Nginx实现多域名证书HTTPS

253次阅读

没有评论

共计 4603 个字符，预计需要花费 12 分钟才能阅读完成。

目前公司有 2 个域名，其中这次涉及到 3 个子域名需要更改为 HTTPS 传输，分别为:

passport.abc.com

www.test.com

admin.test.com

那么就涉及到购买 ssl 证书的问题，由于价格问题使用 3 个不同的证书(每个域名一个)。

由于实验环境，我们就手动生成 3 个 ssl 证书

[root@gz122haproxy95 ～]# mkdir ~/keys
[root@gz122haproxy95 keys]# cd ~/keys
[root@gz122haproxy95 keys]# openssl genrsa -out passport.abc.com.key 2048
[root@gz122haproxy95 keys]# openssl req -new -key passport.abc.com.key -out passport.abc.com.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]:CN #国家
State or Province Name (full name) [Berkshire]:GuangDong #省份
Locality Name (eg, city) [Newbury]:ShenZhen #城市
Organization Name (eg, company) [My Company Ltd]:Test.Inc #公司名称
Organizational Unit Name (eg, section) []:passport.abc.com #组织名称
Common Name (eg, your name or your server’s hostname) []:passport.abc.com #域名
Email Address []:passport@abc.com
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

[root@gz122haproxy95 keys]# openssl x509 -req -days 3650 -in passport.abc.com.csr -signkey passport.abc.com.key -out passport.abc.com.crt

按照以上方法，把名称替换掉再制作 2 份, 最后的结果就是

[root@gz122haproxy95 keys]# ls -l
total 36
-rw-r–r– 1 root root 1354 Dec 4 16:54 admin.test.com.crt
-rw-r–r– 1 root root 1050 Dec 4 16:54 admin.test.com.csr
-rw-r–r– 1 root root 1675 Dec 4 16:52 admin.test.com.key
-rw-r–r– 1 root root 1354 Dec 4 16:48 passport.abc.com.crt
-rw-r–r– 1 root root 1078 Dec 4 16:44 passport.abc.com.csr
-rw-r–r– 1 root root 1675 Dec 4 16:41 passport.abc.com.key
-rw-r–r– 1 root root 1354 Dec 4 16:52 www.test.com.crt
-rw-r–r– 1 root root 1062 Dec 4 16:52 www.test.com.csr
-rw-r–r– 1 root root 1679 Dec 4 16:51 www.test.com.key

现在就是 Nginx 和 OpenSSL 的安装与配置(这里注意，一般情况下一个 IP 只支持一个 SSL 证书，那么我们现在要在一个 IP 上实现多个 SSL 证书，就必须让 Nginx 支持 TLS SNI，由于默认的 OpenSSL 是没有打开 TLS SNI 的)

[root@gz122haproxy95 ~]# wget
[root@gz122haproxy95 ~]# tar zxf openssl-0.9.8zh.tar.gz
[root@gz122haproxy95 ~]# wget http://nginx.org/download/nginx-1.8.0.tar.gz
[root@gz122haproxy95 ~]# tar zxf nginx-1.8.0.tar.gz
[root@gz122haproxy95 ~]# cd nginx-1.8.0
[root@gz122haproxy95 nginx-1.8.0]# ./configure –prefix=/usr/local/nginx1.8.0 –user=www –group=www –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-openssl=../openssl-0.9.8zh
[root@gz122haproxy95 nginx-1.8.0]# make && make install
# 上面只需要解压 openssl 即可，然后在 nginx 的配置参数中添加 –with-openssl=DIR 指定路径即可, 另外由于 openssl 需要编译，所以时间会较长。

在编译安装 nginx 的时候可能会出现 pcre 库没找到或 zlib 没找到，在 CentOS 下可以使用

yum -y install pcre-devel zlib-devel

在安装编译好 Nginx 后，执行

[root@gz122haproxy95 nginx-1.8.0]# /usr/local/nginx1.8.0/sbin/nginx -V
nginx version: nginx/1.8.0
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 0.9.8zh 3 Dec 2015
TLS SNI support enabled #可以看到 TLS SNI support 打开了
configure arguments: –prefix=/usr/local/nginx1.8.0 –user=www –group=www –with-http_stub_status_module –with-http_ssl_module –with-http_gzip_static_module –with-openssl=../openssl-0.9.8zh

然后配置 nginx

upstream passport.abc.com {
server 192.168.20.87:80;
server 192.168.20.88:80;

}

# HTTPS server
#
server {
listen 443 ssl;
server_name passport.abc.com;

ssl_certificate /root/keys/passport.abc.com.crt;
ssl_certificate_key /root/keys/passport.abc.com.key;

ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;

ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location / {
proxy_pass http://passport.abc.com;
}
}

upstream www.test.com {
server 192.168.20.98:80;
server 192.168.20.99:80;

}

# HTTPS server
#
server {
listen 443 ssl;
server_name www.test.com;

ssl_certificate /root/keys/www.test.com.crt;
ssl_certificate_key /root/keys/www.test.com.key;

ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;

ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location / {
proxy_pass http://www.test.com;
}
}