Centos7.6 安装nginx并配置SSL证书

桃扇骨 2023-10-07 17:35 23阅读 0赞

## 安装依赖 ##

yum -y install gcc zlib zlib-devel pcre-devel openssl openssl-devel

## 下载Nginx ##

wget http://nginx.org/download/nginx-1.21.3.tar.gz

## 解压缩 ##

tar -zxvf nginx-1.21.3.tar.gz  
cd nginx-1.21.3/

## 执行配置（加载SSL模块） ##

./configure --with-http\_ssl\_module

## 编译安装(默认安装在/usr/local/nginx) ##

make  
make install

1 进入到安装的目录里面  
whereis nginx

1.  进入该路径：
2.  cd /usr/local/nginx/sbin

3 启动nginx 命令：

./nginx

4 停止

./nginx -s stop

5 重启  
./nginx -s reload

![在这里插入图片描述][watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBA5YS_5pe25Y-v5LmW5LqG_size_15_color_FFFFFF_t_70_g_se_x_16]

完整nginx配置

#user  nobody;
    worker_processes  1;
    
    #error_log  logs/error.log;
    #error_log  logs/error.log  notice;
    #error_log  logs/error.log  info;
    
    #pid        logs/nginx.pid;
    
    
    events {
        worker_connections  1024;
    }
    
    
    http {
        include       mime.types;
        default_type  application/octet-stream;
    
        #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
        #                  '$status $body_bytes_sent "$http_referer" '
        #                  '"$http_user_agent" "$http_x_forwarded_for"';
    
        #access_log  logs/access.log  main;
    
        sendfile        on;
        #tcp_nopush     on;
    
        #keepalive_timeout  0;
        keepalive_timeout  65;
    
        #gzip  on;
    	
    	
    	server {
    			listen 443 ssl;
    			server_name xxx.com; # 配置的https的域名
    			
    			
    			ssl_certificate      /usr/local/nginx/xxx.xxx.csr;  # 这个是证书的crt文件所在目录
    			ssl_certificate_key  /usr/local/nginx/xxx.xxx.key;  # 这个是证书key文件所在目录
    
    			ssl_session_cache    shared:SSL:1m;
    			ssl_session_timeout  5m;
    
    			ssl_ciphers  HIGH:!aNULL:!MD5;
    			ssl_prefer_server_ciphers  on;
    
    		 location / {
    			proxy_set_header   X-Real-IP            $remote_addr;
    			proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    			proxy_set_header   Host                   $http_host;
    			proxy_set_header   X-NginX-Proxy    true;
    			proxy_set_header   Connection "";
    			proxy_http_version 1.1;
    			 proxy_pass 		http://127.0.0.1:80;
    		 }
    
    	}
    
        server {
            listen       80;
            server_name  localhost;
    
            #charset koi8-r;
    
            #access_log  logs/host.access.log  main;
    
            location / {
                root   html;
                index  index.html index.htm;
            }
    
            #error_page  404              /404.html;
    
            # redirect server error pages to the static page /50x.html
            #
            error_page   500 502 503 504  /50x.html;
            location = /50x.html {
                root   html;
            }
    
            # proxy the PHP scripts to Apache listening on 127.0.0.1:80
            #
            #location ~ \.php$ {
            #    proxy_pass   http://127.0.0.1;
            #}
    
            # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
            #
            #location ~ \.php$ {
            #    root           html;
            #    fastcgi_pass   127.0.0.1:9000;
            #    fastcgi_index  index.php;
            #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
            #    include        fastcgi_params;
            #}
    
            # deny access to .htaccess files, if Apache's document root
            # concurs with nginx's one
            #
            #location ~ /\.ht {
            #    deny  all;
            #}
        }
    
    
        # another virtual host using mix of IP-, name-, and port-based configuration
        #
        #server {
        #    listen       8000;
        #    listen       somename:8080;
        #    server_name  somename  alias  another.alias;
    
        #    location / {
        #        root   html;
        #        index  index.html index.htm;
        #    }
        #}
    
    
        # HTTPS server
        #
        #server {
        #    listen       443 ssl;
        #    server_name  localhost;
    
        #    ssl_certificate      cert.pem;
        #    ssl_certificate_key  cert.key;
    
        #    ssl_session_cache    shared:SSL:1m;
        #    ssl_session_timeout  5m;
    
        #    ssl_ciphers  HIGH:!aNULL:!MD5;
        #    ssl_prefer_server_ciphers  on;
    
        #    location / {
        #        root   html;
        #        index  index.html index.htm;
        #    }
        #}
    
    }

PS：可能出现的错误  
nginx: \[emerg\] PEM\_read\_bio\_X509\_AUX(“xxxxxxxx.pem”) failed (SSL: error:0906D066:PEM routines:PEM\_read\_bio:bad end line)  
nginx: configuration file nginx.conf test failed

在网上查找资料发现是证书在合并的过程中有问题，用文本编辑器打开证书，发现里面的部分内容如下：
    dwDuS723dc5guuFCaR+r4Z5mow9+X7By2IMAxHuJeqj9ywAAAVhwAyL3AAAEAwBI
    MEYCIQDOmzx8eUDWCN0HukZuuyNsWtTkj9cXwvXHt7b2VhSH+wIhAMicRFn3HJIp
    wbXgQhoHGLawTWEIkdT0oTuiax34Bs4lMA0GCSqGSIb3DQEBCwUAA4IBAQALfiaS
    7kKLP6N+fCS3bOBbjg/GCRUpt23q0wCMvcU3FxdDmpMMpi3/suvo9DYhLCNJOJt5
    GJgc9PnuTYAuSeWCYj20C8SocTCG/oMASWND+KzvuLflFxlvbNLM7vAqAjuOFoVE
    YQ58D0rusrf4vBODx67bGmJwPa4SBkzbJAp2v84sdlUFplqdFWbFHt9gk6FqlcHh
    6Vlk7b8erutUo/+isEPYJz5lkadCRMrcefq/l2gUIJfbw/dyCNzSZCmRSCMAuTEy
    P02KWpP2sxhKtKn89P41V3JaicZiWPB0pEmhZ3SuIV+OGUjD4OVdHl25c3a7/uqt
    AyQzqLTZDYmqhoYG
    -----END CERTIFICATE----------BEGIN CERTIFICATE-----
    MIIFYjCCBEqgAwIBAgIQTEzYoPxP6q4VVKh/CQ7ahzANBgkqhkiG9w0BAQsFADCB
    yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
    ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
    U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
    
       -----END CERTIFICATE----------BEGIN CERTIFICATE-----在同一行，说明是在合并的时候产生的，把他改成如下的就正常了。
       
    
    dwDuS723dc5guuFCaR+r4Z5mow9+X7By2IMAxHuJeqj9ywAAAVhwAyL3AAAEAwBI
    MEYCIQDOmzx8eUDWCN0HukZuuyNsWtTkj9cXwvXHt7b2VhSH+wIhAMicRFn3HJIp
    wbXgQhoHGLawTWEIkdT0oTuiax34Bs4lMA0GCSqGSIb3DQEBCwUAA4IBAQALfiaS
    7kKLP6N+fCS3bOBbjg/GCRUpt23q0wCMvcU3FxdDmpMMpi3/suvo9DYhLCNJOJt5
    GJgc9PnuTYAuSeWCYj20C8SocTCG/oMASWND+KzvuLflFxlvbNLM7vAqAjuOFoVE
    YQ58D0rusrf4vBODx67bGmJwPa4SBkzbJAp2v84sdlUFplqdFWbFHt9gk6FqlcHh
    6Vlk7b8erutUo/+isEPYJz5lkadCRMrcefq/l2gUIJfbw/dyCNzSZCmRSCMAuTEy
    P02KWpP2sxhKtKn89P41V3JaicZiWPB0pEmhZ3SuIV+OGUjD4OVdHl25c3a7/uqt
    AyQzqLTZDYmqhoYG
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    MIIFYjCCBEqgAwIBAgIQTEzYoPxP6q4VVKh/CQ7ahzANBgkqhkiG9w0BAQsFADCB
    yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
    ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
    U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
    
    
    **
    如果还不行就修改：
    			ssl_certificate      /usr/local/nginx/xxx.com_bundle.pem;  # 这里不一定非要crt，pem文件也许
    			ssl_certificate_key  /usr/local/nginx/xxx.xxx.key;  # 这个是证书key文件所在目录**

[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBA5YS_5pe25Y-v5LmW5LqG_size_15_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/0113bd93e1d049c9bffe07ba311ea104.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5YS_5pe25Y-v5LmW5LqG,size_15,color_FFFFFF,t_70,g_se,x_16