nginx反向代理加https证书和自动跳转配置
nginx反向代理加https证书和自动跳转配置
如果对运维课程感兴趣，可以在b站上搜索我的账号： 运维实战课程，可以关注我，学习更多免费的运维实战技术视频
1.机器规划：
nginx代理机器：192.168.14.128
tomcat1机器: 192.168.14.129
tomcat2机器：192.168.14.130
2.实际操作步骤
1)不用nginx代理时候的直接访问后端网站：
2)配置域名解析（即类似DNS解析，通过域名能解析到nginx机器的IP，此处在本地window机器的hosts文件中配置解析，也可由自己的DNS服务器解决）
aaaaa.hotread.com <-------> 192.168.14.128 (相互对应)
3)nginx机器上(192.168.14.128)安装nginx，并配置反向代理,能通过nginx负载均衡访问服务
[root@bogon ~]# useradd nginx
[root@bogon ~]# yum -y install gcc gcc-c++
[root@bogon ~]# yum -y install openssl-devel zlib-devel pcre-devel
[root@bogon ~]# ls
nginx-1.0.5.tar.gz
[root@bogon ~]# tar -zxf nginx-1.0.5.tar.gz
[root@bogon ~]# ls
nginx-1.0.5 nginx-1.0.5.tar.gz
[root@bogon ~]# cd nginx-1.0.5
[root@bogon nginx-1.0.5]# ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src
[root@bogon nginx-1.0.5]# ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx --with-http_ssl_module
[root@bogon nginx-1.0.5]# make && make install
[root@bogon nginx-1.0.5]# ls /usr/local/nginx/
conf html logs sbin
[root@bogon nginx-1.0.5]# vim /usr/local/nginx/conf/nginx.conf
.........
upstream myserver {
server 192.168.14.129:8080;
server 192.168.14.130:8080;
}
server {
listen 80;
server_name aaaaa.hotread.com;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root html;
index index.html index.htm;
proxy_pass http://myserver;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
[root@bogon nginx-1.0.5]# /usr/local/nginx/sbin/nginx
[root@bogon nginx-1.0.5]# netstat -anput |grep 80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3691/nginx
浏览器访问：http://aaaaa.hotread.com/
4)在阿里云上申请域名对应的ca证书和私钥(aaaaa.hotread.com)，然后下载下来
下载后，解压并重命名后my.key和my.pem，如下图：
5)在nginx机器上配置https证书并配置能强制跳转到https的访问
[root@bogon nginx-1.0.5]# vim /usr/local/nginx/conf/nginx.conf
....................
upstream myserver {
server 192.168.14.129:8080;
server 192.168.14.130:8080;
}
#注意：下面已测：只有301时候可以跳转，307或其他不能跳转，或者不用if判断，直接使用跳转那条也可。
server {
listen 80;
server_name aaaaa.hotread.com;
if ($scheme = http){
return 301 https://$host$request_uri;#或return 301 https://$server_name$request_uri;
}
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root html;
index index.html index.htm;
proxy_pass http://myserver;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
server {
listen 443;
server_name aaaaa.hotread.com;
ssl on;
ssl_certificate /usr/local/nginx/ssl/my.pem;
ssl_certificate_key /usr/local/nginx/ssl/my.key;
# ssl_session_timeout 5m;
# ssl_protocols SSLv2 SSLv3 TLSv1;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
location / {
root html;
index index.html index.htm;
proxy_pass http://myserver;
}
}
[root@bogon nginx-1.0.5]# mkdir /usr/local/nginx/ssl
[root@bogon nginx-1.0.5]# cd /usr/local/nginx/ssl/
[root@bogon ssl]# rz
上传上面改过名的证书和私钥，如下：
[root@bogon ssl]# ls
my.key my.pem
[root@bogon ssl]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@bogon ssl]# /usr/local/nginx/sbin/nginx -s reload
客户端浏览器访问时候能自动跳转，如下：
访问http://aaaaa.hotread.com 会自动跳转到 https://aaaaa.hotread.com 且没有不安全的提示
回车后，如下：刷新还可以轮询
如果对运维课程感兴趣，可以在b站上搜索我的账号： 运维实战课程，可以关注我，学习更多免费的运维实战技术视频