https://blog.csdn.net/w2456/article/details/53943080/

1. Preparations

 Domain name one
 Free certificate (recommended: Tencent cloud, Alibaba cloud and cheap ssl are free configurations, and then download the certificate first)
 One Centos server
 nginx 1.10.2

• 1
• 2
• 3
• 4
• 5

2. Install nginx

  Installation tutorial http://www.runoob.com/linux/nginx-install-setup.html
  Pay attention to compiling -- with stream -- with stream  SSL  module when installing
  If you start nginx, see the figure below for troubleshooting

• 1
• 2
• 3
• 4

3. Configure nginx to implement ssl reverse proxy

  Select the downloaded certificate according to your own server. Here, select nginx certificate
  Mainly use server.crt and server.key two certificates to upload to the server
  Here we upload it directly to conf in nginx directory

• 1
• 2
• 3
• 4

 
Modify nginx.conf (if there is any comment, just change the other ones and keep them as they are)
"`

#user  nobody;
worker_processes  1;
#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;
#pid        logs/nginx.pid;
events {
    worker_connections  1024;
}
http {
    include       mime.types;
    default_type  application/octet-stream;
    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    # '$status $body_bytes_sent "$http_referer" '
    # '"$http_user_agent" "$http_x_forwarded_for"';
    #access_log  logs/access.log  main;
    sendfile        on;
    #tcp_nopush     on;
    #keepalive_timeout  0;
    keepalive_timeout  65;
    #gzip  on;
    server {
        listen       8090; #Change the original port 80 to 8090 
        server_name  xxx.xxx.xxx; #Just write your own domain name here
        #charset koi8-r;
        #access_log  logs/host.access.log  main;
        location / {
            root   html;
            index  index.html index.htm;
        }
        #error_page  404              /404.html;
        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ .php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on           127.0.0.1:9000
        #
        #location ~ .php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /.ht {
        #    deny  all;
        #}
    }
    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}
    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}
    include /usr/nginx/conf/wss.conf;# Here we will introduce a new file of reverse agent
    client_max_body_size    3m;# Upload size unit M wechat applet may need to set when uploading large pictures
}

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58
• 59
• 60
• 61
• 62
• 63
• 64
• 65
• 66
• 67
• 68
• 69
• 70
• 71
• 72
• 73
• 74
• 75
• 76
• 77
• 78
• 79
• 80
• 81
• 82
• 83
• 84
• 85
• 86
• 87
• 88
• 89
• 90
• 91
• 92
• 93
• 94
• 95
• 96

New wss.conf

#Mainly configure the original ws and http interfaces
upstream websocket {
    server 10.5.11.xxx:8283;# Remote websocket server address
}
upstream web{
    server www.xxx.com;# Remote http interface
}
# Through the reverse proxy below to the interface above
server {
    listen 443;#Default https and wss protocol ports
    ssl on;
    ssl_certificate /usr/nginx/conf/server.crt;#Your certificate location uploaded to the server
    ssl_certificate_key /usr/nginx/conf/server.key;#Your certificate location uploaded to the server
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_protocols SSLv3 SSLv2 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
    underscores_in_headers on;#Enable underline of custom header information
    #Links to be accessed in the wss protocol forwarding applet
    location /wss {
        proxy_pass http://websocket; proxy to the above address
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
    }
    #Link to be visited in https protocol forwarding applet
    location /{
    proxy_pass http://web; proxy to the original http address
    proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    add_header Access-Control-Allow-Origin *;#Cross domain access settings
    }
}

```

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36

Copyright notice: This is the original article of the blogger. It can't be reproduced without the permission of the blogger. https://blog.csdn.net/w2456/article/details/53943080