SSL原理、生成SSL密钥对、Nginx配置SSL

[root@jimmylinux-001 ~]# cd /usr/local/nginx/conf
[root@jimmylinux-001 conf]# openssl genrsa -des3 -out tmp.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................+++
...............................+++
e is 65537 (0x10001)
Enter pass phrase for tmp.key:              输入密码abcd1234
Verifying - Enter pass phrase for tmp.key:  再次确认密码

[root@jimmylinux-001 conf]# openssl rsa -in tmp.key -out jimmy.key
Enter pass phrase for tmp.key:
writing RSA key

[root@jimmylinux-001 conf]# rm -f tmp.key

[root@jimmylinux-001 conf]# openssl req -new -key jimmy.key -out jimmy.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:China
string is too long, it needs to be less than  2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:ShenZhen
Locality Name (eg, city) [Default City]:ShenZhen
Organization Name (eg, company) [Default Company Ltd]:jimmy
Organizational Unit Name (eg, section) []:jimmy
Common Name (eg, your name or your server's hostname) []:jimmylinux
Email Address []:joan2008.lms@gmail.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:jimmy

[root@jimmylinux-001 conf]# openssl x509 -req -days 365 -in jimmy.csr -signkey jimmy.key -out jimmy.crt

[root@jimmylinux-001 vhost]# vim ssl.conf    新建配置文件

添加以下内容

server
{
    listen 443;                               监听端口
    server_name jimmy.com;
    index index.html index.php;
    root /data/wwwroot/jimmy.com;
    ssl on;                                   开启SSL支持HTTPS
    ssl_certificate jimmy.crt;                指定公钥
    ssl_certificate_key jimmy.key;            指定私钥
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;      SSL协议
}

[root@jimmylinux-001 nginx-1.12.1]# make

[root@jimmylinux-001 nginx-1.12.1]# make install

[root@jimmylinux-001 nginx-1.12.1]# /etc/init.d/nginx restart  重启Nginx
Restarting nginx (via systemctl):                          [  确定  ]
[root@jimmylinux-001 nginx-1.12.1]# netstat -lntp  检查监听端口
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      4020/nginx: master  
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      934/sshd            
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1305/master         
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      4020/nginx: master  多一个443的端口
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      1310/php-fpm: maste 
tcp6       0      0 :::22                   :::*                    LISTEN      934/sshd            
tcp6       0      0 ::1:25                  :::*                    LISTEN      1305/master         
tcp6       0      0 :::3306                 :::*                    LISTEN      1286/mysqld

[root@jimmylinux-001 nginx-1.12.1]# cd /data/wwwroot/jimmy.com/

[root@jimmylinux-001 jimmy.com]# ls

[root@jimmylinux-001 jimmy.com]# vim 1.txt  新建测试文件

添加以下内容
This is SSL test page.

[root@jimmylinux-001 jimmy.com]# mv 1.txt index.html  重新更名成index.html文件

[root@jimmylinux-001 jimmy.com]# curl -x127.0.0.1:443 https://jimmy.com/  如果直接使用curl方式访问，就会报400的错误状态码。
curl: (56) Received HTTP code 400 from proxy after CONNECT

[root@jimmylinux-001 jimmy.com]# iptables -nvL  检查如果有防火墙

[root@jimmylinux-001 jimmy.com]# iptables -F    可以直接-F