nginx添加ssl证书升级为https(免费证书)

1

琢磨着想弄一个小程序玩玩,所以根据小程序接口要求,必须要有https,遂加ssl之
免费证书自己可以百度,我选择了certbot,阿里云也有免费证书,这个随便选择,重要的是实现过程。

1、证书获取

clipboard.png

根据网站上面提示步骤一一实现,不过我在第五步选择了下面的方式,因为我nginx是自己源码安装的

clipboard.png

注意一下生成的证书位置

clipboard.png

2、nginx修改

clipboard.png

server {
    listen 443 ssl;
    server_name www.***.com;
    root /www/****/****;
    index index.html index.htm index.php;
    ssl_certificate /etc/letsencrypt/live/www.***.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.***.com/privkey.pem;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
  location ~* \.(png|jpg|jpeg|gif|css|js|html)$ {
    try_files $uri $uri/ =404;
  }
 location / {
        try_files $uri $uri/ /index.php$is_args$query_string;
    }

  location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
  }
}
server {
    listen 80;
    server_name www.***.com;
    rewrite ^(.*)$ https://$host$1 permanent;
}
3、重启nginx测试网站,很nice

clipboard.png

4、坑点
tip nginx: [error] invalid PID number "" in "/usr/local/nginx/logs/nginx.pid

nginx启动没有指定配置文件,启动时添加参数即可

/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf

tip [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead
写法问题,网上找到的很多ssl写法都是:

listen 443;
ssl on;

正确写法:

listen 443 ssl;
tip nginx: [emerg] unknown directive "ssl" in /usr/local/nginx/conf/vhosts/testssl.conf:4
nginx缺少ssl模块

解决方法:
① 到源码目录添加ssl模块 ./configure --with-http_ssl_module
如果需要openssl则安装yum -y install openssl openssl-devel,安装完毕再./configure
② make编译
③ 之前的文件备份:mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.pre
④ 新文件引入:cp objs/nginx /usr/local/nginx/sbin/nginx
⑤ 查看是否安装./sbin/nginx -V
v是大写
⑥ 重启nginx查看


如果觉得我的文章对你有用,请随意赞赏

你可能感兴趣的

载入中...