Build an https server using nginx

HTTPS introduction HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) is an HTTP channel designed for security. In short, it is the secure version of HTTP. That is, the SSL layer is added under HTTP. The Security Foundation of HTTPS is SSL, so the detailed content of encryption requires SSL. It is a URI Scheme (Abstract identifier system) with syntaxes similar to http: System, used for secure HTTP data transmission. The default port used by HTTPS is 443. SSL Certificate certificate type. To set up a security server, use the public key to create a public/private key pair. In most cases, send a certificate request (including your own Public Key), your company's evidentiary materials, and fees to a Certificate Authority (CA ). the CA verifies the certificate request and your identity, and then returns the certificate to your security server. However, you can encrypt the content transmitted by a server or client on the Intranet. You can issue a certificate to yourself. You only need to ignore alarms that are not trusted by the browser! The certificate signed by CA provides two important functions for your server:

• The browser automatically recognizes the certificate and allows you to create a secure connection without prompting the user.
• When a ca generates a signed certificate, it provides identity guarantee for organizations that provide web pages to the browser.
• Most Web servers that support SSL have a ca list and their certificates are automatically accepted. When a browser encounters a certificate whose authorized CA is not in the list, the browser will ask the user whether to accept or reject the connection.

Generate an SSL Certificate

 openssl genrsa -des3 -out wangzhengyi.key 2048

openssl req -new -key wangzhengyi.key -out wangzhengyi.csr

Create a self-Signed CA certificate

openssl req -new -x509 -days 3650 -key wangzhengyi_nopass.key -out wangzhengyi.crt

Build an HTTPS virtual host Virtual Host Configuration File

Upstream sslfpm {server 127.0.0.1: 9000 Weight = 10max_fails = 3fail_timeout = 20 s;} server {Listen 192.168.1. *: 443; SERVER_NAME 192.168.1. *; # enable SSL for a server to support SSL on; # specify the PEM Certificate file ssl_certificate/home/wangzhengyi/SSL/wangzhengyi for the VM. CRT; # specify the private key file ssl_certificate_key/home/wangzhengyi/SSL/wangzhengyi_nopass.key for the VM; # The client can reuse the session parameter time stored in the cache ssl_session_timeout 5 m; # specify the SSL protocol ssl_protocols SSLv3 tlsv1; # specify the licensed Password description ssl_ciphers all :! ADH :! Export56: RC4 + RSA: + high: + medium: + low: + SSLv2: + exp; # The server password requirements of SSLv3 and tlsv1 have a higher priority than the client password ssl_prefer_server_ciphers on; location/{root/home/wangzhengyi/SSL/; Autoindex on; autoindex_exact_size off; autoindex_localtime on ;} # redirect server error pages to the static page/50x.html # error_page 500 502 503 x.html; error_page 504/50 .html; location =/50x.html {root/usr/share/nginx/WWW;} location =/404.html {root/usr/share/nginx/WWW;} # proxy the PHP scripts to FPM location ~ \. PHP $ {access_log/var/log/nginx/SSL. access. log main; error_log/var/log/nginx/SSL. error. log; root/home/wangzhengyi/SSL/; fastcgi_paramhttps on; Include/etc/nginx/fastcgi_params; fastcgi_pass sslfpm ;}}

The https server optimization method SSL Operation consumes CPU resources. Therefore, in a multi-processor system, multiple worker processes need to be started, and the number of available CPUs is not less. The SSL handshake is the most CPU-consuming SSL Operation. There are two ways to minimize the number of handshake operations on each client:

1. Keep the client persistent connection and send multiple requests in an SSL connection
2. Use SSL session parameters in concurrent connections or subsequent connections to avoid SSL handshake.

Session cache is used to save SSL sessions. These caches are shared among working processes and can be usedSsl_session_cacheCommand. The 1 MB cache can store about 4000 sessions. The default cache timeout value is 5 MB. You can use ssl_session_timeout to increase it. Ssl_session_cache command

Syntax: ssl_session_cache off | none | builtin: Size | shared: Name: Size environment: Main, server cache type: off -- hard close, nginx clearly tells the client that this session cannot be reused none-soft close, nginx tells the client that sessions can be reused, but nginx does not actually reuse them bultin-OpenSSL built-in cache, which can only be used for one worker process. memory fragments may be shared-the shared cache of all worker processes. (1) cache size specified by number of characters (2) Each cache must have its own name (3) cache with the same name can be used for multiple virtual hosts

Optimization example

# Optimize the SSL Service ssl_session_cacheshared: wzy: 10 m; # The client can reuse the session parameter time stored in the cache ssl_session_timeout 10 m;

Reference http://nginx.org/cn/docs/http/configuring_https_servers.html