全站HTTPS配置 | 安云网

发表评论
394 次浏览

A+

所属分类：系统文档

鉴于很多同学对https配置不太熟悉，至此写个教程

打开阿里云控制台SSL证书应用
进入后点击SSL证书 -> 免费证书 -> 立即购买

完成后点击创建证书 -> 证书申请
填写好你的相关信息等待申请成功
申请成功后点击下载
选择nginx

下载完解压后会出现pem和key文件

2.将ssl文件传输到服务器上

我这里传输的路径是/usr/local/nginx/cert (没创建的需手动创建)

3.修改nginx配置

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    client_max_body_size     50m;
    client_body_buffer_size  10m; 	  
    client_header_timeout    1m;
    client_body_timeout      1m;

    gzip on;
    gzip_min_length  1k;
    gzip_buffers     4 16k;
    gzip_comp_level  4;
    gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
    gzip_vary on;
	
server {

        listen  443 ssl;
        server_name  前台域名;

        ssl on;
        ssl_certificate    pem文件位置;
        ssl_certificate_key  key文件位置;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

       location / {
            root   /usr/local/vue/blog;
            index  index.html index.htm;
            try_files $uri $uri/ /index.html;
        }
		
        location ^~ /api/ {
            proxy_pass http://你的ip:8080/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }

    }

server {

        listen  443 ssl;
        server_name  后台子域名;

        ssl on;
        ssl_certificate    pem文件位置;
        ssl_certificate_key  key文件位置;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

       location / {
            root   /usr/local/vue/admin;
            index  index.html index.htm;
            try_files $uri $uri/ /index.html;
        }
		
        location ^~ /api/ {
            proxy_pass http://你的ip:8080/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
	
    }

server {

        listen  443 ssl;
        server_name  websocket子域名;

        ssl on;
        ssl_certificate    pem文件位置;
        ssl_certificate_key  key文件位置;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        location / {
          proxy_pass http://你的ip:8080/websocket;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "Upgrade";
          proxy_set_header Host $host:$server_port;
          proxy_set_header X-Real-IP $remote_addr; 
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
          proxy_set_header X-Forwarded-Proto $scheme; 
       }

    }

server {

        listen  443 ssl;
        server_name  上传文件子域名;
		
        ssl on;
        ssl_certificate    pem文件位置;
        ssl_certificate_key  key文件位置;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;		
     
        location / {		
          root /usr/local/upload/; 
        }		
		
    }	

server {
        listen       80;
        server_name  前台域名;
		
        rewrite ^(.*)$	https://$host$1	permanent;
 
    }
	
server {
        listen       80;
        server_name  后台子域名;
     
        rewrite ^(.*)$	https://$host$1	permanent;
		
    }
 
server {
        listen       80;
        server_name  websocket子域名;
    
        rewrite ^(.*)$	https://$host$1	permanent;

    }

server {
        listen       80;
        server_name  上传文件子域名;
    
        rewrite ^(.*)$	https://$host$1	permanent;

    }
	
}

sh

配置好域名和对应上传的pem文件和key文件位置（绝对路径，例/usr/local/nginx/cert/5215670_www.ws.talkxj.com.pem）

启动nginx

docker run --name nginx --restart=always -p 80:80 -p 443:443 -d -v /usr/local/nginx/nginx.conf:/etc/nginx/nginx.conf -v /usr/local/vue:/usr/local/vue -v /usr/local/nginx/cert:/usr/local/nginx/cert -v /usr/local/upload:/usr/local/upload nginx 
sh