CentOS Linux服务器，在Nginx上安装SSL证书，支持HTTPS

╰半夏微凉° 2022-12-30 13:38 122阅读 0赞

# CentOS Linux服务器，在Nginx上安装SSL证书，支持HTTPS #

环境是阿里云+CentOS 7.8+Nginx+免费的SSL证书

## 证书购买 ##

阿里云上购买SSL证书，买个免费的  
https://common-buy.aliyun.com/?spm=5176.14113079.0.0.36a756a7dssHuu&commodityCode=cas  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70]

## 证书申请 ##

在SSL证书管理平台上面，

*  证书申请
 *  证书绑定域名
 *  填写联系人
 *  等等
 *  最后会签发证书给你  
    ![在这里插入图片描述][20201225173005985.png]

## 证书下载 ##

![在这里插入图片描述][20201225183055826.png]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70 2]

## 证书上传 ##

通过XShell远程登录到CentOS，做如下操作

*  在ngnix/conf目录下面新建cert文件夹
 *  然后把刚才下载证书上传到cert文件夹，两个都上传key和pem

[root@iZ2zej1nogjvot6f4dzt6eZ ~]# cd /usr/local/nginx/conf
    [root@iZ2zej1nogjvot6f4dzt6eZ conf]# mkdir cert
    [root@iZ2zej1nogjvot6f4dzt6eZ cert]# rz

## 配置Nginx ##

[root@iZ2zej1nogjvot6f4dzt6eZ conf]# vim /usr/local/nginx/conf/nginx.conf

在http底下添加一个server，原本的http的server不要动，现在是增加https的server

# HTTPS server
    
        server { 
            listen       443 ssl;
            server_name  yourdomain.com;
    
            ssl_certificate      cert/cert-file-name.pem;
            ssl_certificate_key  cert/cert-file-name.key;
    
            ssl_session_cache    shared:SSL:1m;
            ssl_session_timeout  5m;
    
            ssl_ciphers  HIGH:!aNULL:!MD5;
            ssl_prefer_server_ciphers  on;
    
            #location / { 
            # root html;
            # index index.html index.htm;
            #}
            location / { 
                root   /usr/local/nginx/dist;
                try_files $uri $uri/ /index.html;
                index  index.html index.htm;
            }
    
            location /prod-api/{ 
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header REMOTE-HOST $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://localhost:8080/;
            }
    
        }

## 安全组规则开放 443端口 ##

![在这里插入图片描述][20201225182928326.png]

## 重启Nginx ##

到这里，不出意外的话，就可以用了，但是人生总会遇到各种坎坷。

[root@iZ2zej1nogjvot6f4dzt6eZ conf]# cd /usr/local/nginx/sbin 
    [root@iZ2zej1nogjvot6f4dzt6eZ sbin]# ./nginx -s reload

## 第一个问题：缺少ngx\_http\_ssl\_module ##

[root@iZ2zej1nogjvot6f4dzt6eZ sbin]# ./nginx -s reload
    nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:109

这时候需要重新编译Nginx，再重新启动

*  configure添加with-http\_ssl\_module模块
 *  编译make
 *  停止Nginx，但是停不下来，因为有错误，只能手动杀死进程
 *  确认Nginx停止来后，把刚才编译的Nginx拷贝过去，覆盖掉原Nginx
 *  重新启动Nginx，重新载入配置文件

[root@iZ2zej1nogjvot6f4dzt6eZ software]# cd nginx-1.18.0
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module
    ……
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# make
    ……
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# cd /usr/local/nginx/sbin
    [root@iZ2zej1nogjvot6f4dzt6eZ sbin]# ./nginx -s stop
    nginx: [emerg] the "ssl" parameter requires ngx_http_ssl_module in /usr/local/nginx/conf/nginx.conf:109
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# ps aux|grep nginx
    root     13103  0.0  0.0 112812   972 pts/0    S+   16:09   0:00 grep --color=auto nginx
    root     25828  0.0  0.0  20564   620 ?        Ss   Nov04   0:00 nginx: master process /usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
    nobody   25829  0.0  0.0  21004  1876 ?        S    Nov04   0:08 nginx: worker process
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# kill -9 25828
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# kill -9 25829
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# ps aux|grep nginx
    root     13111  0.0  0.0 112812   972 pts/0    S+   16:10   0:00 grep --color=auto nginx
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# cp ./objs/nginx /usr/local/nginx/sbin/
    cp: overwrite ‘/usr/local/nginx/sbin/nginx’? y
    [root@iZ2zej1nogjvot6f4dzt6eZ nginx-1.18.0]# cd /usr/local/nginx/sbin
    [root@iZ2zej1nogjvot6f4dzt6eZ sbin]# ./nginx
    [root@iZ2zej1nogjvot6f4dzt6eZ sbin]# ./nginx -s reload

## 第二个问题 Nginx 404 ##

Nginx 404是因为你这个https进来默认的是443端口（http默认80端口），这个端口你没有配置页面，需要重定向  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70 3]

## 验证成功 ##

https://yourdomain.com   #需要将yourdomain.com替换成证书绑定的域名。

如果网页地址栏出现小锁标志，表示证书已经安装成功。也成功刷出界面。  
![在这里插入图片描述][20201225182335835.png]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70_pic_center]

参考文档：[在Nginx（或Tengine）服务器上安装证书][Nginx_Tengine]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70]: /images/20221120/da6aae5207ed45de9d89a7bd3ea9dec3.png
[20201225173005985.png]: https://img-blog.csdnimg.cn/20201225173005985.png
[20201225183055826.png]: https://img-blog.csdnimg.cn/20201225183055826.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20201225173234890.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20201225173746721.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu,size_16,color_FFFFFF,t_70
[20201225182928326.png]: https://img-blog.csdnimg.cn/20201225182928326.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20201225182656277.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu,size_16,color_FFFFFF,t_70
[20201225182335835.png]: https://img-blog.csdnimg.cn/20201225182335835.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu_size_16_color_FFFFFF_t_70_pic_center]: https://img-blog.csdnimg.cn/20201225182822523.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2thbmd3ZWlqaWFu,size_16,color_FFFFFF,t_70#pic_center
[Nginx_Tengine]: https://help.aliyun.com/document_detail/98728.html?spm=5176.14113079.0.dexternal.3e4756a7IRvHIT