HTTPS forwarding HTTP process
1. Process description
To enable the SSL function of Nginx, the Windows version comes with its own http_ssl_module
module and Linux needs to install it. To install this module, you must install it first openssl
. The steps are as follows:
- Install OpenSSL,
- Rewrite and compile Nginx to add the http_ssl_module module,
- Generate certificate number,
- Nginx adds configuration.
Installation Environment:
[root@tcloud ~]# cat /etc/centos-release
CentOS Linux release 7.9.2009 (Core)
2. Install OpenSSL
The version installed this time is openssl-1.1.1s.tar.gz
, the installation script opensslInstall.sh
content is as follows:
#!/bin/bash
echo "(1/4): 安装依赖 gcc zlib..."
yum -y install gcc zlib
echo "(1/4): 依赖 gcc zlib安装完毕"
echo "(2/4): 解压$1.tar.gz安装文件..."
tar -zxvf $1.tar.gz -C /usr/local
sleep 3
echo "(2/4): 安装文件解压完毕"
echo "(3/4): 检测OpenSSL安装环境..."
cd /usr/local/$1
./config shared zlib --prefix=/usr/local/openssl
echo "(3/4): OpenSSL安装环境检测成功"
echo "(4/4): 编译安装OpenSSL..."
make && make install
echo "(4/4): OpenSSL编译安装完成"
cat <<'EOF' > /etc/profile.d/openssl.sh
export OPENSSL=/usr/local/openssl/bin
export PATH=$OPENSSL:$PATH:$HOME/bin
EOF
sleep 1
source /etc/profile.d/openssl.sh
Script call:
# 脚本参数为安装文件的版本信息 也就是解压后的文件夹
./opensslInstall.sh openssl-1.1.1s
Pay special attention here: tar -zxvf $1.tar.gz -C /usr/local
. After the actual installation is completed, the OpenSSL files are stored in /usr/local/openssl-1.1.1s
the path. This folder will be used later when Nginx installs http_ssl_module.
3.Nginx install http_ssl module
#!/bin/bash
echo "(1/4): 安装依赖pcre-devel..."
yum -y install pcre-devel
sleep 5
echo "(1/4): 依赖pcre-devel安装完毕"
echo "(2/4): 解压Nginx安装文件..."
tar -zxvf nginx-1.23.1.tar.gz
sleep 3
echo "(2/4): Nginx安装文件解压完毕"
echo "(3/4): 检测Nginx安装环境..."
cd nginx-1.23.1/
./configure --with-http_ssl_module --with-openssl=/usr/local/openssl-1.1.1s --prefix=/usr/local/nginx1.23.1
echo "(3/4): Nginx安装环境检测成功"
echo "(4/4): 编译安装Nginx..."
make & make install
echo "(4/4): Nginx编译安装完成"
There is a big --with-http_ssl_module --with-openssl=/usr/local/openssl-1.1.1s
hole --with-openssl=/usr/local/openssl-1.1.1s
The decompressed source code folder of OpenSSL is not the folder after installation. Special attention needs to be paid.
4. Self-signed certificate generation
4.1 Step by step generation
# 1.生成长度为1024的RSA密钥对并使用Triple DES算法进行加密
openssl genrsa -des3 -out test-en.key 1024
# 输入密码并验证密码【第2和第3步】都会用到这个密码
Enter pass phrase for test-en.key:
Verifying - Enter pass phrase for test-en.key:
# 2.创建新的证数签名
openssl req -new -key test-en.key -out test.csr
# 输入【第1步的密码】
Enter pass phrase for test-en.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
# 除 Common Name 外都可为空
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HN
Locality Name (eg, city) [Default City]:ZZ
Organization Name (eg, company) [Default Company Ltd]:TEST
Organizational Unit Name (eg, section) []:DC
Common Name (eg, your name or your server's hostname) []:192.168.0.1
Email Address []:.
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:.
An optional company name []:.
# 3.去掉密码
openssl rsa -in test-en.key -out test.key
# 输入【第1步的密码】
Enter pass phrase for test-en.key:
writing RSA key
# 4.生成一个自签名的X.509数字证书 有效期365天
openssl x509 -req -days 365 -in test.csr -signkey test.key -out test.crt
# 成功标志
Signature ok
- -x509: Specifies the command to generate X.509 digital certificate.
- -req: Specifies that the input file is a certificate signing request.
- -days 3650: Specifies that the certificate is valid for 365 days (approximately 1 year).
- -in test.csr: Specify the input certificate signing request file as test.csr.
- -signkey test.key: Specify the private key file used to sign the certificate as test.key.
- -out test.crt: Specify the name of the generated self-signed digital certificate file as test.crt, and save the generated certificate in this file.
This command generates a self-signed X.509 digital certificate based on the provided certificate signing request file test.csr and private key file test.key, and saves the generated certificate in the test.crt file. A self-signed certificate is a certificate signed by the private key holder itself and does not require certification by a third-party Certificate Authority (CA).
The generated self-signed certificate can be used for various purposes, such as for testing, secure communication in development environments, internal websites, etc. Note that self-signed certificates may be considered untrusted by browsers or other applications in a public environment because they have not been certified by a publicly trusted third-party authority.
4.2 Automated generation
The contents of the automated generation script certificateGenerate.sh
are as follows:
#!/bin/bash
echo "(1/5): 生成密钥对开始..."
openssl genrsa -des3 -out test-en.key -passout pass:test 1024
echo "(1/5): 生成密钥对结束。"
echo "(2/5): 创建新的证数签名开始..."
openssl req -new -key test-en.key -out test.csr -passin pass:test -subj "/C=CN/ST=HN/L=ZZ/O=TEST/CN=$1"
sleep 2
echo "(2/5): 创建新的证数签名结束。"
echo "(3/5): 密钥去除密码..."
openssl rsa -in test-en.key -out test.key -passin pass:test
echo "(3/5): 密钥去除密码成功。"
echo "(4/5): 生成自签名证数..."
openssl x509 -req -days 3650 -in test.csr -signkey test.key -out test.crt
echo "(4/5): 生成自签名证数成功。"
echo "(5/5): 删除过程文件..."
rm -rf test-en.key test.csr
echo "(5/5): 删除过程文件成功。"
Script call:
# 脚本参数为IP或域名
./certificateGenerate.sh tcloud
5.Nginx configuration
Delete some comments here and only keep the core configuration, and https://IP:18080
forward the request to http://IP:8080
the following:
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
server {
listen 18080 ssl;
server_name localhost;
ssl_certificate /pathto/test.crt;
ssl_certificate_key /pathto/test.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://localhost:8080/;
proxy_redirect off;
proxy_set_header Host $host:8080;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Cookie $http_cookie;
}
}
}
6. Summary
- Nginx in the Windows environment comes with its own SSL module, but it is difficult to generate a self-signed certificate in the Windows environment. It can be generated and used in the Linux environment.
- When Nginx installs the SSL module in a Linux environment, it must be compiled using the source code of OpenSSL. This should be noted.