12.20 Nginx配置ssl

server
{
    listen 443;
    server_name aming.com;
    index index.html index.php;
    root /data/wwwroot/aming.com;
    ssl on;
    ssl_certificate aminglinux.crt;
    ssl_certificate_key aminglinux.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
}

[root@hf-01 conf]# vim /usr/local/nginx/conf/vhost/ssl.conf

添加以下内容
server
{
    listen 443;        //监听端口为443
    server_name aming.com;   //主机名
    index index.html index.php;
    root /data/wwwroot/aming.com;   //root 目录
    ssl on;                                            //开启ssl
    ssl_certificate gurui.crt;      //指定公钥
    ssl_certificate_key gurui.key;   //指定私钥
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;   //ssl 的协议
}
保存退出

[root@hf-01 conf]# mkdir /data/wwwroot/aming.com
[root@hf-01 conf]# 

[root@hf-01 conf]# /usr/local/nginx/sbin/nginx -t
nginx: [emerg] unknown directive "ssl" in /usr/local/nginx/conf/vhost/ssl.conf:7
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
[root@hf-01 conf]# 

[root@hf-01 conf]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.12.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
configure arguments: --prefix=/usr/local/nginx
[root@hf-01 conf]# 

[root@hf-01 conf]# cd /usr/local/src/nginx-1.12.1/
[root@hf-01 nginx-1.12.1]# ./configure --help |grep -i ssl
  --with-http_ssl_module             enable ngx_http_ssl_module
  --with-mail_ssl_module             enable ngx_mail_ssl_module
  --with-stream_ssl_module           enable ngx_stream_ssl_module
  --with-stream_ssl_preread_module   enable ngx_stream_ssl_preread_module
  --with-openssl=DIR                 set path to OpenSSL library sources
  --with-openssl-opt=OPTIONS         set additional build options for OpenSSL
[root@hf-01 nginx-1.12.1]# 

[root@hf-01 nginx-1.12.1]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module

[root@hf-01 nginx-1.12.1]# make

[root@hf-01 nginx-1.12.1]# make install

[root@hf-01 nginx-1.12.1]# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.12.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module
[root@hf-01 nginx-1.12.1]# 

[root@hf-01 nginx-1.12.1]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@hf-01 nginx-1.12.1]# 

[root@hf-01 nginx-1.12.1]# /etc/init.d/nginx restart
Restarting nginx (via systemctl):                          [  确定  ]
[root@hf-01 nginx-1.12.1]# 

[root@hf-01 nginx-1.12.1]# netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1533/master         
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5716/nginx: master  
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      5716/nginx: master  
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1205/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      1533/master         
tcp6       0      0 :::3306                 :::*                    LISTEN      1576/mysqld         
tcp6       0      0 :::22                   :::*                    LISTEN      1205/sshd           
[root@hf-01 nginx-1.12.1]# 

[root@hf-01 nginx-1.12.1]# cd /data/wwwroot/aming.com/
[root@hf-01 aming.com]# ls
[root@hf-01 aming.com]# vim index.html

This is ssl.
保存退出

[root@hf-01 aming.com]# curl -x127.0.0.1:443 https://aming.com/
curl: (56) Received HTTP code 400 from proxy after CONNECT
[root@hf-01 aming.com]# 

[root@hf-01 aming.com]# vim /etc/hosts

加入以下内容
127.0.0.1 aming.com

[root@hf-01 aming.com]# curl https://aming.com/
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
[root@hf-01 aming.com]# 

192.168.74.129  aming.com

[root@hf-01 aming.com]# iptables -nvL

[root@hf-01 aming.com]# iptables -F
[root@hf-01 aming.com]#