2017-08-24 增加 Nginx HTTPS 配置

zhangchaohuang@banggood.com · zhangchaohuang@banggood.com · commit c9303d83836c · 2017-08-24T17:22:27.000+08:00
diff --git a/Nginx-Install-And-Settings.md b/Nginx-Install-And-Settings.md
@@ -72,6 +72,7 @@
     --http-proxy-temp-path=/var/temp/nginx/proxy \
     --http-fastcgi-temp-path=/var/temp/nginx/fastcgi \
     --http-uwsgi-temp-path=/var/temp/nginx/uwsgi \
+    --with-http_ssl_module \
     --http-scgi-temp-path=/var/temp/nginx/scgi
     ```
 
@@ -433,6 +434,60 @@ http {
 }
 ```
 
+### 配置 HTTPS 服务（SSL 证书配置）
+
+- 免费申请 SSL 证书渠道
+	- 教程：<https://www.wn789.com/4394.html> 
+	- SSL For Free：<https://www.sslforfree.com>
+- 一般你会下载下面两个文件：`certificate.crt`，`private.key`
+- 如果你需要把 crt 和 key 的证书转换成 keystore（如果你有这个需求的话）
+- 从 key 和 crt 生成 pkcs12 格式的 keystore，生成过程会让人你输入密码，这个密码下面会用到，我这里假设输入 123456
+	- `openssl pkcs12 -export -in certificate.crt -inkey private.key -out youmeek.p12 -name youmeek -CAfile certificate.crt -caname -chain`
+	- `keytool -importkeystore -v -srckeystore youmeek.p12 -srcstoretype pkcs12 -srcstorepass 123456 -destkeystore youmeek.keystore -deststoretype jks -deststorepass 123456`  
+- 修改 nginx 配置文件，增加对 HTTPS 支持（下面的配置是基于默认安装 nginx 后的配置）
+- `vim /usr/local/nginx/conf/nginx.conf`
+
+
+```
+worker_processes  1;
+events {
+    worker_connections  1024;
+}
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+    
+    # 如果访问 http 也直接跳转到 https
+    server {
+        listen       80;
+        server_name sso.youmeek.com;
+        return 301 https://$server_name$request_uri;
+    }
+    
+    # crt 和 key 文件的存放位置根据你自己存放位置进行修改
+    server {
+        listen       443;
+        server_name  sso.youmeek.com;
+        ssl  on;
+        ssl_certificate     /opt/ssl/certificate.crt;
+        ssl_certificate_key /opt/ssl/private.key;
+        location / {
+            root   html;
+            index  index.html index.htm;
+        }
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   html;
+        }
+    }
+}
+
+```
+
+
+
 ### HTTP 服务，绑定多个域名
 
 - <https://www.ttlsa.com/nginx/use-nginx-proxy/>
diff --git a/favorite-file/shell/install_nginx.sh b/favorite-file/shell/install_nginx.sh
@@ -1,27 +1,65 @@
 #!/bin/sh
 
+
 echo "安装 nginx"
+echo "判断常见的文件夹是否存在"
+
+if [ ! -d "/opt/setups" ]; then
+	mkdir /opt/setups
+fi
+
+if [ ! -d "/usr/program" ]; then
+	mkdir /usr/program
+fi
+
+if [ ! -d "/usr/local/nginx" ]; then
+	mkdir -p /usr/local/nginx
+fi
+
+if [ ! -d "/var/log/nginx" ]; then
+	mkdir -p /var/log/nginx
+fi
+
+if [ ! -d "/var/temp/nginx" ]; then
+	mkdir -p /var/temp/nginx
+fi
+
+if [ ! -d "/var/lock/nginx" ]; then
+	mkdir -p /var/lock/nginx
+fi
+
+echo "下载 Nginx"
 
 cd /opt/setups
+wget http://nginx.org/download/nginx-1.12.1.tar.gz
 
-yum install -y gcc gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel
+if [ ! -f "/opt/setups/nginx-1.12.1.tar.gz" ]; then
+	echo "Nginx 下载失败，结束脚本"
+	exit 1
+fi
 
-mkdir -p /usr/local/nginx /var/log/nginx /var/temp/nginx /var/lock/nginx
+echo "Nginx 下载成功，开始解压 Nginx"
+tar -zxf nginx-1.12.1.tar.gz
 
-tar zxvf nginx-1.10.2.tar.gz
+if [ ! -d "/opt/setups/nginx-1.12.1" ]; then
+	echo "Nginx 解压失败，结束脚本"
+	exit 1
+fi
 
-cd nginx-1.10.2/
+echo "安装源码安装依赖"
+yum install -y gcc gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel
 
-./configure --prefix=/usr/local/nginx --pid-path=/var/local/nginx/nginx.pid --lock-path=/var/lock/nginx/nginx.lock --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --with-http_gzip_static_module --http-client-body-temp-path=/var/temp/nginx/client --http-proxy-temp-path=/var/temp/nginx/proxy --http-fastcgi-temp-path=/var/temp/nginx/fastcgi --http-uwsgi-temp-path=/var/temp/nginx/uwsgi --http-scgi-temp-path=/var/temp/nginx/scgi 
+echo "开始安装 Nginx"
+cd nginx-1.12.1/
 
+./configure --prefix=/usr/local/nginx --pid-path=/var/local/nginx/nginx.pid --lock-path=/var/lock/nginx/nginx.lock --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --with-http_gzip_static_module --http-client-body-temp-path=/var/temp/nginx/client --http-proxy-temp-path=/var/temp/nginx/proxy --http-fastcgi-temp-path=/var/temp/nginx/fastcgi --http-uwsgi-temp-path=/var/temp/nginx/uwsgi --with-http_ssl_module --http-scgi-temp-path=/var/temp/nginx/scgi
 make
-
 make install
 
+echo "防火墙放行 80 端口"
 iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-
 service iptables save
-
 service iptables restart
 
-echo "完成安装 nginx，把端口加到防火墙中"
+echo "启动 Nginx"
+/usr/local/nginx/sbin/nginx
