创立openssl所需的配置文件localhost.conf
[ req ]default_bits = 2048 # RSA的2048是公认较比拟平安的key长度default_keyfile = server-key.pemdistinguished_name = subjectreq_extensions = req_extx509_extensions = x509_extstring_mask = utf8only[ subject ]countryName = Country Name (2 letter code)countryName_default = USstateOrProvinceName = State or Province Name (full name)stateOrProvinceName_default = NYlocalityName = Locality Name (eg, city)localityName_default = New YorkorganizationName = Organization Name (eg, company)organizationName_default = Example, LLCcommonName = Common Name (e.g. server FQDN or YOUR name)commonName_default = Example CompanyemailAddress = Email AddressemailAddress_default = test@example.com[ x509_ext ]subjectKeyIdentifier = hashauthorityKeyIdentifier = keyid,issuerbasicConstraints = CA:FALSEkeyUsage = digitalSignature, keyEnciphermentsubjectAltName = @alternate_namesnsComment = "OpenSSL Generated Certificate"[ req_ext ]subjectKeyIdentifier = hashbasicConstraints = CA:FALSEkeyUsage = digitalSignature, keyEnciphermentsubjectAltName = @alternate_namesnsComment = "OpenSSL Generated Certificate"[ alternate_names ]DNS.1 = 192.168.XXX.XXX # 留神这里个别改为本人本地的ip或者域名
- 生成证书
localhost.crt
,localhost.key
openssl 运行命令./openssl.exe req -config localhost.conf -new -sha256 -newkey rsa:2048 -nodes -keyout localhost.key -x509 -days 365 -out localhost.crt
- 拷贝证书到
nginx-1.18.0\conf\ssl
目录(新建ssl)下 配置nginx
nginx.conf减少server配置项server { listen 443 ssl; # 不变 # ssl_certificate ssl/localhost.crt; # ssl_certificate_key ssl/localhost.key; ssl_certificate ssl/192.168.56.26.crt; # 指向证书地址,ps:相对路径是绝对与nginx.conf目录 ssl_certificate_key ssl/192.168.56.26.key; # 指向证书地址,ps:相对路径是绝对与nginx.conf目录 location /p { alias E:/p; index index.html index.htm; } }
- ./nginx.exe -t 验证config是否ok,./nginx.exe -s reload 重启