Nginx ngx_http_ssl_module模块详解（七）

1、ssl on | off; 
    为指定虚拟机启用HTTPS protocol，建议用listen指令代替
    可用位置：http, server

2、ssl_certificate file; 
    当前虚拟主机使用PEM格式的证书文件
    可用位置：http, server

3、ssl_certificate_key file; 
    当前虚拟主机上与其证书匹配的私钥文件
    可用位置：http, server

4、ssl_protocols [SSLv2] [SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2]; 
    支持ssl协议版本，默认为后三个
    可用位置：http, server

5、ssl_session_cache off | none | [builtin[:size]] [shared:name:size]; 
    builtin[:size]：使用OpenSSL内建缓存，为每worker进程私有
    [shared:name:size]：在各worker之间使用一个共享的缓存
    可用位置：http, server

6、ssl_session_timeout time; 
    客户端连接可以复用sslsession cache中缓存的ssl参数的有效时长，默认5m
    可用位置：http, server

示例：
    server { 
        listen 443 ssl; 
        server_name www.a.com; 
        root /vhosts/ssl/htdocs; 
        ssl on;  
        ssl_certificate /etc/nginx/ssl/nginx.crt; 
        ssl_certificate_key /etc/nginx/ssl/nginx.key; 
        ssl_session_cache shared:sslcache:20m; 
        ssl_session_timeout 10m; 
    }

必须系统支持 TLS SNI support enabled 必须启用
[root@centos7 conf.d]#nginx -V
nginx version: nginx/1.12.2
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled #这里必须启用 不启动无法设置多个https 网站

[root@centos7 conf.d]#vim vhosts.conf 
server {
        listen 443 ssl;
        server_name www.c.com;
        root /data/web3/;
        ssl on;
                ssl_certificate /etc/nginx/conf.d/c.crt;
                ssl_certificate_key /etc/nginx/conf.d/c.key;
                ssl_session_cache shared:sslcache:20m;
                ssl_session_timeout 10m;
        location /status {
                stub_status;
        }
}
server {
        listen 443 ssl;
        server_name www.b.com;
        root /data/web2/;
        ssl on;
        ssl_certificate /etc/nginx/conf.d/b.crt;
        ssl_certificate_key /etc/nginx/conf.d/bb.key;
        ssl_session_cache shared:sslcache:20m;
        ssl_session_timeout 10m;
        location /status {
                stub_status;
        }
}

获取加密的证书
[root@centos7 conf.d]#yum install mod_ssl
[root@centos7 conf.d]#cd /etc/pki/tls/certs/
[root@centos7 certs]#make c.crt #默认会输入口令

取消口令方式1
[root@centos7 certs]# vim /etc/pki/tls/certs/Makefile
%.key:
        umask 77 ; \
        /usr/bin/openssl genrsa -aes128 $(KEYLEN) > $@ 
        # 删掉-aes128
取消口令方式2 
    生成加密证书后 openssl rsa -in b.key -out bb.key 取消里面加密口令