一:HTTPS的注意事项

• https不支持续费,证书到期需要重新并进行替换
• https如果是通配符域名*.cxy.com,二级域名和三级域名需要分别购买,如test.y.cxy.com
• https显示绿色,说明整个网站的URL都是https
• https显示黄色,说明网站代码中包含http的不安全链接
• https显示红色,要么证书是假的,要么证书过期了

二:Nginx单台实现HTTPS

2.1 准备环境

#nginx必须有ssl模块
[root@web01-7 ~]# nginx -V
--with-http_ssl_module

#创建存放ssl证书的路径
[root@web01-7 ~]# cd /etc/nginx/
[root@web01-7 nginx]# mkdir ssl_key
[root@web01-7 nginx]# cd ssl_key/

2.2 通过openssl生成私钥和证书

#生成私钥
[root@web01-7 ~]# cd /etc/nginx/ssl_key
[root@web01 /etc/nginx/ssl_key]# openssl genrsa -idea -out server.key 2048
#记住配置密码
Enter pass phrase for server.key: 
Verifying - Enter pass phrase for server.key:

#通过生成的私钥生成证书
[root@web01 /etc/nginx/ssl_key]# 
Country Name (2 letter openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt  
State or Province Name (full name) []:SZ
Locality Name (eg, city) [Default City]:SZ
Organization Name (eg, company) [Default Company Ltd]:MKTG
Organizational Unit Name (eg, section) []:SA
Common Name (eg, your name or your server's hostname) []:MKTG
Email Address []: XXXX@qq.com

# req -->用于创建新的证书 
# new -->表示创建的是新证书 
# x509 -->表示定义证书的格式为标准格式 
# key -->表示调用的私钥文件信息 
# out -->表示输出证书文件信息 
# days -->表示证书的有效期

2.3 配置单个实例

[root@web01-7 conf.d]# vim /etc/nginx/conf.d/ssl.conf
server {
        listen 443 ssl;                                     #开启ssl认证
        server_name s.cxy.com;
        ssl_certificate ssl_key/server.crt;        
        ssl_certificate_key ssl_key/server.key;

        location / {
                root /code/ssl;
                index index.html;
        }
}

server {
        listen 80;
        server_name s.cxy.com;
        rewrite ^(.*) https://$server_name$1 redirect;   #强制跳转http到https
}

三:集群实现HTTPS(wordpress和zh)

image.png

思路:
web服务器上不需要做任何操作
通过负载均衡服务器去完成https的访问

3.1 在负载均衡lb01上生成证书

[root@lb01-5 ~]# cd /etc/nginx/ssl_key
[root@lb01-5 ~]# cd /etc/nginx/ssl_key
[root@lb01-5 /etc/nginx/ssl_key]# openssl genrsa -idea -out server.key 2048

##通过生成的密钥生成证书
[root@lb01-5 /etc/nginx/ssl_key]# openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout server.key -out server.crt  

3.2 将lb01上的证书复制到lb02上

[root@lb01-5 conf.d]# scp /etc/nginx/ssl_key/* 10.0.0.6:/etc/nginx/ssl_key/

3.3 配置lb01上和lb02上的nginx负载均衡配置文件

[root@lb01-5 ~]# cat /etc/nginx/conf.d/ssl_proxy.conf 
upstream cxy {
    server 172.16.1.7:80;
    server 172.16.1.8:80;
    server 172.16.1.9:80;

}

server {
    listen 443 ssl;
    server_name blog.cxy1.com;
    ssl_certificate ssl_key/server.crt;
    ssl_certificate_key ssl_key/server.key;

    location / {
        proxy_pass http://cxy;
        include proxy_params;

    }
}

server {
        listen 443 ssl;
        server_name zh.cxy1.com;
        ssl_certificate ssl_key/server.crt;
        ssl_certificate_key ssl_key/server.key;

        location / {
                proxy_pass http://cxy;
                include proxy_params;

        }

}

server {
    listen 80;
    server_name blog.cxy1.com;
    rewrite (.*) https://$server_name$1 redirect;

}

server {
    listen 80;
    server_name zh.cxy1.com;
    rewrite (.*) https://$server_name$1 redirect;
}

#重启nginx服务
[root@lb01-5 conf.d]# systemctl restart nginx

#lb02上的配置和lb01上的一样

3.4 完善wordpress和zh的配置

#想要通过https访问wordpress,还需要到web服务器上修改wordpress的nginx配置文件
location ~ \.php$ {
        root  /code/wordpress;
        .......
        fastcgi_param HTTPS on;   ##加这一条

image.png

zh论坛只需要修改论坛web后台设置

image.png