nginxÔõôÉèÖÃssl
ҪʹÓà nginx ÉèÖà ssl£¬Ð裺»ñÈ¡ ssl Ö¤Êé¡£½¨Éè nginx ÉèÖÃÎļþ£¬Ö¸¶¨Ö¤Êé·¾¶¡£ÆôÓà ssl¡£Ìí¼ÓЧÀÍÆ÷Ãû³Æ¡£ÖØÆô nginx¡£
ÔõÑùʹÓà Nginx ÉèÖà SSL
ҪʹÓà Nginx ÉèÖà SSL£¬ÄúÐèÒªÖ´ÐÐÒÔÏ°취£º
1. »ñÈ¡ SSL Ö¤Êé
ÄúÐèÒª´ÓÖ¤Êé½ÒÏþ»ú¹¹ (CA) ¹ºÖûò»ñÈ¡Ãâ·ÑµÄ SSL Ö¤Êé¡£
2. ½¨Éè Nginx ÉèÖÃÎļþ
ʹÓÃÎı¾±à¼Æ÷½¨ÉèÒ»¸öÐ嵀 Nginx ÉèÖÃÎļþ£¬ÀýÈç “example.conf”:
server { listen 443 ssl; server_name example.com; ssl_certificate /path/to/certificate.crt; ssl_certificate_key /path/to/certificate.key; }
µÇ¼ºó¸´ÖÆ
3. ÉèÖÃÖ¤Êé·¾¶
½« “certificate.crt” ºÍ “certificate.key” Ì滻Ϊ SSL Ö¤ÊéºÍ˽ԿµÄÏÖʵ·¾¶¡£
4. ÆôÓÃ SSL
½« “listen 443 ssl;” ÐÐÌí¼Óµ½ÉèÖÃÎļþÖÐÒÔÆôÓà SSL¡£
5. Ìí¼ÓЧÀÍÆ÷Ãû³Æ
½« “server_name example.com;” Ì滻ΪÄúµÄÓòÃû¡£
6. ÖØÆô Nginx
Ҫʹ¸ü¸ÄÉúЧ£¬ÇëÖØÐÂÆô¶¯ Nginx Àú³Ì¡£
¸½¼ÓÑ¡Ïî
Öض¨Ïò HTTP µ½ HTTPS£º
server { listen 80; server_name example.com; return 301 https://$server_name$request_uri; }
µÇ¼ºó¸´ÖÆ
Ö§³Ö¶à¸öÓòÃû£º
server { listen 443 ssl; server_name example.com www.example.com; ... }
µÇ¼ºó¸´ÖÆ
ʹÓà LetsEncrypt »ñÈ¡Ãâ·Ñ SSL Ö¤Ê飺
sudo apt-get install certbot python3-certbot-nginx certbot --nginx
µÇ¼ºó¸´ÖÆ
ÆôÓà HSTS£º
add_header Strict-Transport-Security "max-age=31536000"; # ÆôÓÃ HSTS
µÇ¼ºó¸´ÖÆ
ÒÔÉϾÍÊÇnginxÔõôÉèÖÃsslµÄÏêϸÄÚÈÝ£¬¸ü¶àÇë¹Ø×¢±¾ÍøÄÚÆäËüÏà¹ØÎÄÕ£¡