win7 localhost 配置 nginx ssl自签名证书

小鱼儿 2022-03-15 09:08 587阅读 0赞

# 步骤 #

**1）下载并安装openssl**  
下载windows版本的openssl解压缩到本地。  
下载地址：[http://gnuwin32.sourceforge.net/packages/openssl.htm][http_gnuwin32.sourceforge.net_packages_openssl.htm]  
这里选择的是：Binaries (\*.zip)

**2）生成ssl证书**

进入目录，运行`openssl.exe`，输入如下生成脚本，假设文件生成到`d:/ssl`目录

OpenSSL> req -x509 -out d:/ssl/localhost.crt -keyout d:/ssl/localhost.key -newke
    y rsa:2048 -nodes -sha256 -subj '/CN=localhost' -extensions EXT -config d:/ssl/c
    onfig.txt -days 2048
    Loading 'screen' into random state - done
    Generating a 2048 bit RSA private key
    .............................................+++
    .......................................................................+++
    writing new private key to 'd:/ssl/localhost.key'
    -----
    OpenSSL>

其中 `d:/ssl/config.txt` 内如如下：

[dn]
    CN=localhost
    
    [req]
    distinguished_name = dn
    
    [EXT]
    subjectAltName=DNS:localhost
    keyUsage=digitalSignature
    extendedKeyUsage=serverAuth

支持多个域名的配置：  
例子1：[http://apetec.com/support/generatesan-csr.htm][http_apetec.com_support_generatesan-csr.htm]  
例子2：[https://medium.com/@pubudu538/how-to-create-a-self-signed-ssl-certificate-for-multiple-domains-25284c91142b][https_medium.com_pubudu538_how-to-create-a-self-signed-ssl-certificate-for-multiple-domains-25284c91142b]

**3）更新到nginx的配置localhost.conf**

server {
    	listen 80;
    	listen 443;
    	server_name localhost;
    	root d:/localhost;
    	index index.html index.htm index.php;
    	autoindex on;
        autoindex_localtime on;
    	
    	ssl on;
    	ssl_certificate     d:/ssl/localhost.crt;
    	ssl_certificate_key d:/ssl/localhost.key;
    	
    	location ~ \.php$ {
    	    fastcgi_pass   php_pool;
    	    fastcgi_index  index.php;
    	    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    	    include        fastcgi_params;
    	}
    }

再重启nginx，访问 [https://localhost][https_localhost]

# 报错 #

localhost 使用了无效的安全证书。 
    该证书因为其自签名而不被信任。
    错误代码：MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

解决方法：~ 暂无，网上的都是治标不治本的，修改浏览器设置的后果无法解决如下报错。

D:\>php -r "echo file_get_contents('http://localhost/robots.txt');"
    Allow: *
    D:\>php -r "echo file_get_contents('https://localhost/robots.txt');"
    
    Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error me
    ssages:
    error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify faile
    d in Command line code on line 1
    
    Call Stack:
        0.0020     350368   1. {main}() Command line code:0
        0.0020     350368   2. file_get_contents() Command line code:1
    
    
    Warning: file_get_contents(): Failed to enable crypto in Command line code on li
    ne 1
    
    Call Stack:
        0.0020     350368   1. {main}() Command line code:0
        0.0020     350368   2. file_get_contents() Command line code:1
    
    
    Warning: file_get_contents(https://localhost/robots.txt): failed to open stream:
     operation failed in Command line code on line 1
    
    Call Stack:
        0.0020     350368   1. {main}() Command line code:0
        0.0020     350368   2. file_get_contents() Command line code:1
    
    
    D:\>

# 相关链接 #

Let’s Encrypt: Certificates for localhost  
[https://letsencrypt.org/docs/certificates-for-localhost/][https_letsencrypt.org_docs_certificates-for-localhost]

How To Create a Self-Signed SSL Certificate for Nginx in Ubuntu 16.04  
[https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04][https_www.digitalocean.com_community_tutorials_how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04]

[http_gnuwin32.sourceforge.net_packages_openssl.htm]: http://gnuwin32.sourceforge.net/packages/openssl.htm
[http_apetec.com_support_generatesan-csr.htm]: http://apetec.com/support/generatesan-csr.htm
[https_medium.com_pubudu538_how-to-create-a-self-signed-ssl-certificate-for-multiple-domains-25284c91142b]: https://medium.com/@pubudu538/how-to-create-a-self-signed-ssl-certificate-for-multiple-domains-25284c91142b
[https_localhost]: https://localhost
[https_letsencrypt.org_docs_certificates-for-localhost]: https://letsencrypt.org/docs/certificates-for-localhost/
[https_www.digitalocean.com_community_tutorials_how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04]: https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04