Example of configuring https protocol access for nginx in Linux

I. Configure nginx to support https protocol access, you need to add the corresponding module when compiling and installing nginx -- with-http_ssl_module
 
View nginx compilation parameters:/usr/local/nginx/sbin/nginx-V
 
As follows:
 
Configure arguments: -- prefix =/usr/local/nginx -- with-google_perftools_module -- without-http_memcached_module -- user = www -- group = www -- with-http_stub_status_module -- with-http_sub_module -- with-http_ssl_module -- with-http_gzip_static_module -- with-openssl =/usr/local/src /openssl-1.0.1h -- with-zlib =/usr/local/src/zlib-1.2.8 -- with-pcre =/usr/local/src/pcre-8.35
 
If you don't have the -- with-http_gzip_static_module parameter, you need to edit nginx again
 
2. Enable the default https port 443 on the firewall
 
Vi/etc/sysconfig/iptables # Edit the firewall configuration file and add the following code
 
-A input-m state -- state NEW-m tcp-p tcp -- dport 443-j ACCEPT
 
: Wq! # Save and exit
 
Service iptables restart # restart firewall
 
3. Create an https certificate
 
Make sure that openssl and openssl-devel are installed on the machine.
 
Yum install openssl-devel # CentOS installation using the yum command
 
Mkdir/usr/local/nginx/conf/ssl # Create a certificate storage directory
 
Cd/usr/local/nginx/conf/ssl # enter the Directory
 
Create server private key: openssl genrsa-des3-out server. key 1024 # enter the certificate password as prompted
 
Create a CSR for the signature request: openssl req-new-key server. key-out server. csr # enter the password set above
 
# Enter the corresponding information as prompted
 
Country Name (2 letter code) [XX]: cn # Country
 
State or Province Name (full name) []: zhejiang # Province
 
Locality Name (eg, city) [Default City]: hangzhou # city
 
Organization Name (eg, company) [Default Company Ltd]: osyunwei # company
 
Organizational Unit Name (eg, section) []: sys # Department
 
Common Name (eg, your name or your server's hostname) []: osyunwei # host Name
 
Email Address []: xxx@qq.com # mailbox
 
Please enter the following 'Extra 'attributes
 
To be sent with your certificate request
 
A challenge password []: 123456 # certificate request key. The CA needs to enter A password when reading the certificate.
 
An optional company name []: osyunwei # company name. The CA needs to enter a password when reading the certificate.
 
Openssl rsa-in server. key-out server_nopassword.key # decrypt the key
 
Openssl x509-req-days 365-in server. csr-signkey server_nopassword.key-out server. crt
 
# Mark the certificate using the above private key and CSR
 
Modify the nginx configuration file and load the ssl certificate
 
Vi/usr/local/nginx/conf/nginx. conf # Edit
 
Listen 80;
 
Listen 443;
 
Ssl on;
 
Ssl_certificate/usr/local/nginx/conf/ssl/server. crt;
 
Ssl_certificate_key/usr/local/nginx/conf/ssl/server_nopassword.key;
 
Fastcgi_param HTTPS $ https if_not_empty; # this parameter is automatically used when the https protocol is available. Otherwise, this parameter is ignored.
 
: Wq! # Save and exit
 
Service nginx restart # restart nginx
 
Rewrite ^ (. *) https://www.111cn.net $1 permanent; # you can redirect http to https