nginx ssl 自签证书实验

两台服务器

11.11.11.3     （生成证书然后到CA服务上注册）

11.11.11.4    （nginx服务、CA证书签发）

1、建立CA服务器（11.3）

、在CA上生成私钥文件 在/etc/pki/CA/private
[root@ca]# cd /etc/pki/CA/
[root@ca CA]# (umask ;openssl genrsa -out private/cakey.pem )

、在CA上生成自签署证书  必须在/etc/pki/CA目录下
[root@ca CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days
-new 为生成新的证书，会要求用户填写相关的信息
-x509 通常用于自签署证书，生成测试证书或用于CA自签署
-key私钥位置
-days申请的天数（默认30天）
-out生成位置

Country Name ( letter code) [XX]:CN
State or Province Name (full name) []:HeNan
Locality Name (eg, city) [Default City]:Zhengzhou
Organization Name (eg, company) [Default Company Ltd]:yanqi
Organizational Unit Name (eg, section) []:system
Common Name (eg, your name or your server's hostname) []:cahost.zzidc.com
Email Address []:@qq.com

[root@ca CA]# touch index.txt
[root@ca CA]# echo 01 > serial

2、给http服务器发放证书

[root@nginx ~]# mkdir /etc/nginx/ssl
[root@nginx ~]# cd /etc/nginx/ssl/
[root@nginx ssl]# (umask ; openssl genrsa -out nginx.key )

[root@nginx ssl]# openssl req -new -key nginx.key -out nginx.csr
#信息跟CA上生成的保持一致
Country Name ( letter code) [XX]:CN
State or Province Name (full name) []:HeNan
Locality Name (eg, city) [Default City]:Zhengzhou
Organization Name (eg, company) [Default Company Ltd]:yanqi
Organizational Unit Name (eg, section) []:system
Common Name (eg, your name or your server's hostname) []:cahost.zzidc.com
Email Address []:@qq.com

[root@nginx ssl]# scp nginx.csr 11.11.11.3:/tmp/

3、在CA上给http服务器签署证书

[root@ca ~]# openssl ca -in /tmp/nginx.csr -out /etc/pki/CA/certs/nginx.crt -days
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:  (0x1)
        Validity
            Not Before: Feb  ::  GMT
            Not After : Feb  ::  GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HeNan
            organizationName          = yanqi
            organizationalUnitName    = system
            commonName                = cahost.zzidc.com
            emailAddress              = @qq.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                :4E:B6:B5:C2:B8:B8:3F:B4:E7::::D3:E8:3A::::
            X509v3 Authority Key Identifier:
                keyid:6B::D0:CD:C9:1A::7E:3B::EC:BE:6B:AB:E4::2C::2A:

Certificate is to be certified until Feb  ::  GMT ( days)
Sign the certificate? [y/n]:y

 out of  certificate requests certified, commit? [y/n]y
Write out database with  new entries
Data Base Updated
[root@ca ~]# 

4、生成完需要拷贝到http服务器上  也用scp命令

[root@ca ~]# scp /etc/pki/CA/certs/nginx.crt 11.11.11.4:/etc/nginx/ssl

5、nginx配置

[root@nginx ~]# vim /etc/nginx/conf.d/vhost_ssl.conf
server {
  listen  ssl;
  server_name cahost.zzidc.com;
  root /data/nginx/vhost1;
  access_log /var/log/nginx/vhost1_ssl_access.log main;

  ssl on;
  ssl_certificate /etc/nginx/ssl/nginx.crt;
  ssl_certificate_key /etc/nginx/ssl/nginx.key;
  ssl_protocols sslv3 TLSv1 TLSv1. TLSv1.;
  ssl_session_cache   shared:SSL:10m;    #共享session内存空间为10M,1M的会话为4千；这个是4万
  ssl_session_timeout 10m;
}

[root@nginx conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

[root@nginx conf.d]# service nginx restart
Redirecting to /bin/systemctl restart nginx.service

[root@nginx conf.d]# netstat -luntp|grep
tcp               0.0.0.0:             0.0.0.0:*               LISTEN      /nginx: mas