记一次zabbix-web切换nginx-https

 

系统环境：

系统：CentOS Linux release 7.6.1810 (Core)

zabbix 4.0

Mysql  5.7

Nginx 1.17.1     

 

Linux 系统通过openssl命令生成证书：

首先执行如下命令生成一个key
openssl genrsa -des3 -out ssl.key 1024

然后他会要求你输入这个key文件的密码。不推荐输入。因为以后要给nginx使用。每次reload nginx配置时候都要你验证这个PAM密码的。
由于生成时候必须输入密码。你可以输入后 再删掉。

mv ssl.key xxx.key
openssl rsa -in xxx.key -out ssl.key
rm xxx.key
然后根据这个key文件生成证书请求文件

openssl req -new -key ssl.key -out ssl.csr
以上命令生成时候要填很多东西 一个个看着写吧（可以随便，毕竟这是自己生成的证书）

最后根据这2个文件生成crt证书文件

openssl x509 -req -days 365 -in ssl.csr -signkey ssl.key -out ssl.crt
这里365是证书有效期 推荐3650哈哈。这个大家随意。最后使用到的文件是key和crt文件。

如果需要用pfx 可以用以下命令生成
openssl pkcs12 -export -inkey ssl.key -in ssl.crt -out ssl.pfx

 

 

 开始安装php72

yum -y remove php*

rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

yum -y install php72w php72w-cli php72w-common php72w-devel php72w-embedded php72w-fpm php72w-gd php72w-mbstring  php72w-opcache php72w-pdo php72w-xml

 

配置Nginx（安装省略）

主配置文件：

[root@Centos-master ~]# cat   /etc/nginx/nginx.conf

user root;

worker_processes  4;

 

 

error_log         /var/log/nginx/error.log warn;

pid               /var/run/nginx.pid;

 

worker_rlimit_nofile 10240;

 

events {

    worker_connections   10240;

    multi_accept on;

    use epoll;

}

 

http {

    include       /etc/nginx/mime.types;

    default_type  application/octet-stream;

    log_format    main  '$remote_addr - $remote_user [$time_local] "$request" '

                        '$status $body_bytes_sent "$http_referer" '

                        '"$http_user_agent" "$http_x_forwarded_for"';

    access_log    /var/log/nginx/access.log  main;

    sendfile               on;

    tcp_nopush             on;

    keepalive_timeout      10;

    #gzip                  on;

    server_names_hash_bucket_size 128;

    client_header_buffer_size     32k;

    large_client_header_buffers   4 32k;

    client_max_body_size    300m;

    tcp_nodelay             on;

    server_tokens           off;

    client_body_buffer_size 512k;

    proxy_connect_timeout   600;

    proxy_send_timeout      600;

    proxy_read_timeout      600;

    proxy_buffer_size       64k;

    proxy_buffers           4 128k;

    proxy_busy_buffers_size 256k;

    proxy_temp_file_write_size 256k;

    proxy_temp_path /var/cache/nginx/proxy_temp;

    client_header_timeout   10;

    client_body_timeout     10;

    send_timeout            10;

    max_ranges              1;

    map $http_upgrade $connection_upgrade {

    default upgrade;

    '' close;

    }

   include /etc/nginx/conf/Include/*.conf;

}

 

 

Zabbix域配置文件：

 

 

[root@Centos-master ~]# cat   /etc/nginx/conf/Include/zabbix.conf

 

server {

    listen       80;

    server_name  192.168.31.103;

}

server {

    listen       443 ssl;

    server_name  192.168.31.103;

    

    root /usr/share/zabbix;   

    index index.php index.html index.htm;

    ssl_certificate     /usr/local/nginx/ssl-certs/ssl.crt;

    ssl_certificate_key /usr/local/nginx/ssl-certs/ssl.key;

    ssl_session_timeout 5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_prefer_server_ciphers on;

 

 

 

   location / {

        try_files $uri $uri/ /index.php?$query_string;

    }

    location ^~ /app {

        deny all;

    }

    location ^~ /conf {

        deny all;

    }

    location ^~ /local {

        deny all;

    }

    location ^~ /include {

        deny all;

    }

    location ~ \.php$ {

        try_files $uri =404;

        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        fastcgi_pass   127.0.0.1:9000;

        fastcgi_index  index.php;

        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        include        fastcgi_params;

    }

}

 

 

配置Nginx启动服务文件：

[root@Centos-master ~]# cat /lib/systemd/system/nginx.service

[Unit]

Description=nginx - high performance web server

Documentation=http://nginx.org/en/docs/

After=network.target

[Service]

Type=forking

ExecStart=/usr/sbin/nginx

ExecReload=/usr/sbin/nginx -s reload

ExecStop=/usr/sbin/nginx -s stop

PrivateTmp=true

 

[Install]  

WantedBy=multi-user.target

 

 

 

加载系统服务 ：

systemctl daemon-reload

 

设置开机启动：

systemctl enable nginx

 

启动 nginx：

systemctl start nginx

最终，切换nginx及配置https成功：