One: Server-side
1, first need to configure the site's SSL certificate
Open the nginx.conf file in the Conf directory under the Nginx installation directory to find
# HTTPS Server
#
#server {
# Listen 443;
# server_name localhost;
# SSL on;
# ssl_certificate Cert.pem;
# Ssl_certificate_key Cert.key;
# ssl_session_timeout 5m;
# ssl_protocols SSLv2 SSLv3 TLSv1;
# ssl_ciphers all:! Adh:! Export56:rc4+rsa:+high:+medium:+low:+sslv2:+exp;
# ssl_prefer_server_ciphers on;
# location/{
# root HTML;
# index index.html index.htm;
# }
#}
Modify it to:
server {
Listen 443;
server_name localhost;
SSL on;
Ssl_certificate Sslkey/public.cer; (Certificate public key)
Ssl_certificate_key Sslkey/private.key; (Certificate private key)
Ssl_session_timeout 5m;
Ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
Ssl_ciphers aes128-sha:aes256-sha:des-cbc3-sha:aes256-sha256:aes128-sha256;ssl_prefer_server_ciphers on;
Location /{
root html;
index index.html index.htm;
}
}
Save exit and restart Nginx.
Access your site over HTTPS to test the installation configuration of the site certificate.
3. Configure strong identity authentication1. Modify the nginx.conf fileif customers are required to use the client certificate authentication method, the following parameters can be added under the original configuration:server { ...... ...... ......ssl_verify_client on requires SSL client certificate authentication. ssl_client_certificateTrust.certhe CA certificate that issued the client certificate that is used to authenticate the client certificate. ssl_verify_depth 4 SSL client certificate authentication chain length. }4. Restart the site to use your client certificate for login testingFor details, refer to the following links:
Two: The client configuration will be wosign or other agencies issued a. PFX to. P12 the previous server-side certificate, to a. cer to the client can be CLIENT.P12 (for wosign issued by the client certificate, using Firefox browser) for the iOS client certificate, Server.cer (Nginx vfcgy.com.crt to. cer) a self-signed certificate that needs to be prepared for a server-side certificate
1. Server private key 2. A digital certificate that is issued by a CA that contains a digital certificate of the server's public key, 3.CA. In the practice of two-way authentication, the server can be used as a certificate authority by itself, and server and client certificates are issued by the server CA.
1. Client private key 2. A digital certificate issued by a CA that contains the client's public key. To avoid a man-in-the-middle attack, the client also needs a built-in server certificate to verify that the attached server is the specified server.
- Service-side. cer
- Client. P12
See Https://github.com/cuiwe000/HttpsDemo
HTTPS bidirectional certificate
