Configuring HTTPS certificates based on Nginx

About platform Configuration HTTPS certificates

Prepare content:

1. certificate files that can be authorized

2, Nginx on the configuration certificate

3. Configure the certificate on the back-end IIS site

4. Program code adjustment and judgment

First, configure the certificate on the Nginx

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s2.51cto.com/wyfs02/M00/08/C5/wKiom1nm8-KjS11vAAEltFHLw40479.png "title=" Qq20171018141030.png " alt= "Wkiom1nm8-kjs11vaaeltfhlw40479.png"/>

Listen 443 SSL;

SSL on;

SSL_CERTIFICATE/USR/LOCAL/NGINX/KEYS/XXX.COM.PEM;

Ssl_certificate_key/usr/local/nginx/keys/xxx.com.key;

Ssl_session_timeout 5m;

Ssl_protocols SSLv3 TLSv1;

Ssl_ciphers high:! Adh:! Export56:rc4+rsa:+medium;

Ssl_prefer_server_ciphers on;

server_name xxx.xxx.com;

Index index.html;

Access_log logs/ssl.lan.xxx.xxx.com Access_log;

In Nginx, configure the payload backend service information

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s1.51cto.com/wyfs02/M00/08/C5/wKiom1nm8SGjQZOgAAC3JCzrt9o604.png "title=" Qq20171018141145.png " alt= "Wkiom1nm8sgjqzogaac3jczrt9o604.png"/>

It is important to note that in the Proxy_pass configuration, you need to use the HTTPS method

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>

Second, configure the certificate on IIS

1. Import the certificate

To open an MMC console, add a certificate configuration entry

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s5.51cto.com/wyfs02/M02/A7/74/wKioL1nm7pLBCSBMAAHqOLymO2M633.png "title=" Qq20171018141305.png " alt= "Wkiol1nm7plbcsbmaahqolymo2m633.png"/>

By importing the corresponding certificate file, importing "personal", "Intermediate certification authority", all 2 nodes require an import operation.

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s2.51cto.com/wyfs02/M02/08/C5/wKiom1nm8XfgIB61AAJ4kkeQjsU723.png "title=" Qq20171018141351.png " alt= "Wkiom1nm8xfgib61aaj4kkeqjsu723.png"/>

2. Application Site Configuration Certificate

After the certificate is correctly imported in the previous, when you configure the site to select the HTTPS type, in the SSL certificate, you can see the certificate information that was successfully imported

It is important to note that the domain name of the certificate authority needs to be the same, and the corresponding level two domain name is not multiple. "Number appears

Here is the configuration port 30011, which is provided to the Nginx configuration, the load used by the

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s3.51cto.com/wyfs02/M02/A7/74/wKioL1nm7wLid1xPAAMILsAkVqc036.png "title=" Qq20171018141456.png " alt= "Wkiol1nm7wlid1xpaamilsakvqc036.png"/>

Description: Here the hostname, can not be configured, in the Nginx load, can be found through the IP and port

Third, the program is configured to support HTTPS

Programs, related exams, timings, videos, login-related addresses, judging connection information based on issecureconnection in context

        //

Summary:

Gets a value that indicates whether the HTTP connection uses a secure socket (that is, HTTPS).

//

return Result:

True if the connection is an SSL connection; otherwise false.

public bool IsSecureConnection {get;}

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s1.51cto.com/wyfs02/M01/08/C5/wKiom1nm8fyielPuAAAuFd8EV5o853.png "title=" Qq20171018141601.png " alt= "Wkiom1nm8fyielpuaaaufd8ev5o853.png"/>

The corresponding Web. config in the corresponding node, here is mainly to consider the support of HTTP, https two different ways to support, in a convenient test environment there are 2 different situations, because the configuration of 2 nodes, formally used, theoretically 2 types of domain name address configuration is the same.

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/> (You can configure different resource addresses depending on the type)

In the platform, such as log in using the CAS service, platform side and CAS for ticket verification, Web. config needs to be configured as follows:

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>

<!--CAS ticket requirements, allowing the system to tolerate hearder information that ends with only CR or LF-

<system.net>

<settings>

</settings>

</system.net>

In Web. config, add the configuration of the above node, otherwise the following exception will appear, causing the user not to log in

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>

Ticket Validation Error:DotNetCasClient.Validation.TicketValidationException:CAS Server Ticket validation threw an Exception---> System.Net.WebException: The server submitted a protocol conflict. Section=responseheader DETAIL=CR back must be LF

Additional Instructions:

1, for the use of dotnetcasclient components, if you need to see the corresponding log information, you need to add the following configuration for Web. config

<system.diagnostics>

<trace autoflush= "true" usegloballock= "false"/>

<sharedListeners>

<add name= "tracefile" type= "System.Diagnostics.TextWriterTraceListener" Initializedata= "Logs\ DotNetCasClient.Log "traceoutputoptions=" DateTime "/>

</sharedListeners>

<sources>

<!--provides diagnostic information on module configuration parameters. -

<source name= "Dotnetcasclient.config" switchname= "Config" switchtype= "System.Diagnostics.SourceSwitch" >

<listeners>

<add name= "Tracefile"/>

</listeners>

</source>

<!--traces IHttpModule lifecycle events and meaningful operations performed therein. -

<source name= "Dotnetcasclient.httpmodule" switchname= "HttpModule" switchtype= "System.Diagnostics.SourceSwitch" >

<listeners>

<add name= "Tracefile"/>

</listeners>

</source>

<!--provides protocol message and routing information. -

<source name= "Dotnetcasclient.protocol" switchname= "Protocol" switchtype= "System.Diagnostics.SourceSwitch" >

<listeners>

<add name= "Tracefile"/>

</listeners>

</source>

<!--provides details on security operations and notable security conditions. -

<source name= "dotnetcasclient.security" switchname= "Security" switchtype= "System.Diagnostics.SourceSwitch" >

<listeners>

<add name= "Tracefile"/>

</listeners>

</source>

</sources>

<switches>

<add name= "Config" value= "Information"/>

<add name= "HttpModule" value= "Verbose"/>

<add name= "Protocol" value= "Information"/>

<add name= "Security" value= "Information"/>

</switches>

</system.diagnostics>

The following is the Nginx configuration of the platform

server {

Listen 443 SSL;

SSL on;

SSL_CERTIFICATE/USR/LOCAL/NGINX/KEYS/XXX.COM.PEM;

Ssl_certificate_key/usr/local/nginx/keys/xxx.com.key;

Ssl_session_timeout 5m;

#ssl_protocols SSLv3 TLSv1;

Ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

Ssl_ciphers high:! Adh:! Export56:rc4+rsa:+medium;

Ssl_prefer_server_ciphers on;

server_name xxx.xxx.com;

Index index.html;

Access_log logs/ssl.lan.xxx.xxx.com Access_log;

Configure Persistent HTTP redirection https

[email protected] extra]$ cat xxx-http-test.conf

server {

Listen 80;

server_name xxx.xxx.com;

Access_log Logs/xxx.xxx.com.access.log Access_log;

Location/{

rewrite ^ (. *) https://xxx.xxx.com/$1 permanent;

}

}

Permanent indicates permanent redirection

$ = parameter information after the domain name

Configuration reference: http://blog.csdn.net/zhanglinjian21/article/details/7631515

Configure the default in Nginx

Solve the low version (XP IE8 similar) browser, only to recognize 1 HTTPS certificate issues, if not configured, there are multiple certificates, browser access will be possible to find an incorrect certificate, Access anomalies

650) this.width=650; "src="/e/u261/themes/default/images/spacer.gif "border=" 0 "style=" Background:url ("/e/u261/ Lang/zh-cn/images/localimage.png ") no-repeat center;border:1px solid #ddd;" alt= "Spacer.gif"/>650) this.width=650 ; "Src=" Https://s2.51cto.com/wyfs02/M01/A7/74/wKioL1nm8Drhg-o8AAGBB-LNE-s842.png "title=" Qq20171018142000.png " alt= "Wkiol1nm8drhg-o8aagbb-lne-s842.png"/>

Five, SSL configuration optimization

1, HSTS

HSTS (HTTP Strict Transport Security). The server returns a HSTS HTTP header, and after the browser gets to the HSTS header, the request internally jumps to https://www for a period of time, regardless of whether the user enters www.baidu.com or http://www.baidu.com. . baidu.com;

Add the following lines to the server block of your HTTPS configuration:

Add_header strict-transport-security "max-age=31536000";

Ssl_session_cache shared:ssl:20m;  

Ssl_session_timeout 20m;  

Refer to Nginx Official document 1MB memory can store about 4,000 sessions, routinely configuration 20M can store about 80000. Reasonable setting According to demand

Ssl_prefer_server_ciphers on; #指定服务器密码算法在优先于客户端密码算法时

Requires both HTTPS and http,http need to jump to HTTPS

New version, re-create the new server configuration

server {

Listen 80;

server_name www. domain name. com;

return 301 https://$server _name$request_uri; (To jump)

}

server {

Listen 443 SSL;

server_name www. domain name. com;

SSL_CERTIFICATE/USR/SHARE/NGINX/HTML/ZHENGSHU/XX.XX.CRT; (certificate)

Ssl_certificate_key/usr/share/nginx/html/zhengshu/xx. Xx.key; (certificate key)

}

This article is from the "Frog Qing" blog, please be sure to keep this source http://wuxueqing.blog.51cto.com/13389311/1973738

Configuring HTTPS certificates based on Nginx