HTTPS settings in nginx + PHP.

1. Create a key

OpenSSL genrsa-des3-out server. Key 2048

Enter the password.

2. Create a CSR

OpenSSL req-New-key engir. Key-out server. CSR

Enter by process, as shown in figure

Country name (2 letter code) [GB]: JP
State or province name (full name) [Berkshire]: Tokyo
Locality name (eg, city) [Newbury]: bungee-ku
Organization Name (eg, company) [My Company Ltd]: Huawei
Organizational unit name (eg, Section): Engr
Common name (eg, your name or your server's hostname) []: abc.com
Email Address []: info@it.co.jp note that the email address should be the same as the email address when registering the Domain Name

Please enter the following 'extra 'attributes
To be sent with your certificate request
A challenge password []: Enter
An optional company name []: Enter

3. Apply for a certificate on the corresponding website through server. Key Server. CSR

Such as: http://www.startssl.com/

Http://ocsp.godaddy.com/

After the application is successful, two files will be obtained:

Gd_bundle.crt abc.com. CRT

4. Configure nginx

Upload the gd_bundle.crt abc.com. CRT file to the nginx configuration directory/usr/local/nginx/CONF.

Run

cat abc.com.crt gd_bundle.crt > abc.com.chained.crt

The nginx configuration is as follows:

Server {
Listen 443;
SERVER_NAME ttt.e.com;

SSL on;
Ssl_certificate/usr/local/nginx/CONF/abc.com. chained. CRT;
Ssl_certificate_key/usr/local/nginx/CONF/abc.com. Key;
Ssl_protocols SSLv3 tlsv1 tlsv1.1 tlsv1.2;
Ssl_ciphers high :! Anull :! MD5;

Location /{
Root HTML;
Index index. php;
}

Location ~ \. Php $ {
Root HTML;
Fastcgi_pass 127.0.0.1: 9000;
Fastcgi_index index. php;
Fastcgi_param script_filename/usr/local/nginx/html $ fastcgi_script_name;
Fastcgi_param HTTPS on;
Include FastCGI. conf;
}
}

5. Verify

Run

openssl s_client -connect www.godaddy.com:443

Finally access the https://abc.com if you can see the certificate information, and the connection is normal OK.

Note:

When installing nginx, add the HTTPS module. When compiling:

./Configure -- with-http_sub_module -- with-http_ssl_module

You can use/usr/local/nginx/sbin/nginx-V for viewing.