https协议
是一种通过计算机网络进行安全通信的传输协议。HTTPS经由HTTP进行通信，但利用SSL/TLS来加密数据包。HTTPS开发的主要目的，是提供对网站服务器的身份认证，保护交换数据的隐私与完整性。这个协议由网景公司（Netscape）在1994年首次提出，随后扩展到互联网上。
简单来说，HTTPS 是 HTTP 的安全版，是使用 SSL/TLS 加密的 HTTP 协议。通过 TLS/SSL 协议的的身份验证、信息加密和完整性校验的功能，从而避免信息窃听、信息篡改和信息劫持的风险。
HTTPS 提供了加密 (Encryption)、认证 (Verification)、鉴定 (Identification) 三种功能
- 私密性(Confidentiality/Privacy):
也就是提供信息加密，保证数据传输的安全； - 可信性(Authentication):
身份验证，主要是服务器端的，确认网站的真实性，有些银行也会对客户端进行认证； - 完整性(Message Integrity):
保证信息传输过程中的完整性，防止被修改；
HTTPS就是在应用层和传输层中间加了一道验证的门槛以保证数据安全
部署服务
准备环境
| 主机名 | IP地址 | 作用 |
| web03 | 10.0.0.9 | 网站服务 |
| lb01 | 10.0.0.6 | 负载均衡 |
server { listen 443 ssl; ssl算法协议 ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl算法方式 证书机构 ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; * 指定公钥文件（证书） ssl_certificate /etc/nginx/conf.d/cert.pem; * 指定私钥文件 ssl_certificate_key /etc/nginx/conf.d/cert.key; }
创建私钥文件
[root@web03 ~]# openssl genrsa -idea -out /etc/nginx/conf.d/server.key 2048 #位数决定私钥的长度,加-idea 需要输入密码 #说明：密钥文件也可以进行加密的，并且支持后期手工加密，但不建议加密，每次使用密钥都需要解密，比较麻烦 [root@web03 ~]# chmod 600 /etc/nginx/conf.d/server.key
创建公钥文件（假证）
[root@web03 /etc/nginx/conf.d]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt # -out 生成证书 Generating a 2048 bit RSA private key .....................+++ ......................+++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN #公司信息 State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]:BJ Organization Name (eg, company) [Default Company Ltd]:edu Organizational Unit Name (eg, section) []:IT Common Name (eg, your name or your server's hostname) []:web Email Address []:1354586***@qq.com
阿里云SSL证书地址：
vim /etc/yum.repos.d/nginx.repo [nginx-stable] name=nginx stable repo baseurl=http://nginx.org/packages/centos/$releasever/$basearch/ gpgcheck=1 enabled=1 gpgkey=https://nginx.org/keys/nginx_signing.key
2. 重新配置完yum源信息，建议清除一些yum缓存信息
yum clean all yum makecache
3. 安装软件程序
yum install nginx -y
4. 编写程序配置文件
cd /etc/nginx/conf.d mv default.conf default.conf.bak vim xxx.conf
5. 编写扩展配置文件
server { listen 443 ssl; #开启ssl功能 server_name www.oldboy.com; ssl_certificate /etc/nginx/conf.d/server.crt; #公钥文件地址 ssl_certificate_key /etc/nginx/conf.d/server.key; #私钥文件地址 location / { root /html/www; index index.html index.htm; } }
user nginx; worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; #tcp_nopush on; keepalive_timeout 65; #gzip on; include /etc/nginx/conf.d/www.conf; }
模块信息： --with-http_ssl_module
server { listen 80; server_name www.oldboy.com; rewrite ^(.*)$ https://$host$1 permanent; #直接跳转到https上 }
cat /etc/nginx/confi.d/www.conf
server { listen 80; server_name www.oldboy.com; rewrite ^(.*)$ https://$host$1 permanent; } server { listen 443 ssl; server_name www.oldboy.com; ssl_certificate /etc/nginx/conf.d/server.crt; ssl_certificate_key /etc/nginx/conf.d/server.key; location / { root /html/www; index index.html index.htm; } }
说明：在https配置server基础上再添加http跳转server
情况二：
server { listen 443; listen 80; ssl on; server_name www.etiantian.org; ssl_certificate /application/nginx/conf/key/server.crt; ssl_certificate_key /application/nginx/conf/key/server.key; location / { root html/www; index index.html index.htm; } error_page 497 https://$host$uri; }
#将公钥和密钥传输到负载均衡上 [root@web03 /html]# scp -rp /etc/nginx/conf.d/server.* 172.16.1.5:/etc/nginx/conf.d/ [root@lb01 ~]# vim /etc/nginx/nginx.conf worker_processes 1; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; server { listen 80; server_name www.oldboy.com; rewrite ^(.*)$ https://$host$1 permanent; } upstream oldboy { server 10.0.0.7:443; } server { listen 443 ssl; server_name localhost; ssl_certificate /etc/nginx/conf.d/server.crt; ssl_certificate_key /etc/nginx/conf.d/server.key; location / { root html; index index.html index.htm; proxy_pass https://oldboy; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; proxy_next_upstream error timeout invalid_header http_403 http_502; } } }
后端web网站配置，跳转已经让负载均衡完成
[root@web03 /]# vim /etc/nginx/conf.d/www.conf server { listen 80; server_name www.oldboy.com; location / { root /html/www; index index.html index.htm; } }