释放双眼，带上耳机，听听看~！
1、获取证书
在阿里云等网站上点击购买ssl证书，选择免费型DV SSL证书，一般有效期为一年，只能绑定一个域名。
购买完成后需要绑定域名，几分钟后就会显示“已签发” 。点击下载证书，根据需要下载tomcat或nginx等证书。
下载的证书中有2个文件： xxxx.pem 和xxxx.key
3、nginx安装
安装参考： https://blog.csdn.net/u013792404/article/details/93863306
nginx使用的版本是：nginx-1.16.1.tar.gz
先将域名解析到服务器IP ， 然后在服务器上安装nginx
4、配置nginx.conf
将证书 xxxx.pem 和xxxx.key 复制到 nginx/conf/下面 （即和nginx.conf同一目录）
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
2worker_processes 1;
3
4#error_log logs/error.log;
5#error_log logs/error.log notice;
6#error_log logs/error.log info;
7
8#pid logs/nginx.pid;
9
10
11events {
12 worker_connections 1024;
13}
14
15
16http {
17 include mime.types;
18 default_type application/octet-stream;
19
20 #log_format main '$remote_addr - $remote_user [$time_local] "$request" '
21 # '$status $body_bytes_sent "$http_referer" '
22 # '"$http_user_agent" "$http_x_forwarded_for"';
23
24 #access_log logs/access.log main;
25
26 sendfile on;
27 #tcp_nopush on;
28
29 #keepalive_timeout 0;
30 keepalive_timeout 65;
31
32 upstream server1 {
33 # 根据实际情况指到具体内网或外网IP
34 server 192.168.8.101:8080 ;
35 }
36
37 #gzip on;
38
39 # HTTPS server
40 server {
41 listen 443 ssl ;
42 server_name www.xxx.com;
43
44 ssl_certificate xxxx.pem;
45 ssl_certificate_key xxxx.key;
46
47 ssl_session_cache shared:SSL:1m;
48 ssl_session_timeout 5m;
49 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES25;
50 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
51 ssl_prefer_server_ciphers on;
52
53 location / {
54 proxy_pass http://server1;
55 # root html;
56 # index index.html index.htm;
57 }
58 }
59
60
61 server {
62 listen 80;
63 server_name www.xxx.com;
64 # 把http的域名请求转成https
65 rewrite ^(.*)$ https://$host$1 permanent;
66
67 #charset koi8-r;
68
69 #access_log logs/host.access.log main;
70
71 #location / {
72 # root html;
73 # index index.html index.htm;
74 #}
75 }
76
77 # another virtual host using mix of IP-, name-, and port-based configuration
78 #
79 #server {
80 # listen 8000;
81 # listen somename:8080;
82 # server_name somename alias another.alias;
83
84 # location / {
85 # root html;
86 # index index.html index.htm;
87 # }
88 #}
89
90
91 # HTTPS server
92 #
93 #server {
94 # listen 443 ssl;
95 # server_name localhost;
96
97 # ssl_certificate cert.pem;
98 # ssl_certificate_key cert.key;
99
100 # ssl_session_cache shared:SSL:1m;
101 # ssl_session_timeout 5m;
102
103 # ssl_ciphers HIGH:!aNULL:!MD5;
104 # ssl_prefer_server_ciphers on;
105
106 # location / {
107 # root html;
108 # index index.html index.htm;
109 # }
110 #}
111
112}
113
检查nginx.conf是否有语法错误： /usr/local/nginx/sbin/nginx -t
语法错误没问题就可以启动nginx了， /usr/local/nginx/sbin/nginx (重启 /usr/local/nginx/sbin/nginx -s reload)
测试访问正常，
5、踩坑点
网上很多配置方法都是 listen 443 ; 导致访问一致有问题， 最后查看nginx.conf默认配置，后面多了一个ssl （listen 443 ssl ; ）， 加上正常访问了， 可能是nginx版本影响的原因 ， 因此在上面把默认配置也贴出来了
server {
listen 443 **ssl ** ;
…..}
