u7f51\u7ad9\u7684\u5177\u4f53\u4f4d\u7f6e\n     location \/ {\n     }\n\n     error_page 404 \/404.html;\t\t\t\t\t\t\t\t\t\u5b9a\u4e49\u9519\u8bef\u9875\u9762404\u7684\u4f4d\u7f6e\uff08404\u8868\u793a\uff1a\u670d\u52a1\u5668\u627e\u4e0d\u5230\u8bf7\u6c42\u7684\u7f51\u9875\uff09\n     location = \/404.html {\t\t\t\t\t\t\t\n     }\n\n     error_page 500 502 503 504 \/50x.html;\t\t\t\t\t\t\u5b9a\u4e49\t500 502 503 504 \/50x.html\uff0850X\uff09\uff09\u9519\u8bef\u6587\u4ef6\u7684\u4f4d\u7f6e\t\n     location = \/50x.html {\n     }\n}<\/code><\/pre>\n\n\n\n
\u5341\u3001\u521b\u5efassl\u91cd\u5b9a\u5411\u6587\u4ef6<\/h2>\n\n\n\n
[root@server10 ~]# vim \/etc\/nginx\/default.d\/ssl-redirect.conf\t\t\u521b\u5efassl\u91cd\u5b9a\u5411\u6587\u4ef6\nreturn 301 https:\/\/$host$request_uri\/;\t\t\t\t\t\t\t\t\u7f51\u7ad9\u7531http\u91cd\u5b9a\u5411\u5230https\n301 \u8868\u793a\u8bf7\u6c42\u7684\u9875\u9762\u6c38\u4e45\u79fb\u52a8\u5230\u65b0\u4f4d\u7f6e<\/code><\/pre>\n\n\n\n
\u5341\u4e00\u3001\u68c0\u67e5nginx\u914d\u7f6e\u6587\u4ef6\u7684\u8bed\u6cd5\u53ca\u91cd\u542fnginx<\/h2>\n\n\n\n
[root@server10 ~]# nginx -t\t\t\t\t\t\t\t\t\t\t\t\u68c0\u67e5nginx\u914d\u7f6e\u6587\u4ef6\u7684\u8bed\u6cd5\t\t\t\t\t\t\t\t\nnginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful\n[root@server10 ~]# \n[root@server10 ~]# systemctl restart nginx\t\t\t\t\t\t\t\u91cd\u542fnginx<\/code><\/pre>\n\n\n\n
\u5341\u4e8c\u3001win11\u4e0a\u6d4b\u8bd5http\u670d\u52a1\u5668\u6d4b\u8bd5\u9875\u9762<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001\u5b89\u88c5nginx \u4e8c\u3001\u5907\u4efdnginx\u7684\u914d\u7f6e\u6587\u4ef6 \u4e09\u3001\u542f\u52a8nginx\u5e76\u8bbe\u7f6enginx\u5f00\u673a\u542f\u52a8 \u56db\u3001\u542f\u52a8\u9632\u706b\u5899  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[77],"class_list":["post-1391","post","type-post","status-publish","format-standard","hentry","category-linux","tag-nginx"],"_links":{"self":[{"href":"http:\/\/113.45.254.23\/index.php?rest_route=\/wp\/v2\/posts\/1391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/113.45.254.23\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/113.45.254.23\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/113.45.254.23\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/113.45.254.23\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1391"}],"version-history":[{"count":3,"href":"http:\/\/113.45.254.23\/index.php?rest_route=\/wp\/v2\/posts\/1391\/revisions"}],"predecessor-version":[{"id":1402,"href":"http:\/\/113.45.254.23\/index.php?rest_route=\/wp\/v2\/posts\/1391\/revisions\/1402"}],"wp:attachment":[{"href":"http:\/\/113.45.254.23\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/113.45.254.23\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1391"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/113.45.254.23\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}