Nginx配置与优化：HTTPS证书与性能提升-优快云博客

本文链接：https://blog.youkuaiyun.com/yimtcode/article/details/116452347

Nginx：HTTPS

nginx version: nginx/1.20.0

1.生成SSL证书

1.1.生成key密钥

# 1.切换到nginx配置文件路径下
cd /etc/nginx
# 2.创建ssl文件夹
mkdir ssl
# 3.生成密钥key
openssl genrsa -out secret.key 2048

1.2.生成证书签名请求文件(csr文件)

openssl req -new -key secret.key -out secret.csr

1.3.生成证书签名文件(CA文件)

openssl x509 -req -days 3650 -in secret.csr -signkey secret.key -out secret.crt

2.Nginx配置HTTPS证书

server {
    # 监听443端口
    listen       443 ssl;
    # 配置ssl证书
    ssl_certificate /etc/nginx/ssl/secret.crt;
    ssl_certificate_key /etc/nginx/ssl/secret.key;
    server_name  localhost;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
    
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

3.优化

长连接：复用连接，减少TCP和SSL握手对性能损耗
ssl session缓存：重用客户缓存的证书

server {
    listen       443 ssl;
    ssl_certificate /etc/nginx/ssl/secret.crt;
    ssl_certificate_key /etc/nginx/ssl/secret.key;
    server_name  localhost;

    # 长连接
    keepalive_time 100;

    # ssl会话缓存
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
    ...
}