Nginx配置https访问

一、利用openssl生成自签名证书
1、进入你想创建证书和私钥的目录
[root@web ~]# cd /application/nginx/key

2、创建服务器私钥，命令会让你输入一个口令：
[root@web key]# openssl genrsa -des3 -out server.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
................................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

3、创建签名请求的证书（CSR）：
[root@web key]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key: ← 输入生成server.key文件时的密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN ← 国家名称，中国输入CN
State or Province Name (full name) [Some-State]:BeiJing ← 省名，拼音
Locality Name (eg, city) []:BeiJing ← 市名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany Corp. ← 公司英文名
Organizational Unit Name (eg, section) []: ← 可以不输入
Common Name (eg, YOUR name) []:www.mycompany.com ← 服务器主机名，若填写不正确，浏览器会报告证书无效，但并不影响使用
Email Address []:admin@mycompany.com ← 电子邮箱，可随便填
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: ← 可以不输入
An optional company name []: ← 可以不输入

4、在Nginx上使用上述私钥时除去口令：
[root@web key]# cp server.key server.key.bak #备份一份带口令的server.key文件
[root@web key]# openssl rsa -in server.key -out server.key

5、最后使用上述私钥和CSR生成证书(-days:指定证书有效期为365天)：
[root@web key]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

二、nginx配置
[root@web conf]# cat nginx.conf

server {
	listen 443;
	server_name www.nginx.com;
	access_log logs/access.log main;
			
	ssl on;
	ssl_certificate /application/nginx/server.crt; 
	ssl_certificate_key /application/nginx/server.key; 
			
	ssl_session_timeout 5m;
	location /echo {
	    #proxy_pass http://10.47.39.7:80;
		#proxy_set_header Host $host;
		#proxy_set_header X-Forwarded-For $remote_addr;
		#rewrite ^(.*) https://www.baidu.com permanent;
		#rewrite ^(.*) https://www.baidu.com redirect;
	    #if ( $uri ~ "[0-9]" ){
		# rewrite ^(.*) http://10.47.39.7:80/abc/1234/index.html;
		# break;
		#}
		default_type text/html;
		set $foo 'hello world';
		echo "$request_uri";
		echo </br>$foo;
		echo </br>$server_protocol;
		}
	}
}

https://freessl.org/
https://letsencrypt.osfipin.com/     #免费申请ssl证书