当前位置：首页 > news >正文

Nginx配置SSL实现服务器/客户端双向认证

news 来源：原创 2024/5/2 11:50:14

转载自：https://blog.csdn.net/rexueqingchun/article/details/82251563

1.下载tar.gz格式jdk并配置环境变量（已配置jdk环境的可以忽略第一步）

解压jdk压缩包到opt目录下：

tar zxvf /opt/jdk-8u144-linux-x64.tar.gz -C /opt/

配置环境变量：

通过vi命令编辑profile文件

vi /etc/profile

按键i开启编辑模式，在文件最后添加：

export JAVA_HOME="/opt/jdk1.8.0_144"

export PATH="$JAVA_HOME/bin:$PATH"

其中jdk1.8.0_144为jdk加压后的文件夹，修改完成后，esc键返回命令模式，输入:x保存并退出。

java -version

显示jdk版本，则配置成功。

备注：tomcat下载后解压即可，无需配置环境变量。

2.安装openssl

yum install openssl

3.配置yun源并安装nginx（centos不支持yum 安装 nginx，所以需要配置一下）

vi /etc/yum.repos.d/nginx.repo

增加如下配置：

[nginx]

name=nginx repo

baseurl=http://nginx.org/packages/centos/7/x86_64/

gpgcheck=0

enabled=1

其中"7"代表CentOS7,"x86_64"代表系统架构。

安装nginx：

yum install nginx

4.生成nginx证书

创建证书文件夹，依次输入如下命令：

cd /etc/nginx

sudo mkdir ca

cd ca

sudo mkdir newcerts private conf server users

conf目录新建openssl.conf文件：

vi /etc/nginx/ca/conf/openssl.conf

增加如下配置：

[ ca ]

default_ca = myserver

[ myserver ]

dir = /etc/nginx/ca

database = /etc/nginx/ca/index.txt

new_certs_dir = /etc/nginx/ca/newcerts

certificate = /etc/nginx/ca/private/ca.crt

serial = /etc/nginx/ca/serial

private_key = /etc/nginx/ca/private/ca.key

RANDFILE = /etc/nginx/ca/private/.rand

default_days = 3650

default_crl_days = 3650

default_md = sha256

unique_subject = no

policy = policy_any

[ policy_any ]

countryName = match

stateOrProvinceName = match

organizationName = match

localityName = optional

commonName = supplied

emailAddress = optional

private目录创建根证书

生成私钥key文件：

sudo openssl genrsa -out /etc/nginx/ca/private/ca.key 2048

生成根证书请求csr文件：

sudo openssl req -new -key /etc/nginx/ca/private/ca.key -out private/ca.csr

生成凭证crt文件：

sudo openssl x509 -req -days 3650 -in /etc/nginx/ca/private/ca.csr -signkey /etc/nginx/ca/private/ca.key -out /etc/nginx/ca/private/ca.crt

设置key起始序列号：

sudo echo FACE > /etc/nginx/ca/serial

创建CA键库：

sudo touch /etc/nginx/ca/index.txt

为 “用户证书” 的移除创建一个证书吊销列表：

sudo openssl ca -gencrl -out /etc/nginx/ca/private/ca.crl -crldays 7 -config "/etc/nginx/ca/conf/openssl.conf"

server目录创建服务器证书

生成私钥key文件：

sudo openssl genrsa -out /etc/nginx/ca/server/server.key 2048

生成证书请求csr文件：

sudo openssl req -new -key /etc/nginx/ca/server/server.key -out /etc/nginx/ca/server/server.csr

生成凭证crt文件：

sudo openssl ca -in /etc/nginx/ca/server/server.csr -cert /etc/nginx/ca/private/ca.crt -keyfile /etc/nginx/ca/private/ca.key -out /etc/nginx/ca/server/server.crt -config "/etc/nginx/ca/conf/openssl.conf"

users目录创建客户端证书

生成私钥key文件：

sudo openssl genrsa -des3 -out /etc/nginx/ca/users/client.key 2048

生成证书请求csr文件：

sudo openssl req -new -key /etc/nginx/ca/users/client.key -out /etc/nginx/ca/users/client.csr

生成凭证crt文件：

sudo openssl ca -in /etc/nginx/ca/users/client.csr -cert /etc/nginx/ca/private/ca.crt -keyfile /etc/nginx/ca/private/ca.key -out /etc/nginx/ca/users/client.crt -config "/etc/nginx/ca/conf/openssl.conf"

5.修改Nginx配置文件nginx.conf

user root;

worker_processes 1;

error_log /var/log/nginx/error.log warn;

#pid /var/run/nginx.pid;

events {

worker_connections 1024;

}

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile on;

#tcp_nopush on;

keepalive_timeout 120;

#gzip on;

client_max_body_size 120m;

client_body_buffer_size 128k;

server_names_hash_bucket_size 128;

large_client_header_buffers 4 4k;

open_file_cache max=8192 inactive=20s;

open_file_cache_min_uses 1;

open_file_cache_valid 30s;

upstream tomcat_server {

server 192.168.1.220:8080 fail_timeout=0;

}

server {

listen 443;

server_name 192.168.1.220;

ssi on;

ssi_silent_errors on;

ssi_types text/shtml;

ssl on;

ssl_certificate /etc/nginx/ca/server/server.crt;

ssl_certificate_key /etc/nginx/ca/server/server.key;

ssl_client_certificate /etc/nginx/ca/private/ca.crt;

ssl_session_timeout 5m;

ssl_verify_client on;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

ssl_prefer_server_ciphers on;

charset utf-8;

access_log logs/host.access.log main;

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root html;

}

location = /favicon.ico {

log_not_found off;

access_log off;

expires 90d;

}

location / {

proxy_pass http://tomcat_server;

include proxy.conf;

}

#include /etc/nginx/conf.d/*.conf;

}

备注：upstream tomcat_server中的server修改为nginx转发服务器的ip地址及端口号，server中server_name为nginx所在服务器ip，此处配置ssl安全认证，故采用https默认端口号443，另外安装nginx后，若根目录没有logs文件夹，可手动创建，否则启动nginx会提示找不到logs文件夹错误。

6.Nginx代理文件配置

编辑nginx的proxy.conf文件：

vi /etc/nginx/proxy.conf

添加如下配置：

proxy_redirect off;

proxy_connect_timeout 60;

proxy_read_timeout 600;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header X-SSL-Client-Cert $ssl_client_cert;