Nginx配置PFX数字证书

原创

herlly 2023-05-08 08:23:31 博主文章分类：SRE ©著作权

©著作权归作者所有：来自51CTO博客作者herlly的原创作品，请联系作者获取转载授权，否则将追究法律责任

1、简介

pfx格式的数字证书是包含有私钥的
cer格式的数字证书里面只有公钥没有私钥

2、安装ssl模块

# 转换成crt格式证书
openssl pkcs12 -in /usr/local/nginx/ssl/xxx.pfx -clcerts -nokeys -out /usr/local/nginx/ssl/xxx.crt
openssl pkcs12 -in /usr/local/nginx/ssl/xxx.pfx -nocerts -nodes -out /usr/local/nginx/ssl/xxx.rsa

3、验证证书可用性

openssl s_server -www -accept 443 -cert/usr/local/nginx/ssl/xxx.crt -key /usr/local/nginx/ssl/xxx.rsa

4、配置

server {  
    listen 443;  
    server_name localhost;
    ssl on;  
    ssl_certificate /usr/local/nginx/ssl/xxx.crt;  
    ssl_certificate_key /usr/local/nginx/ssl/xxx.rsa;  
    ssl_session_timeout 5m;  
    ssl_protocols SSLv2 SSLv3 TLSv1;  
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;  
    ssl_prefer_server_ciphers on;  
    location ~ /api/(.*) {
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Ssl on;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://serverAPI;
        }
    }