NGINX+TOMCAT+SSL Free Certificate Configuration

0. Description

This article describes the way to redirect the 80 port of 8443,nginx to Tomcat with Nginx 443 redirection to tomcat 8080;

Random entry: Personal Tags: caicongyang

1.nginx Installation

can refer to my previous article: Linux tar package installation nginx; http://blog.csdn.net/caicongyang/article/details/46388845

However, in this article, we compile without the SSL module, so we need to recompile the installation

Option to bring an SSL module on installation

Complete the command as follows:

Of course you can see all the compilation options with the following command

#./configure--help

2.nginx Generate free Certificate

# cd/opt/nginx/sslkey/# OpenSSL genrsa-des3-out server.key 1024# OpenSSL req-new-key server.key-out server.csr# CP S Erver.key server.key.org# OpenSSL rsa-in server.key.org-out server.key# OpenSSL x509-req-days 365-in server.csr-sign Key Server.key-out SERVER.CRT

3.tomcat ConfigurationServer.xml

<connector port= "8443" protocol= "Org.apache.coyote.http11.Http11Protocol" maxthreads= "sslenabled="               True "Scheme=" https "secure=" true "               clientauth=" false "sslprotocol=" TLS "keystorefile=" ${user.home}/.keystore " keystorepass= "123456"/>

My tomcat certificate is re-generated: (under the current user path)

#keytool-v-genkey-alias tomcat-keyalg rsa-keystore keystore  -validity 36500

Of course you can also specify the directory

#keytool-v-genkey-alias tomcat-keyalg rsa-keystore/opt/tomcat/sslkey/server.keystore  -validity 36500

Of course, you can also configure an important module in the project's web. XML to force HTTPS, and other modules to go HTTP

Xml

<security-constraint>            <web-resource-collection>                 <web-resource-name>services</ web-resource-name>                 <url-pattern>/login/*</url-pattern>                 </web-resource-collection>                 <user-data-constraint>                        <transport-guarantee>CONFIDENTIAL</transport-guarantee>                 </user-data-constraint>   

The above configuration specified path with login all walk HTTPS

4.nginx Configuration

#user nobody;worker_processes 1; #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; #pid logs/nginx.pid;events {worker_connections 1024;}    HTTP {include mime.types;    Default_type Application/octet-stream;  #log_format Main ' $remote _addr-$remote _user [$time _local] "$request" ' # ' $status $body _bytes_sent    "$http _referer" ' # ' "$http _user_agent" "$http _x_forwarded_for";    #access_log Logs/access.log Main;    Sendfile on;    #tcp_nopush on;    #keepalive_timeout 0;    Keepalive_timeout 65;   Gzip on;upstream tomcat8080 {server localhost:8080 weight=10;   }upstream tomcat8443 {server localhost:8443 weight=10;        } server {Listen 80;        server_name localhost;        #charset Koi8-r;        #access_log Logs/host.access.log Main;  Location/{Proxy_set_header Host $host;  Proxy_set_header X-real-ip $remote _addr; prOxy_set_header x-forwarded-for $proxy _add_x_forwarded_for;            Proxy_pass http://tomcat8080;        } #error_page 404/404.html;        # REDIRECT Server error pages to the static page/50x.html # Error_page 502 503 504/50x.html;        Location =/50x.html {root html; } # Proxy The PHP scripts to Apache listening on 127.0.0.1:80 # #location ~ \.php$ {# ProX        Y_pass http://127.0.0.1;        #} # Pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 # #location ~ \.php$ {        # root HTML;        # Fastcgi_pass 127.0.0.1:9000;        # Fastcgi_index index.php;        # Fastcgi_param Script_filename/scripts$fastcgi_script_name;        # include Fastcgi_params; #} # Deny access to. htaccess files, if Apache ' s document Root # concurs with Nginx ' s one # #l ocation ~/\.ht {# denY all;       #}} # Another virtual host using mix of ip-, name-, and port-based configuration # #server {# listen    8000;    # Listen somename:8080;    # server_name somename alias Another.alias;    # location/{# root HTML;    # index index.html index.htm;       #} #} # HTTPS Server server {listen 443;        server_name localhost;        SSL on;        SSL_CERTIFICATE/OPT/NGINX/SSLKEY/SERVER.CRT;        Ssl_certificate_key/opt/nginx/sslkey/server.key;        Ssl_session_timeout 5m;        Ssl_protocols SSLv2 SSLv3 TLSv1; Ssl_ciphers high:!anull:!        MD5;        Ssl_prefer_server_ciphers on;            Location/{Proxy_pass https://tomcat8443;            Proxy_set_header Host $host: 443;            Proxy_set_header X-real-ip $remote _addr;        Proxy_set_header x-forwarded-for $proxy _add_x_forwarded_for; }    }}

The programmer who does not understand operation and maintenance is not a good engineer!

My personal website: http://www.caicongyang.com

My csdn blog address: Http://blog.csdn.net/caicongyang

Nginx+tomcat+ssl Free Certificate configuration