当前位置: 首页 > news >正文

使用 OpenSSL 创建自签名证书

mkdir -p /etc/nginx/conf.d/cert
#2、创建私钥
openssl genrsa -des3 -out https.key 1024
提示输入字符:
输入字符:rancher
[root@ocean-app-1a-01 cert]# openssl genrsa -des3 -out https.key 1024
Generating RSA private key, 1024 bit long modulus
…++++++
…++++++
e is 65537 (0x10001)
Enter pass phrase for https.key:
139880595519376:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:831:You must type in 4 to 1023 characters
Enter pass phrase for https.key:
Verifying - Enter pass phrase for https.key:
#3、创建签名请求证书
openssl req -new -key https.key -out https.csr

[root@ocean-app-1a-01 cert]# openssl req -new -key https.key -out https.csr
Enter pass phrase for https.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.

Country Name (2 letter code) [XX]:rancher
string is too long, it needs to be less than 2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server’s hostname) []:
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:rancher
An optional company name []:
#4、在加载SSL支持的Nginx并使用上述私钥时除去必须的口令
$ cp https.key https.key.org
$ openssl rsa -in https.key.org -out https.key

输入 rancher

[root@ocean-app-1a-01 cert]# openssl rsa -in https.key.org -out https.key

输入 rancher

Enter pass phrase for https.key.org:
writing RSA key

#5、最后标记证书使用上述私钥和CSR和有效期
openssl x509 -req -days 365 -in https.csr -signkey https.key -out https.crt
[root@ocean-app-1a-01 cert]# openssl x509 -req -days 365 -in https.csr -signkey https.key -out https.crt
Signature ok
subject=/C=CN/ST=BJ/L=beijing/O=Default Company Ltd
Getting Private key
#6、nginx添加配置如下:

示例

server {
listen 443 ssl; #监听443端口
server_name linking-rancher.di.bigdata;
ssl_certificate /etc/nginx/conf.d/cert/https.crt;
ssl_certificate_key /etc/nginx/conf.d/cert/https.key;
ssl_session_timeout 5m;
#charset koi8-r;
#access_log /var/log/nginx/host.access.log main;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Accept-Encoding ‘gzip’;

    ##配置使wss协议生效proxy_http_version 1.1;    proxy_set_header Upgrade $http_upgrade;proxy_set_header Connection "upgrade";client_max_body_size 2G;proxy_pass https://rancher;
}
#error_page  404              /404.html;
# redirect server error pages to the static page /50x.html
#
error_page   500 502 503 504  /50x.html;
location = /50x.html {root   /usr/share/nginx/html;
}

}

实际配置

server {
listen 443 ssl;
server_name linking-rancher.di.bigdata;
ssl_certificate /etc/nginx/conf.d/cert/https.crt;
ssl_certificate_key /etc/nginx/conf.d/cert/https.key;
ssl_session_timeout 5m;
location / {
proxy_pass https://rancher;
proxy_redirect off;
##配置使wss协议生效
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection “upgrade”;

    #下面的参数取决环境需要#后端的Web服务器可以通过X-Forwarded-For获取用户真实IPproxy_set_header           Host $host;proxy_set_header           X-Real-IP $remote_addr;proxy_set_header           X-Forwarded-For $proxy_add_x_forwarded_for;client_max_body_size       2G; #允许客户端请求的最大单文件字节数client_body_buffer_size    512k; #缓冲区代理缓冲用户端请求的最大字节数proxy_connect_timeout      300; #nginx跟后端服务器连接超时时间(代理连接超时)proxy_send_timeout         300; #后端服务器数据回传时间(代理发送超时)proxy_read_timeout         300; #连接成功后,后端服务器响应时间(代理接收超时)proxy_buffer_size          4k; #设置代理服务器(nginx)保存用户头信息的缓冲区大小proxy_buffers              4 32k; #proxy_buffers缓冲区,网页平均在32k以下的话,这样设置proxy_busy_buffers_size    64k; #高负荷下缓冲大小(proxy_buffers*2)proxy_temp_file_write_size 64k; #设定缓存文件夹大小fastcgi_buffer_size 128k;fastcgi_buffers 8 128k;fastcgi_busy_buffers_size 128k;fastcgi_temp_file_write_size 128k;
}   
location = /50x.html {root   /usr/share/nginx/html;
}

}

8443 是自动部署rancher 暴露的端口 https协议

upstream rancher{
server 10.0.0.24:8443;
server 10.0.0.24:8080;
}

http://www.lryc.cn/news/431501.html

相关文章:

  • EmguCV学习笔记 VB.Net 9.1 VideoCapture类
  • Rspack 1.0 发布了!
  • 【全网最全】2024年数学建模国赛E题超详细保奖思路+可视化图表+成品论文+matlab/python代码等(后续会更新
  • 数智转型,看JNPF如何成为企业的必备工具
  • ArcGIS Pro 发布松散型切片
  • 奖项再+1!通义灵码智能编码助手通过可信 AI 智能编码工具评估,获当前最高等级
  • 如何使用 yum 在 CentOS 6 上安装 nginx
  • F12抓包05:Network接口测试(抓包篡改请求)
  • OPenCV结构分析与形状描述符(4)计算一个旋转矩形的四个顶点的函数boxPoints()的使用
  • 【Matplotlib】利用Python进行绘图!(python数据分析与可视化)
  • 第二百二十节 JPA教程 - JPA 实体管理器删除示例
  • [⁠TypeError⁠]‍ {message: “Cannot read property ‘‘ of undefined“}
  • NIFI汉化_替换logo_二次开发_Idea编译NIFI最新源码_详细过程记录_全解析_Maven编译NIFI避坑指南001
  • 项目在运行时,浏览器控制台出现 Uncaught ReferenceError: globalThis is not defined
  • 图中点的层次
  • ansible+awx搭建
  • linux环境下安装配置go环境
  • 可交互、会学习、自成长机器人——李德毅院士
  • Redis发布订阅PUB/SUB
  • Scratch教师节 —— 感恩教师节
  • 【60天备战软考高级系统架构设计师——第五天:需求分析方法与工具】
  • 【Hot100算法刷题集】哈希-01-两数之和(暴力枚举再优化,也不是哈希表的对手)
  • 基于.NET6的WPF基础总结(上)
  • Nuxt3入门:资源文件(第2节)
  • 企业微信中嵌套的h5应用调用微信扫码功能
  • Excel如何把表格变成图表
  • HTTP 三、http在springboot中得应用
  • Java秋招面经(网搜版)
  • 【Android】Material Design编写更好的UI
  • 剪辑视频,这四大工具助你一臂之力!