SSL证书安装与Nginx配置-优快云博客

一、ssl证书安装

①

1.  wget  https://dl.eff.org/certbot-auto
2.   chmod a+x certbot-auto
3. ./certbot-auto certonly --standalone -d www.sunkun.pub






②ssl生成的文件

/etc/letsencrypt/live/sk.test/fullchain.pem
/etc/letsencrypt/live/sk.test/privkey.pem

③

    cd /etc/nginx && openssl dhparam -out dhparam.pem 2048


二、nginx的安装

1. 下载   http://nginx.org/download/nginx-1.12.2.tar.gz

2. 编译 

    ./configure --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-threads --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-http_slice_module --with-mail --with-mail_ssl_module --with-compat --with-file-aio --with-http_v2_module 
3. 安装
 make && make install


注意： 安装nginx时，一定要带上 --with-http_ssl_module 


查看防火墙

iptables -nL INPUT


开放443 端口

iptables -I INPUT -p tcp --dport 443 -j ACCEPT




三、nginx配置

server {
    listen       443 ssl http2;
    server_name  sk.test;
    ssl on; #cert root /var/www/htdocs/sk.test; ssl_certificate /etc/letsencrypt/live/sk.test/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/sk.test/privkey.pem; ssl_dhparam /etc/nginx/dhparam.pem; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECD HE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES2 56-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:!RC4:!aNULL:!eNULL:!MD5:!EXPORT:!EXP:!LOW:!SEED:!CAMELLIA:!IDEA:!Psk.test:!SRP:!SSLv:!aECD H:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; ssl_prefer_server_ciphers on; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"; ssl_session_timeout 1h; ssl_session_cache shared:SSL:16m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; client_max_body_size 100m; location / { root html; } location ~ \.(inc|tpl|sql|ini|bin|sh|bak|old)$ { deny all; } location ~ \.(ico|gif|png|jpeg|jpg|css|js|xml|html|shtml|swf|mp3)$ { expires 1d; if ($uri ~ ^/favicon\.ico$) { expires 30d; } if ($uri ~ index\.(html|shtml)$) { expires 600; } if ($uri ~ check\.html$) { expires 100d; } } location ~ \.php { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $1; include fastcgi_params; } try_files $uri $uri/ /index.php$request_uri; }