nginx 配置https和对应的证书申请

本地环境配置https

1、openssl生成自签名证书

创建服务器私钥，命令会让你输入一个口令

openssl genrsa -out server.key 1024

根据私钥生成证书申请,创建签名请求的证书（CSR）

openssl req -new -key server.key -out server.csr

下面的选项至少写一个，才可以生成证书成功

Country Name (2 letter code) []:ch
State or Province Name (full name) []:
Locality Name (eg, city) []:
Organization Name (eg, company) []:
Organizational Unit Name (eg, section) []:
Common Name (eg, fully qualified host name) []:
Email Address []:

在加载SSL支持的Nginx并使用上述私钥时除去必须的口令：

$ cp server.key server.key.org

$ openssl rsa -in server.key.org -out server.key

最后标记证书使用上述私钥和CSR

openssl x509 -req -in server.csr -out server.crt -signkey server.key -days 3650

nginx加入对应的配置

server {
    listen 80;
    server_name api.quexs.com;
	rewrite (.*) https://api.quexs.com$1 permanent;
	root /www/quexsApi/public;
    charset utf-8;

    location / {
	   rewrite (.*) https://api.quexs.com$1 permanent;
       index index.php;
    }

    location ~ \.php$ {
        fastcgi_pass php56:9000;
        include        fastcgi-php.conf;
        include fastcgi_params;
    }
    access_log /var/log/nginx/quexsApi.access.log;
    error_log /var/log/nginx/quexsApi.error.log;
}

server {
    listen         443 ssl default ssl http2;
    server_name    api.quexs.com;#域名
	root /www/quexsApi/public;
	#ssl on;
    ssl_certificate      /ssl/quexsApi.crt;#证书路径(必要)
    ssl_certificate_key  /ssl/quexsApi.key;#key路径(必要)

    location / {
        index  index.php index.html;
        try_files $uri $uri/ $uri/index.php;
    }

    if (!-e $request_filename) {
        rewrite ^/(.*)$ /index.php last;
    }
    
    location ~ \.php$ {
        fastcgi_pass php56:9000;
        include        fastcgi-php.conf;
        include fastcgi_params;
    }

    access_log /var/log/nginx/quexsApi.access.log;
    error_log /var/log/nginx/quexsApi.error.log;
}