Nginx Configuration HTTPS Web site

Premise:

1, the host to install OpenSSL first

2, compile and install Nginx, to add--with-openssl and--with-http_ssl_module

1. Generate self-signed certificate

[[Email protected] /]# openssl req -new -x509 -keyout /root/ca.key  -out /root/ca.crtgenerating a 2048 bit rsa private key.............++ +...................................+++writing new private key to  '/root/ca.key ' Enter  PEM pass phrase:         #输入密钥保护密码Verifying  -  Enter PEM pass phrase:     #确认密码保护密码-----you are about  To be asked to enter information that will be incorporatedinto  your certificate request. what you are about to enter is what is called a  Distinguished name or a dn. there are quite a few fields but you can leave some  Blankfor some fields there will be a default value,if you enter  '. ',  the field will be  left blank.-----country name  (2 letter code)  [XX]:CNState or  province name  (Full name)  []:guangzhouLocality Name  (eg, city)  [ default city]:guangzhouorganization name  (Eg, company)  [default company ltd ]:lzsorganizational unit name  (eg, section)  []:itCommon Name  (eg, your  name or your server ' S hostname)  []:101.lzs.comemail address []:[email  protected]

2. Modify the configuration file openssl.cnf

Vim /etc/pki/tls/openssl.cnf[ ca ]default_ca      = ca_ Default            # the default ca  section####################################################################[ ca_default ]dir              = /etc/pki/CA             #证书的根目录, remember this directory certs            =  $dir/certs             crl_dir         =  $dir/crl               database         =  $dir/index.txt        #unique_subject  = no                                                               new_certs_dir   =  $dir/newcerts        certificate      =  $dir/ca.crt       #  modified here, Represents the certificate used when signing serial          =  $dir/serial           crlnumber       =  $dir /crlnumber                                                  crl              =  $dir/crl.pem         private_key      =  $dir/private/cakey.pemrandfile         =  $dir/private/.rand

3. Copy the certificate to the certificate root/ETC/PKI/CA, and create the empty file Index.txt and serial in the directory, and enter "01" to Serial

CD/ETC/PKI/CACP/ROOT/CA.CRT Touch Index.txttouch Serialecho ">serial"

4. Generate server RSA private key/root/server.key

OpenSSL Genrsa-des3-out/root/server.key 1024

5. Remove the password for the private key

OpenSSL Rsa-in/root/server.key-out/root/server_nopwd.key

5. Generate Certificate Request file/ROOT/SERVER.CSR

[[Email protected] /]# openssl req -new -key /root/server.key -out  /root/server.csrenter pass phrase for /root/server.key:    # Enter the protection password for the key generated by step 4th you are about to be asked to enter information  That will be incorporatedinto your certificate request. what you are about to enter is what is called a  Distinguished name or a dn. there are quite a few fields but you can leave some  blankfor some fields there will be a default value,if you  enter  '. ', the field will be left  Blank.--------The following section should be the same as when you created the private certificate------------------------country name  (2 letter code)  [XX]:CNState or Province Name  (Full name)  []:guangzhouLocality Name  (eg, city)  [default city]: guangzhouorganization name  (Eg, company)  [default company ltd]:lzsorganizational  Unit Name  (eg, section)  []:itCommon Name  (eg, your name or  your server ' S hostname)  []:101. Lzs.com----------------------------------------------------------------email address []:[email  protected]please enter the following  ' Extra '  attributesto be sent with  your certificate requesta challenge password []:www.lzs.coman optional  company name []:lzs

6./ROOT/SERVER.CSR signing of a certificate request file with a private certificate

[[email protected] ca]# openssl ca -in /root/server.csr -out /root/ server.crt -cert /root/ca.crt -keyfile /root/ca.key -config /etc/pki/tls/ openssl.cnfusing configuration from /etc/pki/tls/openssl.cnfenter pass phrase  for ca.key:check that the request matches the signaturesignature  okcertificate details:        serial number: 1  ( 0x1)         Validity             Not Before: Aug 31 14:09:15 2016 GMT             not after : aug 31 14:09:15  2017 GMT        Subject:             Countryname               = cn             stateOrProvinceName        = guangzhou             organizationName          = lzs             organizationalunitname    = it             commonName                 = 101.lzs.com             emailAddress               = [email protected]         x509v3 extensions:            x509v3 basic  constraints:                  ca:false            netscape comment:                  openssl  generated certificate            x509v3  Subject Key Identifier:                  18:80:30:B7:C6:11:61:AE:F3:62:9D:D0:33:D9:97:CB:45:5A:31:91             x509v3 authority key identifier:                  keyid:da : 99:4b:9b:29:a8:d8:14:54:fa:52:4b:1e:c3:e0:81:c6:a6:ef:42certificate is to be certified until aug 31  14:09:15 2017 gmt  (365 days) sign the certificate? [y/n]:yes1 out  Of 1 certificate requests certified, commit? [y/n]ywrite out database  with 1 new entriesdata base updated

7. Edit Nginx configuration file/etc/nginx/nginx.conf

-------Add/Modify the following content server {Listen 443 SSL in a specific area of the configuration file;        #设置监听的端口 server_name Lzs;        SSL on;        SSL_CERTIFICATE/ROOT/SERVER.CRT; Ssl_certificate_key/root/server_nopwd.key;

8. Restart Service

~ ~ ~ Complete, enter https://x.x.x.x on the client to access

This article is from the "a" blog, please make sure to keep this source http://lzs66.blog.51cto.com/9607068/1844977

Nginx Configuration HTTPS Web site