Nginx加载https模块，并配置自行颁发的SSL证书【测试成功】

艺帆风顺 发布于 2025-04-02 16 次阅读

，一、检查是否安装SSL模块

    nginx -V   #没有弹出--with-http_ssl_module相关信息则表示不支持https

    [root@host-192-168-66-18 ~]# /usr/local/nginx/sbin/nginx -Vnginx version: nginx/1.24.0built by gcc 7.3.0 (GCC) configure arguments: --prefix=/usr/local/nginx

    二、原有配置加载https模块

        1、安装SSL依赖环境

            yum install openssl openssl-devel

        2、切换到源码解压目录

            cd  /usr/local/nginx/nginx-1.24.0

            重新编译：

      ./configure --prefix=/usr/local/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --pid-path=/usr/local/nginx/conf/nginx.pid --lock-path=/usr/local/nginx/lock/nginx.lock./configure --prefix=/usr/local/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --pid-path=/usr/local/nginx/conf/nginx.pid --lock-path=/usr/local/nginx/lock/nginx.lock --with-http_ssl_module

      3、执行make

          此处不要执行make install ，否则会覆盖安装。

      4、覆盖nginx执行文件

          cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak

      5、再次查看是否加载成功，弹出SSL信息则加载成功

          /usr/local/nginx/sbin/nginx -V

        [root@host-192-168-66-18 sbin]# /usr/local/nginx/sbin/nginx -Vnginx version: nginx/1.24.0built by gcc 7.3.0 (GCC) built with OpenSSL 1.1.1f 31 Mar 2020TLS SNI support enabledconfigure arguments: --prefix=/usr/local/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --pid-path=/usr/local/nginx/conf/nginx.pid --lock-path=/usr/local/nginx/lock/nginx.lock --with-http_ssl_module

        三、配置https

        1、生成ssl证书（略）

        2、查看nginx配置文件（未使用https）

          server { listen 80; client_max_body_size 600M; fastcgi_buffers 8 4K; fastcgi_buffer_size 4K; client_body_buffer_size 1024k; root /data/zhdj/frontends/dist;
           location / { try_files $uri $uri/ /index.html; index index.html; } location ^~ /api/ {# proxy_pass http://sw-chatbot.tumorcompass.com; proxy_set_header Host "sw-chatbot.tumorcompass.com"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
           location ^~ /oauth2/ { proxy_pass http://183.67.4.66:8868; }
           location ^~ /yinling/ { default_type application/json; add_header Content-Type 'application/json; charset=utf-8'; if ($request_method = 'OPTIONS') { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS; add_header Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization; return 204; } if ($request_method != 'OPTIONS') { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization; add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS; proxy_pass http://119.29.146.251:9500; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Port $server_port; proxy_set_header Host "ptbd-admin.erp12580.com"; proxy_connect_timeout 1200s; proxy_send_timeout 1200s; proxy_read_timeout 1200s; }

           location @router { rewrite ^.*$ /index.html last; }
           error_page 500 502 503 504 /50x.html;
           location = /50x.html { root html; }}

          3、加入Https配置文件内容：

            server { listen 443 ssl; client_max_body_size 600M; fastcgi_buffers 8 4K; fastcgi_buffer_size 4K; client_body_buffer_size 1024k; root /data/zhdj/frontends/dist;
             ssl_certificate /data/nginx/ssl/zhdj.crt; ssl_certificate_key /data/nginx/ssl/zhdj.key;
             location / { try_files $uri $uri/ /index.html; index index.html; }
             # 其他 location 配置...
             location ^~ /api/ { proxy_pass http://sw-chatbot.tumorcompass.com; proxy_set_header Host "sw-chatbot.tumorcompass.com"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
             location ^~ /oauth2/ { proxy_pass http://183.67.4.66:8868; }
             location ^~ /yinling/ { default_type application/json; add_header Content-Type 'application/json; charset=utf-8'; if ($request_method = 'OPTIONS') { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS; add_header Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization; return 204; } if ($request_method != 'OPTIONS') { add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization; add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS; proxy_pass http://119.29.146.251:9500; } proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Port $server_port; proxy_set_header Host "ptbd-admin.erp12580.com"; proxy_connect_timeout 1200s; proxy_send_timeout 1200s; proxy_read_timeout 1200s; }
             location @router { rewrite ^.*$ /index.html last; }
             error_page 500 502 503 504 /50x.html;
             location = /50x.html { root html; }}

            此时，实现了

            http://192.168.3.200和https://192.168.3.200地址的共存访问。

            四、将80端口的http流量全部转发到https

                新建nginx配置文件：

              server { listen 80; server_name 127.0.0.1;
               rewrite ^(.*)$ https://192.168.3.200/login permanent;}

                  实现了80端口过来的所有流量，转发到https://192.168.3.200/login