Nginx Configuration HTTPS

Using SSL module configuration to support both HTTP and HTTPS coexistence one, generate certificates

# 1, first, enter the directory where you want to create the certificate and private key, for example: cd/etc/nginx/# 2, create the server private key, the command will let you enter a password: OpenSSL genrsa-des3-Out server. Key1024# 3. Create a certificate for signing request (CSR): OpenSSL req-new-key Server. Key-out server. CSR# 4, remove the required password when loading SSL-supported Nginx and using the above private key:CP server. Key server.key. Orgopenssl RSA-inserver. Key. org-outserver. Key# 5, the last token certificate uses the above private key and Csr:openssl X509-req- Days 365-inserver. Csr-signkey server.key-outserver. CRT    

Second, configure Nginx

Cd/etc/nginxvim nginx.conf## HTTPS Server Configuration#server {Listen443; server_name the IP address of the machine; SSL on; ssl_certificate/etc/nginx/server.crt; ssl_certificate_key/etc/nginx/server.key ; Ssl_session_timeout 5m;  # ssl_protocols SSLv2 SSLv3 TLSv1; # ssl_ciphers all:! Adh:! Export56:rc4+rsa:+high:+medium:+low:+sslv2:+exp; # ssl_prefer_server_ciphers on, location/{ #root html; #index testssl.html index.html index.htm; proxy_redirect off; Proxy_set_header Host $host; proxy_set_ Header X-real-ip $remote _addr, proxy_set_header x-forwarded-for $proxy _add_x_forwarded_for; proxy_ Pass Http://IP address/ssl/; }}

Restart Nginx, in the browser input: Https://IP address will jump to Http://IP address/ssl/This address (later adjusted to WebService interface address)

Third, STARTSSL free SSL certificate trusted by the browser:

Like VeriSign, Startssl (website: http://www.startssl.com, company name: startcom) is also a CA agency,

Its root certificate has long been supported by browsers with open-source backgrounds (Firefox browser, Google Chrome browser, Apple Safari, etc.).

Iv. the project needs to redirect access to directory \services\ from HTTP access to HTTPS (workaround: Nginx rewrite plus location mode implementation)

/services/.*$ {        if ($server_port ~ "^80$"){ set $rule_0 1$rule_0; } if ($rule_0 = "1"){ rewrite /(.*) https://IP地址/$1 permanent; break; } }

Five, configure the end of the upload after using NGINX-T test configuration is correct reload the Nginx service check whether the 443 port is listening

/usr/Local/nginx/sbin/nginx-tnginx: The configuration file/usr/local/nginx/conf/nginx.conf Syntax is OK nginx:configuration file/usr/local/nginx/conf/nginx.conf Test is successful (shows no errors for configuration file) service Nginx Reload (Reload Nginx service) Netstat-lan | grep 443 (view 443 port) TCP 0 0 0.0. 0. 0:443 0.0. 0. 0:* LISTEN (see this line It means that HTTPS is already working.)                  

Nginx Configuration HTTPS