基于openresty配置https访问

安装方法：http://openresty.org/cn/linux-packages.html

1. openssl的版本信息

[root@localhost conf]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

2. openresty的版本信息

[root@localhost sbin]# ./nginx -V

3. 创建服务器私钥，命令会提醒输入一个密码，必须输入（在nginx的conf所在的路径下进行操作，当然也可以在其他路径，需要配合后续的nginx的配置一起改变）

[root@localhost conf]# openssl genrsa -des3 -out server.key
Generating RSA private key,  bit long modulus
..............................................................++
........................++
e is  (0x10001)
Enter pass phrase for server.key:
:error::lib():UI_set_result:result too small:ui_lib.c::You must type in  to  characters
Enter pass phrase for server.key:
:error::lib():UI_set_result:result too small:ui_lib.c::You must type in  to  characters
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
[root@localhost conf]# ll
总用量
-rw-r--r--.  root root  3月    : fastcgi.conf
-rw-r--r--.  root root  3月    : fastcgi.conf.default
-rw-r--r--.  root root  3月    : fastcgi_params
-rw-r--r--.  root root  3月    : fastcgi_params.default
-rw-r--r--.  root root  3月    : koi-utf
-rw-r--r--.  root root  3月    : koi-win
-rw-r--r--.  root root  3月    : mime.types
-rw-r--r--.  root root  3月    : mime.types.default
-rw-r--r--.  root root  3月   : nginx.conf
-rw-r--r--.  root root  3月    : nginx.conf.default
-rw-r--r--.  root root   3月    : scgi_params
-rw-r--r--.  root root   3月    : scgi_params.default
-rw-r--r--   root root  7月   : server.key
-rw-r--r--.  root root   3月    : uwsgi_params
-rw-r--r--.  root root   3月    : uwsgi_params.default
-rw-r--r--.  root root  3月    : win-utf

4. 创建签名请求的证书（CSR）

[root@localhost conf]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name ( letter code) [XX]:cn
State or Province Name (full name) []:hubei
Locality Name (eg, city) [Default City]:wuhan
Organization Name (eg, company) [Default Company Ltd]:tk
Organizational Unit Name (eg, section) []:iflab
Common Name (eg, your name or your server's hostname) []:root
Email Address []:shihuc@.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:shihuc
An optional company name []:tk
[root@localhost conf]#

5. 在加载SSL支持的Nginx服务器上，使用上述私钥时除去必须的口令（注意，所谓除去，其实就是将必须的私钥密码写入到了私钥文件里面了，更新了原来的私钥文件）

[root@localhost conf]# cp server.key server.key.org
[root@localhost conf]#
[root@localhost conf]# openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:
writing RSA key
[root@localhost conf]# 

6. 通过openssl的x509指令生产证书文件

[root@localhost conf]# openssl x509 -req -days  -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=cn/ST=hubei/L=wuhan/O=tk/OU=iflab/CN=root/emailAddress=shihuc@.com
Getting Private key

7. nginx的简单配置

# HTTPS server
#
server {
    listen        ssl;
    server_name  localhost;

    ssl_certificate      server.crt;
    ssl_certificate_key  server.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        root   html/SSLROOT;
        index  index.html index.htm;
    }
}

在nginx的html目录下，创建SSLROOT目录，并在下面创建一个index.html的页面，用于测试。

8. 一个用于转发的nginx.conf文件

worker_processes        ;
error_log       logs/error.log;
events {
        worker_connections ;
}

http {
        keepalive_timeout       ;
        sendfile        on;

        log_format      main    '$remote_addr - $remote_user [$time_local] "$request" '
                                '$status $body_bytes_sent "$http_referer" '
                                '"$http_user_agent" "$http_x_forwarded_for"';

        server {
        listen        ssl;
#       listen      ssl;
        server_name  localhost;

        ssl_certificate      kaili.axinfu.com.crt;
        ssl_certificate_key  kaili.axinfu.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
                root   html/SSLROOT;
                index  index.html index.htm;
                 # 开启白名单，根据需求替换
                allow 127.0.0.1;
                allow 192.168.11.10;
                deny all;

                 #反向代理,根据需求替换
                proxy_pass      http://192.168.11.10:9581;
                proxy_set_header        Host    $host;
                proxy_set_header        X-Forwarded-For $remote_addr;
        }
        }
}

参考：https://www.cnblogs.com/shihuc/p/7150900.html