Nginx之常用基本配置（三）

[root@test ~]# cd /etc/pki/CA/
[root@test CA]# tree
.
├── certs
├── crl
├── newcerts
└── private4 directories, 0 files
[root@test CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...+++
...................+++
e is 65537 (0x10001)
[root@test CA]# tree
.
├── certs
├── crl
├── newcerts
└── private
└── cakey.pem4 directories, 1 file
[root@test CA]#

[root@test CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SICHUAN
Locality Name (eg, city) [Default City]:GUANGYUAN
Organization Name (eg, company) [Default Company Ltd]:TEST
Organizational Unit Name (eg, section) []:DEVOPS
Common Name (eg, your name or your server's hostname) []:ca.ilinux.io
Email Address []:
[root@test CA]# touch index.txt
[root@test CA]# echo 01 >serial
[root@test CA]# tree
.
├── cacert.pem
├── certs
├── crl
├── index.txt
├── newcerts
├── private
│   └── cakey.pem
└── serial4 directories, 4 files
[root@test CA]#

[root@www ~]# mkdir /etc/nginx/ssl
[root@www ~]# cd /etc/nginx/ssl
[root@www ssl]# ls
[root@www ssl]# (umask 077;openssl genrsa -out nginx.key 2048)
Generating RSA private key, 2048 bit long modulus
.........................................+++
.......+++
e is 65537 (0x10001)
[root@www ssl]# ll
total 4
-rw------- 1 root root 1679 Mar 2 23:06 nginx.key
[root@www ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SICHUAN
Locality Name (eg, city) [Default City]:GUANGYUAN
Organization Name (eg, company) [Default Company Ltd]:TEST
Organizational Unit Name (eg, section) []:DEVOPS
Common Name (eg, your name or your server's hostname) []:www.ilinux.io
Email Address []:Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@www ssl]# ll
total 8
-rw-r--r-- 1 root root 1009 Mar 2 23:07 nginx.csr
-rw------- 1 root root 1679 Mar 2 23:06 nginx.key
[root@www ssl]#

[root@www ssl]# scp -P 41319 nginx.csr qiuhom@192.168.0.99:/tmp/
qiuhom@192.168.0.99's password:
nginx.csr 100% 1009 225.4KB/s 00:00
[root@www ssl]#

[root@test CA]# openssl ca -in /tmp/nginx.csr -out certs/nginx.pem -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Mar 2 15:11:02 2020 GMT
Not After : Mar 2 15:11:02 2021 GMT
Subject:
countryName = CN
stateOrProvinceName = SICHUAN
organizationName = TEST
organizationalUnitName = DEVOPS
commonName = www.ilinux.io
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
F7:76:62:31:04:D8:CE:0E:6E:CD:C5:14:05:EF:7F:E4:A5:AD:A0:91
X509v3 Authority Key Identifier:
keyid:D5:61:A5:2F:BF:67:51:78:D7:5D:F8:51:F4:3C:FB:22:F9:E5:A7:3BCertificate is to be certified until Mar 2 15:11:02 2021 GMT (365 days)
Sign the certificate? [y/n]:y1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@test CA]# tree
.
├── cacert.pem
├── certs
│   └── nginx.pem
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│   └── 01.pem
├── private
│   └── cakey.pem
├── serial
└── serial.old4 directories, 9 files
[root@test CA]#

[root@test CA]# scp certs/nginx.pem 192.168.0.30:/etc/nginx/ssl/
The authenticity of host '192.168.0.30 (192.168.0.30)' can't be established.
ECDSA key fingerprint is SHA256:EG9nua4JJuUeofheXlgQeL9hX5H53JynOqf2vf53mII.
ECDSA key fingerprint is MD5:57:83:e6:46:2c:4b:bb:33:13:56:17:f7:fd:76:71:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.30' (ECDSA) to the list of known hosts.
root@192.168.0.30's password:
nginx.pem 100% 4464 2.1MB/s 00:00
[root@test CA]#

[root@www conf.d]# cat login.conf
server {
listen 443 ssl;
server_name 192.168.0.30;
root /data/web/html;
gzip on;
gzip_types text/xml text/plain;
gzip_disable Firefox;
location /basic_status {
stub_status;
auth_basic "please input you username and passwd login";
auth_basic_user_file /etc/nginx/conf.d/.ngxpasswd;
}
ssl_certificate "/etc/nginx/ssl/nginx.pem";
ssl_certificate_key "/etc/nginx/ssl/nginx.key";
ssl_protocols sslv2 sslv3 tlsv1 tlsv1.1 tlsv1.2;
ssl_session_cache shared:SSL:10m;}
[root@www conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@www conf.d]# nginx -s reload
[root@www conf.d]#

rewrite /(.*)$ https://www.ilinux.io/basic_status;

rewrite /(.*)\.jpg /test/ redirect;

if ($http_user_agent ~ MSIE) {
rewrite ^(.*)$ /msie/$1 break;
}if ($http_cookie ~* "id=([^;]+)(?:;|$)") {
set $id $1;
}if ($request_method = POST) {
return 405;
}if ($slow) {
limit_rate 10k;
}if ($invalid_referer) {
return 403;
}