-
[root@rhel6u3-7 ~]# cd /etc/pki/tls/certs/
-
[root@rhel6u3-7 certs]# make server.key //生成私钥
-
umask 77 ; \
-
/usr/bin/openssl genrsa -aes128 2048 > server.key
-
Generating RSA private key, 2048 bit long modulus
-
..........+++
-
.....................................+++
-
e is 65537 (0x10001)
-
Enter pass phrase:
-
Verifying - Enter pass phrase:
-
[root@rhel6u3-7 certs]# openssl rsa -in server.key -out server.key //除去密码以便询问时不需要密码
-
Enter pass phrase for server.key:
-
writing RSA key
-
[root@rhel6u3-7 certs]# make server.csr //生成证书颁发机构,用于颁发公钥
-
umask 77 ; \
-
/usr/bin/openssl req -utf8 -new -key server.key -out server.csr
-
You are about to be asked to enter information that will be incorporated
-
into your certificate request.
-
What you are about to enter is what is called a Distinguished Name or a DN.
-
There are quite a few fields but you can leave some blank
-
For some fields there will be a default value,
-
If you enter '.', the field will be left blank.
-
-----
-
Country Name (2 letter code) [XX]:cn
-
State or Province Name (full name) []:sh
-
Locality Name (eg, city) [Default City]:sh
-
Organization Name (eg, company) [Default Company Ltd]:rsyslog
-
Organizational Unit Name (eg, section) []:rsyslog
-
Common Name (eg, your name or your server's hostname) []:xiaonuo
-
Email Address []:unix.root@hotmail.com
-
Please enter the following 'extra' attributes
-
to be sent with your certificate request
-
A challenge password []:123.com
-
An optional company name []:it
-
[root@rhel6u3-7 certs]# openssl x509 -in server.csr -req -signkey server.key -days 365 -out server.crt //颁发公钥，不过由于我们并不是去CA证书中心申请的公钥，所以在使用的时候，客户端浏览器会跳出未受信任的警告。如果你在生产环境下，请去CA申请。
-
Signature ok
-
subject=/C=cn/ST=sh/L=sh/O=rsyslog/OU=rsyslog/CN=xiaonuo/emailAddress=unix.root@hotmail.com
-
Getting Private key
-
[root@rhel6u3-7 certs]#
-
[root@rhel6u3-7 certs]# vim /usr/local/nginx/conf/nginx.conf
-
include /usr/local/nginx/server/www2.rsyslog.org; //将虚拟主机单独设置，然后用include包含到主配置文件中，简化主配置文件的配置
-
[root@rhel6u3-7 certs]# vim /usr/local/nginx/server/www2.rsyslog.org //注意以下配置可以在主配置文件中复制ssl模块信息
-
server {
-
listen 443; 监听端口为443
-
server_name www2.rsyslog.org;
-
-
ssl on; //开启ssl
-
ssl_certificate /etc/pki/tls/certs/server.crt; //证书位置
-
ssl_certificate_key /etc/pki/tls/certs/server.key; //私钥位置
-
ssl_session_timeout 5m;
-
ssl_protocols SSLv2 SSLv3 TLSv1; //指定密码为openssl支持的格式
-
ssl_ciphers HIGH:!aNULL:!MD5; //密码加密方式
-
ssl_prefer_server_ciphers on; //依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码
-
-
location / {
-
root sites/www2; //www2.rsyslog.org根目录的相对位置
-
index index.html index.htm;
-
}
-
}
