Nginx + Tomcat 8.5 启用SSL HTTPS

迷南。 2022-06-02 01:14 206阅读 0赞

一、申请SSL证书

[阿里云申请证书 ][Link 1]  图文教程：[http://www.chinaz.com/web/2017/0105/639110.shtml][http_www.chinaz.com_web_2017_0105_639110.shtml]

[腾讯云申请证书][Link 2]

二、Nginx 配置SSL

server { listen 443; server_name localhost; ssl on; ssl_certificate cert/xxx.pem; ssl_certificate_key cert/xxx.key; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; }

其他配置可以参考nginx官网

80端口重定向到 443 端口配置如下：

server {
            listen          80;
            server_name     localhost;
            rewrite ^(.*)$  https://$host$1 permanent;
        }

可能的问题：

1. Nginx 没有启用SSL模块：

报错：

./configure: error: the HTTP cache module requires md5 functions
     
    from OpenSSL library.  You can either disable the module by using
     
    --without-http-cache option, or install the OpenSSL library into the system,
     
    or build the OpenSSL library statically from the source with nginx by using
     
    --with-http_ssl_module --with-openssl=<path> options.

解决办法：

**1. 安装openssl 和 openssl-devel**

yum -y install openssl openssl-devel

**2. 如果已经安装了，但还是报错，则可以使用参数指定openssl源码路径**

./configure --with-http\_v2\_module --with-http\_ssl\_module\--with-openssl=/work/openssl-1.0.2n

**3. Nginx升级可以使用如下方式：**

nginx:\[emerg\]unknown directive "ssl" 解决方法：[http://blog.csdn.net/u014227715/article/details/77649156][http_blog.csdn.net_u014227715_article_details_77649156]

**4. 如果之前安装的Nginx没有SSL模块可以参考下面连接升级：**

[ http://blog.csdn.net/u014227715/article/details/77649156][http_blog.csdn.net_u014227715_article_details_77649156]

**5. 升级完成之后一定要重启Nginx 注意，不是重新加载配置文件 ！！！**

这样Nginx基本就配置完了

三、Tomcat 8 配置SSL openSSL

注意：tomcat 8 配置ssl 有两种配置方式，**一种是apr 另外一种是JSSE**。

两种配置方式不一样。具体配置方案可见：[https://stackoverflow.com/questions/6306314/tomcat-7-ssl-failed][https_stackoverflow.com_questions_6306314_tomcat-7-ssl-failed]

![1514460422_9345.png][]

**四、配置说明**

**1. 使用 阿里云负载均衡（https） + Nginx（http） + Tomcat（http），阿里云负载均衡通过http 协议与后端通信**

a.阿里云负载均衡 启用 https 并配置证书，并在高级配置中启用 X-Forwarded-Proto

b.Nginx 不需要配置，但需要启用 Http 监听即可

c.Tomcat 在 server.xml 中的Host标签下配置（主要用于记录客户端请求的是http还是https）：

2. Nginx(https) + Tomcat(http)，客户端 ->(Https) Nginx ->(http) Tomcat

a. Nginx 启用SSL配置如下：

user              nobody;
    worker_processes  auto;
    pid               logs/nginx.pid;
    events {
        use epoll;
        worker_connections  65535;
    }
    
    http { 
       
    	proxy_set_header     X-Real-IP          $remote_addr;
            proxy_set_header     Host               $host;
            proxy_set_header     X-Forwarded-For    $proxy_add_x_forwarded_for;
    	# 设置到Http请求头中，标识用户请求方式是http还是https
    	proxy_set_header     X-Forwarded-Proto  $scheme; 
    	
    	upstream  backend { 
            server    127.0.0.1:8080;
        }
        
    	
    	server {
    		listen                           443;
    		server_name                      127.0.0.1;
    		ssl                              on;
    		ssl_certificate                  cert/214404386550201.pem;
    		ssl_certificate_key              cert/214404386550201.key;
    		ssl_session_timeout              5m;
    		ssl_ciphers                      ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    		ssl_protocols                    TLSv1 TLSv1.1 TLSv1.2;
    		ssl_prefer_server_ciphers        on;
    		
            
            location ~*/* {
                proxy_pass                  http://backend;
            }
    	}
    }

b. Tomcat 配置需要从请求头中获取客户端请求协议类型： T omcat 在 server.xml 中的Host标签下配置（主要用于记录客户端请求的是http还是https）：

参考资料：

1. Tomcat 9 官网SSL配置属性：[https://tomcat.apache.org/tomcat-9.0-doc/config/http.html\#SSL\_Support\_-\_SSLHostConfig][https_tomcat.apache.org_tomcat-9.0-doc_config_http.html_SSL_Support_-_SSLHostConfig]

2. Nginx SSL+tomcat集群 Nginx tomcat no 不用https  [http://blog.csdn.net/vfush/article/details/51086274][http_blog.csdn.net_vfush_article_details_51086274]

3. nginx:\[emerg\]unknown directive "ssl" [http://blog.csdn.net/u014227715/article/details/77649156][http_blog.csdn.net_u014227715_article_details_77649156]

4. Tomcat 配置SSL两种方式：[https://stackoverflow.com/questions/6306314/tomcat-7-ssl-failed][https_stackoverflow.com_questions_6306314_tomcat-7-ssl-failed]

[Link 1]: https://common-buy.aliyun.com/?spm=5176.7968328.231195.1.7FheST&commodityCode=cas#/buy
[http_www.chinaz.com_web_2017_0105_639110.shtml]: http://www.chinaz.com/web/2017/0105/639110.shtml
[Link 2]: https://www.jianshu.com/p/2f534d1cd519
[http_blog.csdn.net_u014227715_article_details_77649156]: http://blog.csdn.net/u014227715/article/details/77649156
[https_stackoverflow.com_questions_6306314_tomcat-7-ssl-failed]: https://stackoverflow.com/questions/6306314/tomcat-7-ssl-failed
[1514460422_9345.png]: https://img-my.csdn.net/uploads/201712/28/1514460422_9345.png
[https_tomcat.apache.org_tomcat-9.0-doc_config_http.html_SSL_Support_-_SSLHostConfig]: https://tomcat.apache.org/tomcat-9.0-doc/config/http.html#SSL_Support_-_SSLHostConfig
[http_blog.csdn.net_vfush_article_details_51086274]: http://blog.csdn.net/vfush/article/details/51086274