nginx proxy https
server {
listen 443;
server_name mail.jb51.net;
ssl on;
ssl_certificate server.crt;
ssl_certificate_key server.key;
location / {
proxy_pass https://192.168.0.2:443;
proxy_set_header Host $host:443;
proxy_set_header X-Real-IP
$remote_addr;
proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
proxy_set_header Via "nginx";
}
}
其中192.168.0.2是你的https主机
如果后端https没有证书的话,可以如此简化:
代码如下:
listen 80;
server_name
svn.jb51.net;
location / {
proxy_pass https://192.168.0.2:443;
proxy_set_header Host $host:443;
proxy_set_header X-Real-IP
$remote_addr;
proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
proxy_set_header Via "nginx";
proxy_set_header X-Forwarded-Proto https; #注意看这里 多了一行
}
}
如果提示“SSL 接收到一个超出最大准许长度的记录。” 错误代码“ssl_error_rx_record_too_long”说明少了“ssl
on;”这一行
说明:
1.nginx 1.2.0 centos 6.2
2.这里所指的反向代理https是指nginx为ssl服务器,nginx与后端服务器的通信还是http,当然可能也可以实现nginx与后端服务器实现https通信,不过本文没有测试
步骤:
nginx要实现ssl,在编译时要添加--with-http_ssl_module,如:
./configure --with-http_ssl_module
#cd /usr/local/nginx/conf
#mkdir ssl
#cd ssl
生成一个私有key
# openssl genrsa -des3 -out aoshiwei.com.key 1024
提示输入密码
生成CSR(Certificate Signing Request)文件:
# openssl req -new -key aoshiwei.com.key -out aoshiwei.com.csr
填写证书内容,组织机构、域名等,Common Name填写域名
# cp aoshiwei.com.key aoshiwei.com.key.bak
# openssl rsa -in aoshiwei.com.key.bak -out aoshiwei.com.key
# openssl x509 -req -days 365 -in aoshiwei.com.csr -signkey aoshiwei.com.key -out aoshiwei.com.crt
在nginx.conf中添加:
- server {
- ### server port and name ###
- listen 443 ssl;
- server_name member.aoshiwei.com;
- ssl on;
- ### SSL log files ###
- access_log logs/ssl-access.log;
- error_log logs/ssl-error.log;
- ### SSL cert files ###
- ssl_certificate ssl/aoshiwei.com.crt;
- ssl_certificate_key ssl/aoshiwei.com.key;
- ### Add SSL specific settings here ###
- keepalive_timeout 60;
- ### Limiting Ciphers ########################
- # Uncomment as per your setup
- #ssl_ciphers HIGH:!ADH;
- #ssl_perfer_server_ciphers on;
- #ssl_protocols SSLv3;
- ##############################################
- ### We want full access to SSL via backend ###
- location / {
- proxy_pass http://member.aoshiwei.com;
- ### force timeouts if one of backend is died ##
- proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
- ### Set headers ####
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- ### Most PHP, Python, Rails, Java App can use this header ###
- proxy_set_header X-Forwarded-Proto https;
- ### By default we don't want to redirect it ####
- proxy_redirect off;
- }
- }
最新文章
- 编译安装 varnish-4.1.2和yum 安装 varnish-4.0.3
- AspNetPager分页控件的使用
- 浅谈php生成静态页面
- 必须使用";角色管理工具";安装或配置microsoft.net framework 3.5
- javascript在调试bug的奇淫技巧(Chrome, Firebug, Filddle 调试)
- mysql远程连接:ERROR 1130 (HY000): Host '*.*.*.*' is not allowed to connect to this MySQL server解决办法
- 链表中倒数第k个结点
- [转]10分钟入门python
- hdu 3518 Boring counting 后缀数组LCP
- python--判断数据类型可不可变
- javascript读取本地文件
- winform中获取Properties窗口的值.
- Mpmovieplayercontroller 黑屏
- JavaService实现Windows服务
- 浅析 SpringMVC 原理和配置.
- tomcat集群实现源码级别剖析
- 论文笔记:Improving Deep Visual Representation for Person Re-identification by Global and Local Image-language Association
- BSGS-Junior·大步小步算法
- Centos7解决中文乱码问题
- 一些常用的排序算法(C版)