架构（day20）

nginx实现https

HTTPS作用

数据加密传输

OSI七层模型：表示层加密/解密

证书申请流程

证书类型介绍

对比	域名型DV	企业型OV	增强型EV
地址栏	锁标记+绿色https	锁标记+绿色https	锁标记+绿色https+企业名称（logo）
用途	个人网站	电子商务网站，中小型企业	大型金融平台，大公司，政府机构
审核内容	域名所有权验证	全面的企业身份验证； 域名所有权验证	最高等级的企业身份验证； 域名所有权验证
颁发时长	不到10分钟	3-5个工作日	5-7个工作日
首次申请年限	1年	1-2年	1-2年
赔付保障金	..	125-175万美金	150-175万美金

证书购买

• 单域名

• 只能单个域名使用

• ​​www.wjh.com​​

• 混合域名

• 多个域名都可以使用该证书

• ​​www.wjh.com​​ www.wu.com

• 泛域名

• 通配符域名证书

• *.wjh.com

• ​​www.wjh.com​​
• blog.wjh.com
• ***.wjh.com

HTTPS注意事项

1.证书过期，无法续费

2.三级域名无法使用https

3.注意证书的颜色：

• 绿色：全站的URL都是https加密的
• 红色：假证书或者证书过期
• 黄色：并非全站URL都是https加密的

单台nginx实现HTTPS

# 编辑nginx配置文件
 [root@web01 ~]# vim /etc/nginx/conf.d/test.wjh.com.conf
 server{
         listen 80;
         server_name test.wjh.com;
         root /code/test;
         index index.html;
 }
 
 # 检查并重启nginx
 [root@web01 ~]# nginx -t
 [root@web01 ~]# systemctl reload nginx
 
 # 创建站点目录
 [root@web01 ~]# mkdir /code/test/
 
 # 部署代码
 [root@web01 ~]# echo 'test https web01' > /code/test/index.html
 
 # 域名解析
 10.0.0.7 test.wjh.com
 # 访问浏览器：http://test.wjh.com/

跟CA机构申请证书

[root@web01 ~]# openssl genrsa -idea -out server.key 2048
 Generating RSA private key, 2048 bit long modulus
 ...............+++
 ...........+++
 e is 65537 (0x10001)
 Enter pass phrase for server.key: 1234
 Verifying - Enter pass phrase for server.key: 1234
 
 ## 当前所在目录会生成证书
 [root@web01 ~]# ll
 -rw-r--r-- 1 root root 1739 Jun 22 19:03 server.key
 
 ## 跟CA机构填写个人信息，签发证书
 [root@web01 code]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
 Generating a 2048 bit RSA private key
 ..............................................................................................+++
 ...+++
 writing new private key to 'server.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [XX]:CN
 State or Province Name (full name) []:Shanghai
 Locality Name (eg, city) [Default City]:Shanghai
 Organization Name (eg, company) [Default Company Ltd]:oldboy
 Organizational Unit Name (eg, section) []:oldboy
 Common Name (eg, your name or your server's hostname) []:test.wjh.com
 Email Address []:[e-mail]
 
 
 ## 国家代码 简写，2个字符
 Country Name (2 letter code) [XX]:CN
 ## 所在省
 State or Province Name (full name) []:Shanghai
 ## 城市名字
 Locality Name (eg, city) [Default City]:Shanghai
 ## 公司名字
 Organization Name (eg, company) [Default Company Ltd]:oldboy
 ## 公司名字
 Organizational Unit Name (eg, section) []:oldboy
 ## 域名
 Common Name (eg, your name or your server's hostname) []:test.wjh.com
 ## 邮箱
 Email Address []:[e-mail]
 
 ## 查看证书文件
 [root@web01 ~]# ll
 -rw-r--r-- 1 root root 1411 Jun 22 19:10 server.crt
 -rw-r--r-- 1 root root 1708 Jun 22 19:10 server.key

配置ssl证书语法

#启动ssl功能
 Syntax: ssl on | off;
 Default: ssl off;
 Context: http,server
 
 #证书文件
 Syntax: ssl_certificate file;
 Default: -
 Context: http,server
 
 #私钥文件
 Syntax: ssl_certificate_key file;
 Default: -
 Context: http,server

修改nginx配置文件

# 1.创建证书存放的目录
 [root@web01 ~]# mkdir /etc/nginx/ssl
 [root@web01 ~]# mv server.* /etc/nginx/ssl/
 
 [root@web01 ~]# ll /etc/nginx/ssl/
 total 8
 -rw-r--r-- 1 root root 1411 Jun 22 19:10 server.crt
 -rw-r--r-- 1 root root 1708 Jun 22 19:10 server.key
 
 # 2.配置nginx证书（老语法）
 [root@web01 ~]# vim /etc/nginx/conf.d/test.wjh.com.conf
 server{
         listen 443;
         server_name test.zls.com;
         root /code/test;
         index index.html;
         ssl on;
         ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 }
 
 [root@web01 ~]# nginx -t
 nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/test.zls.com.conf:6
 nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
 nginx: configuration file /etc/nginx/nginx.conf test is successful
 
 # 3.配置证书新语法
 [root@web01 ~]# vim /etc/nginx/conf.d/test.wjh.com.conf
 server{
         listen 443 ssl;
         server_name test.wjh.com;
         root /code/test;
         index index.html;
         ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 }
 
 # 4.检测语法，重启nginx
 [root@web01 ~]# nginx -t
 nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
 nginx: configuration file /etc/nginx/nginx.conf test is successful
 [root@web01 ~]# systemctl reload nginx
 
 # 5.浏览器访问：https://test.wjh.com/

使用rewrite协议跳转

[root@web01 ~]# vim /etc/nginx/conf.d/test.wjh.com.conf
 
 server{
         listen 80 ;
         server_name test.wjh.com;
         rewrite (.*) https://test.wjh.com$1 redirect;
 }
 
 server{
         listen 443 ssl;
         server_name test.wjh.com;
         root /code/test;
         index index.html;
         ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 }
 
 
 [root@web01 ~]# vim /etc/nginx/conf.d/test.wjh.com.conf
 server{
         listen 80 ;
         server_name test.wjh.com;
         #rewrite (.*) https://test.wjh.com$1 redirect;
         return 302 https://$server_name$request_uri;
 }
 
 server{
         listen 443 ssl;
         server_name test.wjh.com;
         root /code/test;
         index index.html;
         ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 }

给wordpress博客加证书

## 在ssl目录下生成证书
 [root@web01 ssl]# openssl genrsa -idea -out server.key 2048
 Generating RSA private key, 2048 bit long modulus
 ......................................+++
 .........................................................................................................................................+++
 e is 65537 (0x10001)
 Enter pass phrase for server.key:  1234
 Verifying - Enter pass phrase for server.key:  1234
 
 [root@web01 ssl]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt
 Generating a 2048 bit RSA private key
 .............+++
 ................................................................+++
 writing new private key to 'server.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [XX]:CN        
 State or Province Name (full name) []:Shanghai
 Locality Name (eg, city) [Default City]:Shanghai
 Organization Name (eg, company) [Default Company Ltd]:oldboy
 Organizational Unit Name (eg, section) []:oldoboy
 Common Name (eg, your name or your server's hostname) []:blog.wjh.com
 Email Address []:[e-mail]
 
 ## 配置nginx配置文件
 server{
         listen 80;
         server_name blog.wjh.com;
         rewrite (.*) https://blog.wjh.com$1 redirect;
 }
 server{
         listen 443 ssl;
         server_name blog.wjh.com;
         root /blog/wordpress;
         index index.php index.html;
         ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 
         location / {
                 if ( -f $request_filename/index.html ){
                         rewrite (.*) $1/index.html break;
                 }
                 if ( -f $request_filename/index.php ){
                         rewrite (.*) $1/index.php;
                 }
                 if ( !-f $request_filename ){
                         rewrite (.*) /index.php;
                 }
         }
 }

解决php破图现象

[root@web01 conf.d]# cat blog.wjh.com.conf 
 server{
         listen 80;
         server_name blog.wjh.com;
         rewrite (.*) https://blog.wjh.com$1 redirect;
 }
 server{
     listen 443 ssl;
     server_name blog.wjh.com;
     root /blog/wordpress;
     index index.php index.html;
     ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 
     location / {    
         if ( -f $request_filename/index.html ){
         rewrite (.*) $1/index.html break;
         }
         if ( -f $request_filename/index.php ){
         rewrite (.*) $1/index.php;
         }
         if ( !-f $request_filename ){
         rewrite (.*) /index.php;
         }
     }
 
     location ~ \.php$ {
         fastcgi_pass unix:/dev/shm/php.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         ## 让nginx访问php时，也要使用https
         fastcgi_param HTTPS on;
         include /etc/nginx/fastcgi_params;
     }
 }

多台nginx配置ssl证书

[root@lb01 conf.d]# vim test.wjh.com_proxy.conf 
 upstream test_wjh_com {
     server 172.16.1.7;
     server 172.16.1.8;
 }
 
 server {
     listen 80;
     server_name test.wjh.com;
     rewrite (.*) https://test.wjh.com$1 redirect;
 }
 
 server {
     listen 443 ssl;
     server_name test.wjh.com;
     ssl_certificate ssl/server.crt;
         ssl_certificate_key ssl/server.key;
 
     location /{
         proxy_pass http://test_wjh_com;
         include proxy_params;
     }
 }
 
 
 ## 创建ssl目录
 [root@lb01 ~]# mkdir /etc/nginx/ssl
 
 ## 将证书放在负载均衡服务器的/etc/nginx/ssl
 [root@web01 conf.d]# scp /etc/nginx/ssl/* 172.16.1.5:/etc/nginx/ssl
 
 ## 配置web01和web02
 [root@web01 conf.d]# cat test.wjh.com.conf 
 server{
         listen 80 ;
         server_name test.wjh.com;
     root /code/test;
     index index.html;
 }
 
 
 [root@web02 test]# cat /etc/nginx/conf.d/test.wjh.com.conf 
 server{
         listen 80;
         server_name test.wjh.com;
         root /code/test;
         index index.html;
 }

ssl优化参数

ssl_session_cache shared:SSL:10m; #在建立完ssl握手后如果断开连接，在session_timeout时间内再次连接，是不需要再次获取公钥建立握手的，可以服用之前的连接
 ssl_session_timeout 1440m; #ssl连接断开后的超时时间
 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #配置加密套接协议
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; #使用TLS版本协议
 ssl_prefer_server_ciphers on; #nginx决定使用哪些协议与浏览器通信
 
 
 
 
 
 [root@lb01 conf.d]# cat test.wjh.com_proxy.conf 
 upstream test_wjh_com {
     server 172.16.1.7;
     server 172.16.1.8;
 }
 
 server {
     listen 80;
     server_name test.wjh.com;
     rewrite (.*) https://test.wjh.com$1 redirect;
 }
 
 server {
     listen 443 ssl;
     server_name test.wjh.com;
     ssl_certificate ssl/server.crt;
     ssl_certificate_key ssl/server.key;
     ssl_session_cache shared:SSL:10m; #在建立完ssl握手后如果断开连接，在session_timeout时间内再次连接，是不需要再次获取公钥建立握手的，可以服用之前的连接
     ssl_session_timeout 1440m; #ssl连接断开后的超时时间
     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; #配置加密套接协议
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; #使用TLS版本协议
     ssl_prefer_server_ciphers on; #nginx决定使用哪些协议与浏览器通信
 
     location /{
         proxy_pass http://test_wjh_com;
         include proxy_params;
     }
 }

阿里云证书配置