Nginx部署SSLHTTPS

Nginx ssl部署
一、创建CA，自制CA证书
1、安装openssl openssl-devel
yum -y install openssl openssl-devel
2、查看openssl.cnf文件 cat /etc/pki/tls/openssl.cnf

3、生成CA私钥
(umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048) -----生成的私钥名字必须为cakey.pem,同时要在此路径下
4、生成CA自签证书
openssl req -new -x509 -key cakey.pem -out /etc/pki/CA/cacert.pem -days 365 -----生成的证书名字必须为cakey.pem,同时要在此路径下
5、在此目录下创建两个文件
cd /etc/pki/CA
touch index.txt
echo 01 > serial

二、Nginx服务端生成密钥及证书签署文件
1、安装openssl openssl-devel
yum -y install openssl openssl-devel
2、服务器端生成秘钥
cd /application/Nginx/key && (umask 077;openssl genrsa -out Nginx.key 2048)
3、生成证书签署文件
openssl req -new -key /application/Nginx/key/Nginx.key -out Nginx.csr

三、根据Nginx.csr，让CA签署生成证书
openssl ca -in Nginx.csr -out /etc/pki/CA/certs/Nginx.crt -days 365

四、安装Nginx（编译安装Nginx如出现配置Nginx文件出现：Nginx:[emerg]unkNown directive ssl错误，要进入到解压包内：./configure --with-http_ssl_module //重新添加这个ssl模块，执行make，再从objs中的Nginx文件拷贝到对应的启动目录下面，启动就可以了）
yum install Nginx

五、配置Nginx
server {
listen 443;
server_name localhost;
access_log /var/log/Nginx/access.log;
charset utf-8;
gzip on;
gzip_buffers 32 4K;
gzip_comp_level 6;
gzip_min_length 4000;

ssl on;
ssl_certificate /application/Nginx/key/Nginx.crt;
ssl_certificate_key /application/Nginx/key/Nginx.key;

ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;

location / {
include uwsgi_params;
uwsgi_connect_timeout 30;
uwsgi_pass 127.0.0.1:8888;
uwsgi_ignore_client_abort on;
}
location /static {
alias /data/wwwroot/PD/static/;

}

}