nginx配置CDN和自签名SSL

nginx自签证书

[root@Mike-VM-Node-172_31_225_214 ~]# openssl genrsa -des3 -out tmp.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................................+++
...............................+++
e is 65537 (0x10001)
Enter pass phrase for tmp.key:
Verifying - Enter pass phrase for tmp.key:
[root@Mike-VM-Node-172_31_225_214 ~]#  
[root@Mike-VM-Node-172_31_225_214 ~]# openssl rsa -in tmp.key -out chao.key
Enter pass phrase for tmp.key:
writing RSA key
[root@Mike-VM-Node-172_31_225_214 ~]# openssl req -new -key chao.key -out chao.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@Mike-VM-Node-172_31_225_214 ~]# openssl x509 -req -days 365 -in chao.csr -signkey chao.key -out chao.crt
Signature ok
subject=/C=XX/L=Default City/O=Default Company Ltd
Getting Private key
[root@Mike-VM-Node-172_31_225_214 ~]# 

第一步和第二步都需要输入一个自定义密码，然后三四步是替换有密码的证书操作

会得到四个配置文件其中 chao.crt 和 chao.key 两个证书配置到nginx上就可以

 

nginx安装详见 ：   https://www.cnblogs.com/mike666/p/13926545.html

nginx ssl证书配置

80和443端口都可以访问

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# cat test.conf 
server
    {
        listen 80;
        listen 443 ssl;
        ssl_certificate      ssl/chao.crt;
        ssl_certificate_key  ssl/chao.key;
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers  on;

        server_name test.com;
        index index.html index.php index.htm;
        root  /www/nginx/html;


        location ~* \.(eot|otf|ttf|woff|woff2|svg)$ {
          add_header Access-Control-Allow-Origin *;
        }

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ~ /.well-known {
            allow all;
        }

        location ~ /\.
        {
            deny all;
        }


    }

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# 

 

强制只有https协议访问配置

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# cat test.conf 
server {
    listen 80;
    server_name test.com;
    rewrite ^(.*)$ https://$host$1 permanent;
}

server
    {
        listen 443 ssl;
        ssl_certificate      ssl/chao.crt;
        ssl_certificate_key  ssl/chao.key;
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers  on;

        server_name test.com;
        index index.html index.php index.htm;
        root  /www/nginx/html;


    location ~* \.(eot|otf|ttf|woff|woff2|svg)$ {
    add_header Access-Control-Allow-Origin *;
    }

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ~ /.well-known {
            allow all;
        }

        location ~ /\.
        {
            deny all;
        }


    }

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# 

 

nginx 代理做CDN配置

nginx.conf配置

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf]# cat nginx.conf
user nginx nginx;
worker_processes auto;

error_log  logs/error.log ;
worker_rlimit_nofile 65535;
pid        logs/nginx.pid;

events {
    use epoll;
    worker_connections  65535;
}


http {
    include       mime.types;
    default_type  application/octet-stream;
    log_format upstream2 '$proxy_add_x_forwarded_for $remote_user [$time_local] "$request" $http_host'
        '$body_bytes_sent "$http_referer" "$http_user_agent" $ssl_protocol $ssl_cipher'
        '$request_time [$status] [$upstream_status] [$upstream_response_time] "$upstream_addr"';
   
   access_log  logs/access.log;
   
   server_names_hash_bucket_size 128;
   server_names_hash_max_size    1024;
   client_header_buffer_size 32k;
   large_client_header_buffers 4 32k;
   client_max_body_size 50m;

   sendfile        on;
   tcp_nopush      on;
   server_tokens   off;
   tcp_nodelay     on;
   keepalive_timeout        120;

   proxy_connect_timeout    1000s;
   proxy_read_timeout       2000;
   proxy_send_timeout       2000;
   proxy_buffer_size        128k;
   proxy_buffers            4 256k;
   proxy_busy_buffers_size  256k;
   proxy_redirect           off;
   proxy_hide_header        Vary;
   proxy_set_header         Accept-Encoding '';
   proxy_set_header         Host   $host;
   proxy_set_header         Referer $http_referer;
   proxy_set_header         X-Real-IP  $remote_addr;
   proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;


   fastcgi_connect_timeout 300;
   fastcgi_send_timeout 300;
   fastcgi_read_timeout 300;
   fastcgi_buffer_size 64k;
   fastcgi_buffers 4 64k;
   fastcgi_busy_buffers_size 128k;
   fastcgi_temp_file_write_size 128k;

   gzip on;
   gzip_buffers 16 8k;
   gzip_comp_level 6;
   gzip_http_version 1.1;
   gzip_min_length 256;
   gzip_proxied any;
   gzip_vary on;
   gzip_types
   text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
   text/javascript application/javascript application/x-javascript
   text/x-json application/json application/x-web-app-manifest+json
   text/css text/plain text/x-component
   font/opentype application/x-font-ttf application/vnd.ms-fontobject
   image/x-icon image/jpeg image/gif image/png;
   gzip_disable  "msie6";


   If you have a lot of static files to serve through Nginx then caching of the files' metadata (not the actual files' contents) can save some latency.
   open_file_cache max=1000 inactive=20s;
   open_file_cache_valid 30s;
   open_file_cache_min_uses 2;
   open_file_cache_errors on;



    server {
        listen   80;
        server_name  _;
        root /www/wwwtest;
        index index.html index.php index.jsp;

        location /status {
            stub_status on;
            auth_basic "WebServer Status";
        }

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|ico)$ {
            expires 30d;
        }

        location ~ .*\.(js|css)?$ {
            expires 7d;
        }

    }


##########################vhost#####################################
include  conf.d/*.conf;
}
[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf]# 

 

虚拟主机配置

https证书配置 

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# cat mike.com.conf
upstream mikessl {
    server 172.18.18.50:80 max_fails=3 fail_timeout=1s weight=1;
}

server {
    listen 80;
    server_name mike.com;
    access_log /data/logs/access.log upstream2;
    if ( $query_string ~* ".*[\;'\<\>].*" ){ return 404; }
    if ($scheme = 'http' ) { rewrite ^(.*)$ https://$host$1 permanent; }
}

server {
    listen 443;
    server_name mike.com;
    index index.html index.htm index.jsp index.php;
    access_log /data/logs/access.log upstream2;

    server_tokens off;
    keepalive_timeout   70;
    ssl on;
    ssl_certificate ssl/mike.com/crt.crt;
    ssl_certificate_key ssl/mike.com/mike.com.key;

    location / {
        proxy_pass http://mikessl;
    }
}
[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# 

其中 172.18.18.50 是后端代理核心ip，这样就可以隐藏真实源ip

不带https证书配置

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# cat ops.com.conf
upstream ops {
    server 172.18.18.51:80 max_fails=3 fail_timeout=1s weight=1;
}
server {
    listen     80;
    server_name  ops.com;
    #include    conf.d/ops;
    index index.html index.htm index.jsp index.php;
    access_log /data/logs/ops.log upstream2;

    server_tokens off;
    keepalive_timeout   70;

    if ( $query_string ~* ".*[\;'\<\>].*" ){ return 404; }

    location / {
        proxy_pass http://ops;
    }
}
[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# 

这是不带https的配置，如果域名多可以使用 include 配置到一个文件里写多个域名

 

nginx反向代理配置

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# vim abc.com.conf

server
    {
        listen 80;
        server_name abc.com;
        index index.html index.php index.htm default.html default.htm default.php;
        root  /www/wwwtest;


        location ~* \.(eot|otf|ttf|woff|woff2|svg)$ {
        add_header Access-Control-Allow-Origin *;
        }


        location /user {
                proxy_set_header Cookie $http_cookie;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_pass http://127.0.0.1:8080;
   
        }


        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ~ /.well-known {
            allow all;
        }

        location ~ /\.
        {
            deny all;
        }


    }

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]#

这里反向代理的意思是 访问 abc.com/user 域名就是访问  http://127.0.0.1:8080端口的内容

 

负载均衡

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]# vim test.conf
upstream aaa {
    server 172.18.18.60:80 max_fails=3 fail_timeout=1s weight=1;
    server 172.18.18.61:80 max_fails=3 fail_timeout=1s weight=1;
}

server
    {
        listen 80;
        server_name test.com;
        index index.html index.php index.htm;

  
        location / {
        proxy_set_header Cookie $http_cookie;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_pass http://aaa;
        }


    }

[root@Mike-VM-Node-172_31_225_214 /usr/local/nginx/conf/conf.d]#

上面的意思就是    访问 test.com 就是访问 172.18.18.60:80和172.18.18.61:80 里面的内容

 

本文分享完毕，感谢支持点赞~~