Nginx +location + HTTPS

wget http://nginx.org/packages/rhel/6/x86_64/RPMS/nginx-1.14.0-1.el6.ngx.x86_64.rpm (Download nginxrpm Management Pack)
RPM-IVH nginx-1.14.0-1.el6.ngx.x86_64.rpm (Installation nginx)

Start the experiment:

/etc/nginx/     ├── conf.d   （拓展文件）│?? ├── abc.conf│?? ├── default.conf│?? ├── efg.conf│?? └── error.conf├── fastcgi_params├── koi-utf├── koi-win├── mime.types├── modules -> ../../usr/lib64/nginx/modules├── nginx.conf   （主配文件）├── scgi_params├── uwsgi_params└── win-utf/usr/share/nginx/html/  （数据文件）├── 50x.html├── abc│?? └── index.html   ├── efg│?? └── index.html├── error│?? └── index.html└── index.html

**# 基于虚拟主机的两个网站**[[email protected] conf.d]# cat abc.conf efg.conf server {    listen       80;    server_name  www.abc.com;    #charset koi8-r;    #access_log  /var/log/nginx/host.access.log  main;    location / {        root   /usr/share/nginx/html/abc;        index  index.html index.htm;    }}server {    listen       80;    server_name  www.efg.com;    #charset koi8-r;    #access_log  /var/log/nginx/host.access.log  main;    location / {        root   /usr/share/nginx/html/efg;        index  index.html index.htm;    }}[[email protected] nginx]# vim nginx.conf     include /etc/nginx/conf.d/*.conf;charset utf-8;    （如果出现web访问显示中文乱码，写上这条，重启nginx）}

There is no problem accessing ABC and EFG, but if there is no corresponding virtual host for XYZ (the first virtual host is shown by default in ASCII order) Here we give him a false echo, see:

(How is this error page configured?) ）

[[email protected] conf.d]# vim error.conf server {    listen       80 default;  （只要找不到虚拟主机一律去error下面找）    #access_log  /var/log/nginx/host.access.log  main;    location / {        root   /usr/share/nginx/html/error;  （配置文件）        index  index.html index.htm;    }}

Location Match field (the path portion of the URL, which can be used with regular mates)

[[email protected] download]# vim /etc/nginx/conf.d/abc.conf server {    listen       80;    server_name  www.abc.com;    #charset koi8-r;    #access_log  /var/log/nginx/host.access.log  main;    location / {        root   /usr/share/nginx/html/abc;        index  index.html index.htm;    }        location /boke.html {     （这里的意思是去root boke目录里找boke.html这个文件URL最后面不能加/）        root   /usr/share/nginx/html/boke;    }

[[email protected] download]# vim /etc/nginx/conf.d/abc.conf         location /download/ {             （这里去html下面找download目录！！目录里面可以有文件，页面等等URL最后必须要加/）        root   /usr/share/nginx/html;    }}

* (How do I have to add/or not?) Not human, can use regular to solve)

[[email protected] download]# vim /etc/nginx/conf.d/abc.conf  location ~* /download.* {   （~* 不区分大小写，.*为正则匹配）        root   /usr/share/nginx/html;    }}

HTTPS

讲之前先看下公钥与私钥到底是个啥？[1](http://blog.51cto.com/2938638/809991)[2](http://blog.51cto.com/zhangyanfeng/1711250)

实验：自签名客户端                                                                                 CA1.创建私钥                                                                         1.有自己的私钥和证书2.根据私钥创建证书颁发请求  .csr                                     2.对证书颁发请求签名3.等CA中心授权签名通过，返回证书文件 .crt                   3.将证书发送给客户端4.根据KEY，CRT配置HTTPS站点

client [[email protected] keyes]# OpenSSL genrsa 2048 > Siyao.keys (Create private key) generating RSA private key, 2048 bit long m Odulus...............................................................................+++.+++e is 65537 (0x10001) [ [email protected] keyes]# chmod siyao.keys (give minimal permission) [[email protected] keyes]# OpenSSL req-new-key Siyao. Keys-out SIYAO.CSR (Create a certificate method request) You is about-is asked to-enter information that'll be incorporatedinto your Certifica Te request. What's about-to-enter is called a distinguished Name or a DN. There is quite a few fields but can leave some blankfor some fields there would be a default value,if you enter '. ', t He field would be a left blank.-----Country Name (2 letter code) [XX]:CN (country) state or province name (full name) []:shangha  I (province) Locality name (eg, city) [Default City]:shanghai (urban) Organization name (eg, company) [Default company Ltd]:boke (company name) organizational Unit name (eg, section) []:boke-cainiao (department)Common name (eg, your name or your server ' s hostname) []:www.abc.com (Rul to encrypt) email Address []:[email protected] (mail box) Please enter the following ' extra ' attributesto is sent with your certificate Requesta challenge password []: (Do not write here Password, CA where one will not open the password, self-signed. A optional company name []: (also skipped here) [[email protected] keyes]# LSSIYAO.CSR siyao.keys (Generate a. csr file) [[Email&nbs P;protected] keyes]# SCP SIYAO.CSR 192.168.1.115:/root (when I was using SCP to transfer files, I ran into a problem because I did NAT before.) The gateway blocks ICMP, and the policy is block return, so return a destination unreachable package to you. ) Ssh:connect to host 192.168.1.115 Port 22:no route to host[[email protected] keyes]# SCP SIYAO.CSR 192.168.1.115:/ Root (passed) The authenticity of host ' 192.168.1.115 (192.168.1.115) ' can ' t be established. RSA key fingerprint is CE:73:07:C4:4C:F3:2B:1B:21:C7:92:31:27:53:BE:CF. Is you sure want to continue connecting (yes/no)? yeswarning:permanently added ' 192.168.1.115 ' (RSA) to the list of known hosts. [email protected] ' s PASSWORD:SIYAO.CSR # CA-side [[EMAIL&NBSp;protected] ~]# OpenSSL genrsa-des3-out ca.key 4096 (Generate public private key, do self-signed) generating RSA private key, 4096 bit long modulus .... .... ++.......................++e is 65537 (0x10001) Enter The pass phrase for Ca.key: (self-signed),... ..... Password to remember, a self-signed process to use) Verifying-enter pass phrase for ca.key:[[email protected] ~]# lsanaconda-ks.cfg ca.key SIYAO.CSR [[email protected] ~]# OpenSSL req-new-x509-days 365-key ca.key-out ca.crt (self-signed) Enter pass phrase for Ca.key:Yo U is about to is asked to enter information that'll be incorporatedinto your certificate request. What's about-to-enter is called a distinguished Name or a DN. There is quite a few fields but can leave some blankfor some fields there would be a default value,if you enter '. ', t He field would be a left blank.-----Country Name (2 letter code) [Xx]:cnstate or province name (full name) []:shanghailocalit y name [eg, city] [default City]:shanghai Organization Name (eg, company) [Default company] Ltd]:nsa organizational Unit name (eg, section) []:FBI Common name (eg, your name or your server ' s hostname) []:www. Boke.comemail Address []:[[email protected] ~]# lsanaconda-ks.cfg ca.crt Ca.key siyao.csr[[email protected] ~]# OpenSSL x509-req-days 365-in siyao.csr-ca ca.crt-cakey ca.key-set_serial 01-out SIYAO.CRT (certificate issued to clients) Signature Oksubject=/c=cn/st=shanghai/l=shanghai/o=boke/ou=boke-cainiao/cn=www.abc.com/[email protected]getting CA Private Keyenter pass phrase for ca.key:[[email protected] ~]# lsanaconda-ks.cfg ca.crt ca.key siyao.crt Siyao.cs R[[email protected] ~]# SCP siyao.crt 192.168.1.3:/etc/pki/ca/keyes (back to client) the authenticity of host ' 192.168.1.3 ( 192.168.1.3) ' can ' t be established. RSA Key fingerprint is bd:4d:15:99:19:a7:d7:fb:6e:0a:91:b0:b7:62:04:73.are your sure you want to continue connecting (yes/n o)? yeswarning:permanently added ' 192.168.1.3 ' (RSA) to the list of known hosts. [email protected] ' s PASSWORD:SIYAO.CRT 100% 1590 1.6kb/s 00:00 [[email protected] ~]# lsanaconda-ks.cfg ca.crt ca.key siyao.crt SIYAO.CSR client Keyes to have private key, public key, certificate [[Email pro Tected] keyes]# lssiyao.crt SIYAO.CSR siyao.keys[[email protected] keyes]# pwd/etc/pki/ca/keyes

Finally, configure HTTPS.

[[email protected] conf.d]# vim abc.conf server {        listen  443 ssl;        server_name     www.abc.com;        ssl_certificate /etc/pki/CA/keyes/siyao.crt;  （证书）        ssl_certificate_key     /etc/pki/CA/keyes/siyao.keys; （私钥）        ssl_protocols   TLSv1  TLSv1.1  TLSv1.2; （协议）        ssl_ciphers     HIGH:!aNULL:!MD5;        root /usr/share/nginx/html/abc;        index index.html;}

I'm using Chrome's browser here:
Google Browser See here

这里显示不安全，但是能看到内容，大神给讲下吧，有点迷。----------下次分享下nginx的rewrite和反向代理和缓存。。

Nginx +location + HTTPS