使用nginx来实现https的功能
注：准备一台linux服务器（此时实验下在Centos7下完成）
[root@localhost nginx]# service nginx stop
Redirecting to /bin/systemctl stop nginx.service
[root@localhost nginx]# netstat -anplut|grep 80
[root@localhost nginx]# ps aux|grep httpd
root 20096 0.0 0.0 112824 980 pts/1 S+ 16:02 0:00 grep --color=auto httpd
[root@localhost nginx]# ps aux|grep nginx
root 20098 0.0 0.0 112824 980 pts/1 S+ 16:02 0:00 grep --color=auto nginx
一、编译安装nginx
[root@localhost nginx]# mkdir /sanchuang
[root@localhost nginx]# cd /sanchuang/
#上传安装脚本onekey_install_nginx_yingboshuyuan.sh
[root@localhost sanchuang]# rz
[root@localhost sanchuang]# ls
onekey_install_nginx_yingboshuyuan.sh
[root@localhost sanchuang]# cat onekey_install_nginx_yingboshuyuan.sh
#!/bin/bash
#解决软件的依赖关系，需要安装的软件包
yum install epel-release -y
yum -y install zlib zlib-devel openssl openssl-devel pcre pcre-devel gcc gcc-c++ autoconf automake make psmisc net-tools lsof vim wget -y
#新建wangguang用户和组
id wangguang|| useradd wangguang -s /sbin/nologin
#下载nginx软件
mkdir /wangguang -p
cd /wangguang
wget https://nginx.org/download/nginx-1.21.4.tar.gz
#解压软件
tar xf nginx-1.21.4.tar.gz
#进入解压后的文件夹
cd nginx-1.21.4
#编译前的配置,开启https和http 2.0功能
./configure --prefix=/usr/local/wangguang --user=wangguang --group=wangguang --with-http_ssl_module --with-http_v2_module
#如果上面的编译前的配置失败，直接退出脚本
if (( $? != 0));thenexit
fi
#编译，启动2个进程去编译，这样速度快
make -j 2
#编译安装
make install
#修改PATH变量
echo "PATH=/usr/local/wangguang/sbin:$PATH" >>/root/.bashrc
#firewalld and selinux
#stop firewall和设置下次开机不启动firewalld
service firewalld stop
systemctl disable firewalld
#临时停止selinux和永久停止selinux
setenforce 0
sed -i '/^SELINUX=/ s/enforcing/disabled/' /etc/selinux/config
#开机启动
chmod +x /etc/rc.d/rc.local
echo "/usr/local/wangguang/sbin/nginx" >>/etc/rc.local
#启动nginx
/usr/local/wangguang/sbin/nginx
二、执行安装脚本
[root@localhost sanchuang]# bash onekey_install_nginx_yingboshuyuan.sh 查看nginx是否安装成功
[root@localhost sanchuang]# ps aux|grep nginx
root 22992 0.0 0.0 46100 1144 ? Ss 16:13 0:00 nginx: master process /usr/local/wangguang/sbin/nginx
wanggua+ 22993 0.0 0.0 46468 1900 ? S 16:13 0:00 nginx: worker process
root 22995 0.0 0.0 112824 980 pts/1 S+ 16:14 0:00 grep --color=auto nginx
[root@localhost sanchuang]# ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00inet 127.0.0.1/8 scope host lovalid_lft forever preferred_lft foreverinet6 ::1/128 scope host valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000link/ether 00:0c:29:33:d9:c8 brd ff:ff:ff:ff:ff:ffinet 192.168.203.201/24 brd 192.168.203.255 scope global noprefixroute dynamic ens33valid_lft 1396sec preferred_lft 1396secinet6 fe80::c348:5575:d46e:777e/64 scope link noprefixroute valid_lft forever preferred_lft forever
三、使用浏览器去访问
http://192.168.203.201/
注：可以从阿里云上面获取免费的证书，但是要申请，这里存放在/usr/local/wangguang/conf目录下
四、使用证书
[root@localhost sanchuang]# cd /usr/local/wangguang/
[root@localhost wangguang]# ls
client_body_temp conf fastcgi_temp html logs proxy_temp sbin scgi_temp uwsgi_temp
[root@localhost wangguang]# cd conf
#证书是绑定到域名上的
#开始上传证书11158224_www.sanchuangedu.cn_nginx.zip
[root@localhost conf]# rz
[root@localhost conf]# ls
11158224_www.sanchuangedu.cn_nginx.zip fastcgi_params koi-win nginx.conf scgi_params.default win-utf
fastcgi.conf fastcgi_params.default mime.types nginx.conf.default uwsgi_params
fastcgi.conf.default koi-utf mime.types.default scgi_params uwsgi_params.default
[root@localhost conf]# yum install unzip -y
1.解压证书压缩文件
[root@localhost conf]# unzip 11158224_www.sanchuangedu.cn_nginx.zip
Archive: 11158224_www.sanchuangedu.cn_nginx.zip
Aliyun Certificate Downloadinflating: www.sanchuangedu.cn.pem inflating: www.sanchuangedu.cn.key
[root@localhost conf]# ls
11158224_www.sanchuangedu.cn_nginx.zip fastcgi_params koi-win nginx.conf scgi_params.default win-utf
fastcgi.conf fastcgi_params.default mime.types nginx.conf.default uwsgi_params www.sanchuangedu.cn.key
fastcgi.conf.default koi-utf mime.types.default scgi_params uwsgi_params.default www.sanchuangedu.cn.pem注：
www.sanchuangedu.cn.pem --》公钥
www.sanchuangedu.cn.key --》私钥
2.编辑nginx的主配置文件
[root@localhost conf]# vim nginx.conf
#在最后面添加下面的配置
server {listen 443 ssl; #若是想用http 2版本的，需要在ssl后面加上http2:listen 443 ssl http2;server_name www.sanchuangedu.cn;ssl_certificate www.sanchuangedu.cn.pem; #这里填自己的证书公钥ssl_certificate_key www.sanchuangedu.cn.key; #这里填自己的证书私钥ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location / {root html;index index.html index.htm;}
}
3.检查我们的nginx.conf配置文件是否正确
[root@localhost conf]# /usr/local/wangguang/sbin/nginx -t
nginx: the configuration file /usr/local/wangguang/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/wangguang/conf/nginx.conf test is successful
4.重启编译安装的nginx服务
[root@localhost conf]# /usr/local/wangguang/sbin/nginx -s reload
5.查看进程和端口号
[root@localhost conf]# ps aux|grep nginx
root 22992 0.0 0.0 47256 2752 ? Ss 16:13 0:00 nginx: master process /usr/local/wangguang/sbin/nginx
wanggua+ 23098 0.0 0.0 47648 2064 ? S 16:36 0:00 nginx: worker process
root 23100 0.0 0.0 112824 976 pts/1 S+ 16:36 0:00 grep --color=auto nginx
[root@localhost conf]# netstat -anplut|grep nginx
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 22992/nginx: master
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 22992/nginx: master
6.访问验证https功能是否生效，访问必须使用域名进行访问
#修改windows里的一个hosts文件，添加www.sanchuangedu.cn对应的ip地址
C:\Windows\System32\drivers\etc\hosts
#添加下面的域名解析
192.168.203.201 www.sanchuangedu.cn
#然后在浏览器去访问
https://www.sanchuangedu.cn/
chrome浏览器默认使用https访问
#火狐浏览器默认使用http方式，需要自己指定https方式
https://www.sanchuangedu.cn/