Nginx configures https and wss

1. Apply for an https certificate

You can apply for a free ssl certificate on Alibaba Cloud, which can be replaced once a year

Two, Nginx configuration ssl

upstream tomcat_web{
    
    
     server 127.0.0.1:8080;
}

server {
    
    
    listen  443 ssl;
    server_name  www.xxx.com;
	## 配置日志文件
    access_log  /var/log/nginx/web/xxx-ssl-access.log  main;
    error_log  /var/log/nginx/web/xxx-ssl-err.log;
    ## 配置证书所在目录
    ssl_certificate   sslkey/www.xxx.com.pem;
    ssl_certificate_key sslkey/www.xxx.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_prefer_server_ciphers on;
    ssl_session_timeout 1d;
    ssl_stapling on;
    ssl_stapling_verify on;
    ## 重要，否则应用redirect的时候，会跳转到http，这里强制替换成https
    proxy_redirect http:// $scheme://;

    location / {
    
    
        root   /usr/share/nginx/html;
        index  index.html index.htm;

        proxy_set_header    Host $host;
        proxy_set_header    X-Real-IP  $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto  $scheme;
        proxy_pass      http://tomcat_web;
        proxy_http_version 1.1;
        ## 以下两个配置如果没配置，websocket会报错，链接时使用wss://
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

		## 配置上传文件大小 300Mb
        client_max_body_size 300m;
        client_body_buffer_size 128k;
        ## 配置链接超时时间 10分钟
        proxy_connect_timeout 600;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        proxy_buffer_size 64k;
        proxy_buffers   4 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
    }

}

Note:
1. After the configuration is complete, nginx needs to be restarted, and the reload certificate will not take effect.
2. If you need to support the wss protocol, you need to add configuration:
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
3. After configuring https, finally disable http. Through the following configuration, force jump to https
proxy_redirect http:// $scheme://;