nginx与https证书集成

最新推荐文章于 2022-07-01 17:34:53 发布

置顶洛枫偃月

最新推荐文章于 2022-07-01 17:34:53 发布

阅读量554

点赞数

CC 4.0 BY-SA版权

分类专栏： https/ssl Web安全

本文链接：https://blog.youkuaiyun.com/zgs_shmily/article/details/53321411

Web安全同时被 2 个专栏收录

5 篇文章

订阅专栏

https/ssl

1 篇文章

订阅专栏

本文详细介绍了Nginx服务器的配置方法，包括事件处理模型、HTTP核心模块配置、上游服务器负载均衡策略、SSL证书配置等内容，并针对特定需求进行了优化设置。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#user  nobody;
worker_processes  8;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

worker_rlimit_nofile 30000;
events {
    worker_connections  1024;
	use epoll;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

   
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;
    server_tokens off;  #关闭版本显示 
	
    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;
    #防止ddos攻击
    client_header_timeout 60;
    client_body_timeout 10;
	#设置文件上传最大为50M
	client_max_body_size 50M;
    #gzip  on;
    #软负载映射节点
	upstream balanceServer{
	    # sticky  httponly;
		 server 127.0.0.1:8001;
		 server 127.0.0.1:8002;
		 server 127.0.0.1:8003;
		 server 127.0.0.1:8004;
	}
    server {
        listen       8443;
        server_name  localhost;
		#ssl config
        ssl                  on; 
        ssl_certificate      /app/nginx.pem; 
        ssl_certificate_key  /app/nginx.key; 
        ssl_session_timeout  5m; 
        ssl_session_cache    shared:SSL:1m;
        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers    EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM;
        ssl_prefer_server_ciphers   on; 
        #charset koi8-r;
        location / {
			#负载均衡地址
			proxy_pass  http://balanceServer$request_uri; 
			proxy_set_header X-Forwarded-Host $host;
			proxy_set_header X-Forwarded-Server $host;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_redirect off;
			proxy_set_header Host $http_host;
			proxy_set_header Connection Close;
			port_in_redirect off; 
			proxy_connect_timeout 60s;
			proxy_read_timeout 3h;
	        proxy_send_timeout 3h;
			proxy_buffer_size 4k;
			proxy_buffers 6 32k; 
			proxy_busy_buffers_size 64k;
			proxy_temp_file_write_size 64k;
			#开启代理拦截错误，屏蔽真实中间件信息
			proxy_intercept_errors off;
	    }
        
       
    	location ~ ^/WEB-INF/ {
        	deny  all;
    	}

        location /res {
            alias  /app2/res_mng;#图片映射路径
            index  index.html index.htm;
        }

        #设置健康检查页面
		location = /healthcheck.html {
            root   /app/nginx/html;
			access_log off; #关闭健康检查访问日志
        }
		#设置404页面[/app/nginx/html目录下的文件]
		error_page  404 403             /404.html;
		location = /404.html {
            root   /app/nginx/html;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /app/nginx/html;
        }
        
    }
}