当前位置: 亚洲城ca88 > 亚洲城 > 正文

SSL配置笔记,Nginx反向代理

时间:2019-08-24 08:10来源:亚洲城
Spring Boot Nginx Tomcat SSL配置笔记 如果你的tomcat应用需要采用ssl来加强安全性,一种做法是把tomcat配置为支持ssl,另一种做法是用nginx反向代理tomcat,然后把nginx配置为https访问,并且ngin

Spring Boot Nginx Tomcat SSL配置笔记

如果你的tomcat应用需要采用ssl来加强安全性,一种做法是把tomcat配置为支持ssl,另一种做法是用nginx反向代理tomcat,然后把nginx配置为https访问,并且nginx与tomcat之间配置为普通的http协议即可。下面说的是后一种方法,同时假定我们基于spring-boot来开发应用。

一、配置nginx:

server {

    listen 80;

    listen 443 ssl;

    server_name localhost;

    ssl_certificate server.crt;

    ssl_certificate_key server.key;

    location / {

        proxy_pass ;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_set_header X-Forwarded-Port $server_port;

    }

}

这里有三点需要说明:

1、nginx允许一个server同时支持http和https两种协议。这里我们分别定义了http:80和https:443两个协议和端口号。如果你不需要http:80则可删除那行。

2、nginx收到请求后将通过http协议转发给tomcat。由于nginx和tomcat在同一台机里因此nginx和tomcat之间无需使用https协议。

3、由于对tomcat而言收到的是普通的http请求,因此当tomcat里的应用发生转向请求时将转向为http而非https,为此我们需要告诉tomcat已被https代理,方法是增加X-Forwared-Proto和X-Forwarded-Port两个HTTP头信息。

二、接着再配置tomcat。基于spring-boot开发时只需在application.properties中进行配置:

server.tomcat.remote_ip_header=x-forwarded-for

server.tomcat.protocol_header=x-forwarded-proto

server.tomcat.port-header=X-Forwarded-Port

server.use-forward-headers=true

该配置将指示tomcat从HTTP头信息中去获取协议信息(而非从HttpServletRequest中获取),同时,如果你的应用还用到了spring-security则也无需再配置。

此外,由于spring-boot足够自动化,你也可以把上面四行变为两行:

server.tomcat.protocol_header=x-forwarded-proto

server.use-forward-headers=true

下面这样写也可以:

server.tomcat.remote_ip_header=x-forwarded-for

server.use-forward-headers=true

 但不能只写一行:

server.use-forward-headers=true

具体请参见

server.tomcat.remote_ip_header=x-forwarded-for
server.tomcat.protocol_header=x-forwarded-proto
亚洲城,The presence of either of those properties will switch on the valve

 此外,虽然我们的tomcat被nginx反向代理了,但仍可访问到其8080端口。为此可在application.properties中增加一行:

server.address=127.0.0.1

这样一来其8080端口就只能被本机访问了,其它机器访问不到。

Spring Boot 的详细介绍:请点这里
Spring Boot 的下载地址:请点这里

本文永久更新链接地址:

Boot Nginx Tomcat SSL配置笔记 如果你的tomcat应用需要采用ssl来加强安全性,一种做法是把tomcat配置为支持ssl,另一种做法是用nginx反向代理...

背景:
A服务器(192.168.1.8)作为nginx代理服务器
B服务器(192.168.1.150)作为后端真实服务器

现在需要访问请求时从A服务器上反向代理到B服务器上

这就涉及到nginx反向代理https请求的配置了~~~


A服务器(192.168.1.8)上的操作流程:

1)编译安装nginx
[root@opd ~]# yum install -y pcre pcre-devel openssl openssl-devel gcc
[root@opd ~]# cd /usr/loca/src
[root@src ~]# wget
[root@src ~]# tar -zxvf nginx-1.8.0.tar.gz
[root@src ~]# cd nginx-1.8.0
#添加www用户,其中-M参数表示不添加用户家目录,-s参数表示指定shell类型

[root@nginx-1.8.0 ~]#useradd www -M -s /sbin/nologin
[root@nginx-1.8.0 ~]##vim auto/cc/gcc
#将这句注释掉 取消Debug编译模式 大概在179行
#CFLAGS="$CFLAGS -g"

#我们再配置下nginx编译参数,编译时一定要添加--with-http_ssl_module,以便让nginx支持ssl功能!
[root@nginx-1.8.0 ~]# ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_stub_status_module --with-http_ssl_module
[root@nginx-1.8.0 ~]#make
[root@nginx-1.8.0 ~]#make install clean

2)配置nginx
[root@nginx-1.8.0 ~]# cd /usr/local/nginx/conf
[root@nginx-1.8.0 conf]# vim nginx.conf

user  nobody;

worker_processes  8;

 

#error_log logs/error.log;

#error_log logs/error.log notice;

#error_log logs/error.log info;

 

events {

``worker_connections  65535;

}

 

http {

``include      mime.types;

``default_type  application``/octet-stream``;

``charset utf-8;

 

``log_format  main  ``'$http_x_forwarded_for $remote_addr $remote_user [$time_local] "$request" '

``'$status $body_bytes_sent "$http_referer" '

``'"$http_user_agent" "$http_cookie" $host $request_time'``;

``sendfile      on;

``tcp_nopush    on;

``tcp_nodelay    on;

``keepalive_timeout  65;

 

 

``fastcgi_connect_timeout 3000;

``fastcgi_send_timeout 3000;

``fastcgi_read_timeout 3000;

``fastcgi_buffer_size 256k;

``fastcgi_buffers 8 256k;

``fastcgi_busy_buffers_size 256k;

``fastcgi_temp_file_write_size 256k;

``fastcgi_intercept_errors on;

 

 

``client_header_timeout 600s;

``client_body_timeout 600s;

 

``client_max_body_size 100m;

``client_body_buffer_size 256k;  <br>

``## support more than 15 test environments<br>    server_names_hash_max_size 512;<br>    server_names_hash_bucket_size 128;<br>

``gzip  on;

``gzip_min_length  1k;

``gzip_buffers    4 16k;

``gzip_http_version 1.1;

``gzip_comp_level 9;

``gzip_types      text``/plain application``/x-javascript text``/css application``/xml text``/javascript application``/x-httpd-php``;

``gzip_vary on;

 

 

``include vhosts/*.conf;

}

[root@nginx-1.8.0 conf]# ulimit -n 65535
[root@nginx-1.8.0 conf]# mkdir vhosts


接下来手动配置ssl证书
如果自己手动颁发证书的话,那么https是不被浏览器认可的,就是https上面会有一个大红叉
****************************************************
推荐一个免费的网站:
startssl的操作教程看这个:
****************************************************

下面是手动颁发证书的操作:
[root@linux-node1 ~]# cd /usr/local/nginx/conf/
[root@linux-node1 conf]# mkdir ssl
[root@linux-node1 conf]# cd ssl/
[root@linux-node1 ssl]# openssl genrsa -des3 -out aoshiwei.com.key 1024
Generating RSA private key, 1024 bit long modulus
................................
....................................
e is 65537 (0x10001)
Enter pass phrase for aoshiwei.com.key:                    #提示输入密码,比如这里我输入123456
Verifying - Enter pass phrase for aoshiwei.com.key:     #确认密码,继续输入123456

[root@linux-node1 ssl]# ls                                       #查看,已生成CSR(Certificate Signing Request)文件
aoshiwei.com.key

[root@linux-node1 ssl]# openssl req -new -key aoshiwei.com.key -out aoshiwei.com.csr
Enter pass phrase for aoshiwei.com.key:                      #输入123456
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,

If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:cn                                                         #国家
State or Province Name (full name) []:beijing                                               #省份
Locality Name (eg, city) [Default City]:beijing                                               #地区名字
Organization Name (eg, company) [Default Company Ltd]:huanqiu                 #公司名
Organizational Unit Name (eg, section) []:Technology                                     #部门
Common Name (eg, your name or your server's hostname) []:huanqiu            #CA主机名
Email Address []:wangshibo@xqshijie.cn                                                      #邮箱

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456                                                                   #证书请求密钥,CA读取证书的时候需要输入密码
An optional company name []:huanqiu                                                          #-公司名称,CA读取证书的时候需要输入名称

[root@linux-node1 ssl]# ls
aoshiwei.com.csr aoshiwei.com.key

[root@linux-node1 ssl]# cp aoshiwei.com.key aoshiwei.com.key.bak
[root@linux-node1 ssl]# openssl rsa -in aoshiwei.com.key.bak -out aoshiwei.com.key
Enter pass phrase for aoshiwei.com.key.bak:                            #输入123456
writing RSA key
[root@linux-node1 ssl]# openssl x509 -req -days 365 -in aoshiwei.com.csr -signkey aoshiwei.com.key -out aoshiwei.com.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=huanqiu/OU=Technology/CN=huanqiu/emailAddress=wangshibo@xqshijie.cn
Getting Private key
[root@linux-node1 ssl]# ll
total 24
-rw-r--r-- 1 root root 960 Sep 12 16:01 aoshiwei.com.crt
-rw-r--r-- 1 root root 769 Sep 12 15:59 aoshiwei.com.csr
-rw-r--r-- 1 root root 887 Sep 12 16:01 aoshiwei.com.key
-rw-r--r-- 1 root root 963 Sep 12 16:01 aoshiwei.com.key.bak

然后配置nginx的反向代理:
[root@linux-node1 vhosts]# pwd
/usr/local/nginx/conf/vhosts
[root@linux-node1 vhosts]# cat test.xqshijie.com-ssl.conf
upstream 8090 {
    server 192.168.1.150:8090 max_fails=3 fail_timeout=30s;; 
}

server {
   listen 443;
   server_name testwww.huanqiu.com;
   ssl on;

   ### SSL log files ###
   access_log logs/ssl-access.log;
   error_log logs/ssl-error.log;

### SSL cert files ###
   ssl_certificate ssl/aoshiwei.com.crt;      #由于这个证书是自己手动颁发的,是不受信任的,访问时会有个“大叉”提示,但是不影响访问
   ssl_certificate_key ssl/aoshiwei.com.key;   #如果是线上环境,可以购买被信任后的证书,拷贝过来使用。
   ssl_session_timeout 5m;

   location / {
   proxy_pass ;                                      #这个一定要是https
   proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
   proxy_set_header Host $host;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto https;
   proxy_redirect off;
}
}

重启nginx
[root@linux-node1 ssl]# /usr/local/nginx/sbin/nginx -t
[root@linux-node1 ssl]# /usr/local/nginx/sbin/nginx -s reload

[root@linux-node1 ssl]# lsof -i:443
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 15755 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)
nginx 15756 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)
nginx 15757 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)
nginx 15758 nobody 24u IPv4 4717921 0t0 TCP *:https (LISTEN)

A服务器要开启防火墙了,则需要在iptables里开通443端口的访问
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

[root@linux-node1 ssl]# /etc/init.d/iptables restart


后端真是服务器(192.168.1.150)上的nginx配置

[root@dev-new-test1 vhosts]# cat test.xqshijie.com-ssl.conf
server {
   listen 8090;                                                                    #这里后端服务器的https没有采用默认的443端口

   server_name testwww.huanqiu.com;
   root /var/www/vhosts/test.huanqiu.com/httpdocs/main/;

   ssl on;
   ssl_certificate /Data/app/nginx/certificates/xqshijie.cer;          #这是后端服务器上的证书,这个是购买的被信任的证书,可以把它的证书拷贝给上面的代理机器使用
   ssl_certificate_key /Data/app/nginx/certificates/xqshijie.key;   #可以将这两个证书拷给上面192.168.1.8的/usr/loca/nginx/conf/ssl下使用,修改nginx代理配置部分的证书路径即可!

   ssl_session_timeout 5m;

   ssl_protocols SSLv2 SSLv3 TLSv1;
   ssl_ciphers HIGH:!aNULL:!MD5;
   ssl_prefer_server_ciphers on;

   access_log /var/www/vhosts/test.huanqiu.com/logs/clickstream_ssl.log main;

location / {
   try_files $uri $uri/ @router;
   index index.php;
}

   error_page 500 502 503 504 /50x.html;

location @router {
   rewrite ^.*$ /index.php last;
}

location ~ .php$ {
  fastcgi_pass 127.0.0.1:9001;
  fastcgi_read_timeout 300;
  fastcgi_index index.php;
  fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
  #include fastcgi_params;
  include fastcgi.conf;
  fastcgi_param HTTPS on;        #这个一定要加上,否则访问https时会出现报错:The plain HTTP request was sent to HTTPS port
}
} ##end server

[root@dev-new-test1 vhosts]# lsof -i:8090
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 24373 root 170u IPv4 849747 0t0 TCP *:8090 (LISTEN)
nginx 25897 nobody 170u IPv4 849747 0t0 TCP *:8090 (LISTEN)
nginx 25898 nobody 170u IPv4 849747 0t0 TCP *:8090 (LISTEN)

最后在浏览器里访问

****************************************************************************************
下面顺便附上一个测试的nginx代理配置(http和https)

[root@linux-node1 vhosts]# cat testhuanqiu.com
upstream 8802 {
   server 192.168.1.150:8802 max_fails=3 fail_timeout=30s;
}
upstream 8803 {
   server 192.168.1.150:8803 max_fails=3 fail_timeout=30s;
}
upstream 8804 {
   server 192.168.1.150:8804 max_fails=3 fail_timeout=30s;
}
upstream 8805 {
  server 192.168.1.150:8805 max_fails=3 fail_timeout=30s;
}

server {
  listen 80;
  server_name test10erp.fangfull.com;
location / {
  proxy_store off;
  proxy_redirect off;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $http_host;
  proxy_pass ;
}
}

server {
  listen 80;
  server_name test10www.fangfull.com;
location / {
  proxy_store off;
  proxy_redirect off;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $http_host;
  proxy_pass ;
}
}

server {
  listen 443;
  server_name test10fanghu.xqshijie.com;
  ssl on;

### SSL cert files ###
  ssl_certificate ssl/xqshijie.cer;
  ssl_certificate_key ssl/xqshijie.key;
  ssl_session_timeout 5m;

location / {
  proxy_pass ;
  proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto https;
  proxy_redirect off;
}
}

server {
  listen 443;
  server_name test10www.xqshijie.com;
  ssl on;

### SSL cert files ###
  ssl_certificate ssl/xqshijie.cer;
  ssl_certificate_key ssl/xqshijie.key;
  ssl_session_timeout 5m;

location / {
  proxy_pass ;
  proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto https;
  proxy_redirect off;
}
}

本文永久更新链接地址:http://www.linuxidc.com/Linux/2017-02/140400.htm

亚洲城 1

编辑:亚洲城 本文来源:SSL配置笔记,Nginx反向代理

关键词: 亚洲城ca88