Nginx、Tomcat配置https

一、Nginx、Tomcat配置https

　　前提就是已经得到了CA机构颁发的证书

  一、合并证书

　　1、假设证书文件如下

　　秘钥文件server.key，证书CACertificate-INTERMEDIATE-1.crt、CACertificate-ROOT-2.crt和ServerCertificate.crt

　　2、使用cat命令合并证书

cd /application/nginx/ssl
cat CACertificate-INTERMEDIATE-1.crt>>ServerCertificate.crt
cat CACertificate-ROOT-2.crt>>ServerCertificate.crt

  二、nginx反向代理证书

　　/application/nginx/conf/vhost/oil_price_applet.conf

upstream oilprice.test {
    server    localhost:8443;
}
server {
    listen       443;
    server_name  oilprice.test.com;
    root   /www/html/oil_price_applet;
    access_log  logs/access.log  main;
    ssl                  on;
    ssl_certificate      /application/nginx/ssl/ServerCertificate.crt;
    ssl_certificate_key  /application/nginx/ssl/server.key;
    ssl_session_timeout  5m;

    location / {
        root   /www/html/oil_price_applet;
        index  index.html index.htm index.php;
        proxy_pass  https://oilprice.test;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header REMOTE-HOST $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 1000m;
        client_body_buffer_size 1024k;
        proxy_connect_timeout 90;
        proxy_send_timeout 90;
        proxy_read_timeout 90;
        proxy_buffer_size 1024k;
        proxy_buffers 4 1024k;
        proxy_busy_buffers_size 1024k;
        proxy_temp_file_write_size 1024k;
        proxy_max_temp_file_size 128m;
    }
    location ~.*\.(php|php5)?$ {
        root   /www/html/oil_price_applet;
        fastcgi_pass  127.0.0.1:9000;
        fastcgi_index  index.php;
        include  fastcgi.conf;
   }
}

/application/nginx/conf/vhost/oil_price_applet.conf

  三、在Tomcat下配置https生成keystore

　　切记：设置的密码

　　1、Convert x509 Cert and Key to a pkcs12 file（将证书和私钥转换为p12格式的证书）

openssl pkcs12 -export -in ServerCertificate.crt -inkey server.key \
               -out server.p12 -name some-alias 

　　2、 Convert the pkcs12 file to a java keystore （将pkcs12格式的证书转换成java keystore）

keytool -importkeystore \
        -deststorepass Ctb+wZs1 -destkeypass Ctb+wZs1  -destkeystore server.keystore \
        -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass Ctb+wZs1  \
        -alias some-alias

　　3、配置Tomcat

    <Connector port="8443"
                protocol="org.apache.coyote.http11.Http11NioProtocol"
                SSLEnabled="true"
                scheme="https"
                secure="true"
                keystoreFile="/application/nginx/ssl/server.keystore"
                keystorePass="Ctb+wZs1"
                sslProtocol="TLS"
                URIEncoding="utf-8" />

　　4、重启Tomcat生效