为 Nginx 设置自签名的 SSL

本文简单演示如何为 Nginx 配置自签名证书，启用 HTTPS。

安装 Nginx

1	docker run -it -p 80:80 -p 443:443 --name nginx-alpine-ssl alpine /bin/sh

1 2	echo http://mirrors.ustc.edu.cn/alpine/v3.8/main > /etc/apk/repositories echo http://mirrors.ustc.edu.cn/alpine/v3.8/community >> /etc/apk/repositories

1	apk update

1	apk add nginx

1	mkdir /run/nginx/

nginx

1	curl http://localhost

1	vi /etc/nginx/conf.d/default.conf

编辑

1	root /var/www/localhost/htdocs;

保存以后执行

1	nginx -s reload

1	echo "<h1>Hello world!</h1>" > /var/www/localhost/htdocs/index.html;

1	curl http://localhost

生成自签名证书

安装 openssl

1	apk add openssl

1	openssl req -x509 -nodes -days 365 -subj "/C=CA/ST=QC/O=Company, Inc./CN=mydomain.com" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt

输出:

Generating a RSA private key
......................................+++++
.................................................................................................................+++++
writing new private key to '/etc/ssl/private/nginx-selfsigned.key'
-----

为 Nginx 配置 SSL

编辑 default.conf

1	vi /etc/nginx/conf.d/default.conf

 listen 443 ssl http2 default_server;
 listen [::]:443 ssl http2 default_server;
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

验证:

nginx -t

重新加载配置

1	nginx -s reload

1	curl https://localhost

1	curl https://localhost --insecure