Nginx SSL+tomcat集群,https和http配置

最新推荐文章于 2023-09-06 22:53:34 发布

90後的无奈

最新推荐文章于 2023-09-06 22:53:34 发布

阅读量294

点赞数

分类专栏：运维学习

本文链接：https://blog.youkuaiyun.com/weixin_43548686/article/details/104263005

版权

运维学习专栏收录该内容

10 篇文章

订阅专栏

最近在做一个项目, 架构上使用了 Nginx +tomcat 集群, 且nginx下配置了SSL,tomcat no SSL,项目使用https协议


但是,明明是https url请求,发现 log里面,


解决方法很简单，只需要分别配置一下 Nginx 和 Tomcat 就好了，而不用改程序。

 

配置 Nginx 的转发选项：

  

Xml代码  收藏代码
proxy_set_header       Host $host;  
proxy_set_header  X-Real-IP  $remote_addr;  
proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;  
proxy_set_header X-Forwarded-Proto  $scheme;  

nginx中配置中加入：
proxy_set_header X-Forwarded-Proto $scheme;

配置Tomcat server.xml 的 Engine 模块下配置一个 Valve：
Xml代码  收藏代码 

    <Valve className="org.apache.catalina.valves.RemoteIpValve"
    remoteIpHeader="X-Forwarded-For"
    protocolHeader="X-Forwarded-Proto"
    protocolHeaderHttpsValue="https"/>


下面这种是写死中https。类似与强转
还可以在tomcat配置文件中Connector下面添加
scheme="https" secure="true"


参考链接：
https://blog.youkuaiyun.com/lwcyd/article/details/80032288
https://www.cnblogs.com/interdrp/p/4881785.html

 sed -i '129a  <Valve className="org.apache.catalina.valves.RemoteIpValve"\nremoteIpHeader="X-Forwarded-For"\nprotocolHeader="X-Forwarded-Proto"\nprotocolHeaderHttpsValue="https"/>' /data/webenv/tomcat/server.xml





upstream baidu{
    
    server  X.X.X.X:8080;

    check interval=3000 rise=2 fall=5 timeout=3000 type=http;
    check_http_send "HEAD /check.txt HTTP/1.0\r\n\r\n";
    check_http_expect_alive http_2xx http_3xx;
}

server {
    listen    80 ;
    server_name baidu.com;
    
    location / {
        #proxy_pass http://baidu;
        rewrite ^/(.*) https://baidu.com/$1 permanent;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_redirect  off;
        access_log  /etc/nginx/logs/pangmao56test.com.log  main;
    }

    
}
server {
    listen 443;
    server_name baidu.com;
    ssl on;
    ssl_certificate /etc/nginx/ssl/test.pem;
    ssl_certificate_key /etc/nginx/ssl/test.key;
    ssl_dhparam /etc/nginx/ssl/dhparams.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'AES128+EECDH:AES128+EDH';
    ssl_prefer_server_ciphers on;
    
    location / {
        proxy_pass http://baidu;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_redirect  off;
        access_log  /etc/nginx/logs/pangmao56test.com.log  main;
    }

    

}