nginx搭建https單向認證

標籤：nginx搭建https單向認證

一）預設情況下ssl模組並未被安裝，如果使用該模組則需要在編譯nginx的時指定--with-http_ssl_module參數。

wget http://nginx.org/download/nginx-1.3.16.tar.gz

tar -xf nginx-1.3.16.tar.gz -C /usr/local/

cd /usr/local/nginx-1.3.16/

./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre 

make

make install

http://192.168.254.103/      測試

cd /usr/loca/nginx/conf  進入到想建立認證和私密金鑰的目錄

[[email protected] conf]# openssl genrsa -des3 -out server.key 1024   建立伺服器私密金鑰，輸入一個口令

Enter pass phrase for server.key:123456

Verifying - Enter pass phrase for server.key:123456

[[email protected] conf]# openssl req -new -key server.key -out server.csr 建立簽章要求的認證（CSR）

Enter pass phrase for server.key:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.‘, the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:BeiJing

Locality Name (eg, city) [Default City]:ChangPing

Organization Name (eg, company) [Default Company Ltd]:Leay

Organizational Unit Name (eg, section) []:Linux

Common Name (eg, your name or your server‘s hostname) []:ca.Leay.com

Email Address []:[email protected]

Please enter the following ‘extra‘ attributes

to be sent with your certificate request

A challenge password []:123456

An optional company name []:Leay

在載入ssl支援的nginx並使用上述私密金鑰時除去必須的口令：

[[email protected] conf]#  cp server.key server.key.org

[[email protected] conf]# openssl rsa -in server.key.org -out server.key

Enter pass phrase for server.key.org:123456

writing RSA key

最後標記認證使用上述私密金鑰的CSR：

[[email protected] conf]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Signature ok

subject=/C=CN/ST=BeiJing/L=ChangPing/O=Leay/OU=Linux/CN=ca.Leay.com/[email protected]

Getting Private key

修改nginx的設定檔，讓其包含新標記的認證和私密金鑰

server {

        listen       80;

        server_name  www.bill.com;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {

            root   html;

            index  index.html index.htm;

        }

    # HTTPS server

    #

    server {

        listen       443;

        server_name  www.bill.com;

        ssl                  on;

        ssl_certificate      /usr/local/nginx/conf/server.crt;

        ssl_certificate_key  /usr/local/nginx/conf/server.key;

    #    ssl_session_timeout  5m;

    #    ssl_protocols  SSLv2 SSLv3 TLSv1;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;

    #    ssl_prefer_server_ciphers   on;

        location / {

            root   html;

            index  index.html index.htm;

        }

    }

} 

重啟nginx

[[email protected] conf]# /usr/local/nginx/sbin/nginx -s reload

物理機訪問的時候需要在本地的hosts檔案中添加網域名稱的解析

http://www.bill.com 訪問的是80連接埠

通過https://www.bill.com訪問的是443連接埠

本文出自 “落葉飄遠方” 部落格，請務必保留此出處http://shunzi.blog.51cto.com/8289655/1536055