nginx配置http转https(tomcat不需要变还是http)

nginx配置http转https(tomcat不需要变还是http)

• 网站升级https
• 网站原访问http 保留不变,nginx做重定向，把所有http请求重定向到https
• https请求转发到tomcat上(tomcat保留开放http)

centos 安装nginx

• 切换到root 用户进行安装

下载nginx安装包

cd /usr/local/src
wget http://nginx.org/download/nginx-1.15.10.tar.gz
tar -zxvf nginx-1.15.10.tar.gz

安装nginx 支持https

• 安装依赖环境

# 依赖环境
yum install gcc-c++
yum -y install pcre-devel openssl openssl-devel

• prefix指定安装目录
• with-http_ssl_module安装ssl模块

cd /usr/local/src/nginx-1.15.10
./configure --prefix=/usr/local/nginx  --with-http_stub_status_module --with-http_ssl_module --with-stream --with-http_v2_module

make && make install

nginx.conf 修改配置

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;
    client_max_body_size  5000m;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;
    
   
     # Tomcat 
    upstream appServer {
        server 127.0.0.1:8888 weight=4;
      
    }
    
      
    server {
       listen       80;
       # listen       somename:8080;
       server_name    thinktothings  thinktothings.com;

      rewrite ^(.*) https://$host$1 permanent;
    }


 server {
        listen      443 ssl; # https  443
        charset     utf-8;
        server_name www.thinktothings.com; # host_name of URL

        #  https
        #ssl on;
        ssl_certificate       /usr/local/nginx/ssl/server.crt;
	      ssl_certificate_key   /usr/local/nginx/ssl/server.key;

        location / {
            proxy_redirect   off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            #  https  Tomcat Tomcat  http 
            proxy_set_header X-Forwarded-Proto $scheme;
            #  Tomcat 
            proxy_pass http://appServer;
        }
    }
   



    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

自签证书

• https 需要的证书可以去购买，也可以申请免费的证书，不过我们也可以自签一个证书在本地进行测试（自签的证书在访问时需要用户手动确认信任证书才能继续访问）

创建 server.key

openssl genrsa -des3 -out server.key 1024

生成server.csr

openssl req -new -key server.key -out server.csr

复制 server.key 到 server.key.org

cp server.key server.key.org

生成rsa server.key

openssl rsa -in server.key.org -out server.key

生成证书 server.crt

• days 有效期多少天

openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

把生成的 server.crt 和 server.key 配置到 Nginx

• 该方式证书，用户不能直接访问，被屏蔽了，需要用户手动通过设置，或安装证书才可以访问

  ssl_certificate       /usr/local/nginx/ssl/server.crt;
  ssl_certificate_key   /usr/local/nginx/ssl/server.key;

• 去阿里云下载免费域名证书，替换上面的证书就可以直接访问该网站https(用户可以直接访问)

  ssl_certificate       /usr/local/nginx/ssl/2024841_thinktothings.com.pem;
  ssl_certificate_key   /usr/local/nginx/ssl/2024841_thinktothings.com.key;

nginx 常用命令

• 验证nginx配置是否正确

/usr/local/nginx/sbin/nginx  -t

• 启动nginx

/usr/local/nginx/sbin/nginx 

• 重启nginx

/usr/local/nginx/sbin/nginx  -s reload

• 停止nginx

/usr/local/nginx/sbin/nginx  -s stop

• 强制停止nginx

pkill -9 nginx