nginx configuring https access


HTTP (HyperText Transfer Protocol) is an application layer protocol for distributed, collaborative and hypermedia information systems. In short, it is a method of publishing and receiving HTML pages, which is used to transfer information between Web browsers and Web servers.

HTTPS (Hypertext Transfer Protocol Secure) is a transmission protocol for secure communication through computer network. HTTPS communicates through HTTP, but uses SSL/TLS to encrypt data packets. The main purpose of HTTPS development is to provide identity authentication to website server and protect the privacy and integrity of exchange data.

The HTTP protocol sends content in clear text without any data encryption. If an attacker intercepts the transmission message between the Web browser and the website server, he can directly read the information. Therefore, the HTTP protocol is not suitable for transmitting some sensitive information, such as credit card number, password and other payment information.

02. https usage scenario

1: Security of website data transmission

2: Based on the front-end and back-end separation development methods, such as wechat applets, and other mobile application development, for example, your server interface must be https. Wechat applets are published in real projects. If they are not https interfaces, you can't pass.

03. https configuration premise

1. You must have a registered domain name
2. Have a server (including public IP)
3. Server and domain name resolution
4. Get ssl security certificate
5. Certificate Authorization and installation into nginx

04. Domain name resolution

Before this step, you need to successfully file information in the Ministry of industry and information technology. Note: the filing address depends on your server manufacturer. You can go to the company where the server is purchased for filing. Please consult the customer service for details. The customer service will explain you clearly.

Note: if your domain name manufacturer is not the same as the server manufacturer, you need to modify the dns server address of the domain name manufacturer (depending on the situation) as follows:

05. Apply for ssl certificate

Search for SSL in the search bar

Apply for a free certificate and enter the domain name

Create certificate

Download certificate

Unzip certificate

06. Installing nginx

1. Create installation directory

mkdir -p /www/server/nginx
cd /www/server/nginx

2. Download and install nginx


3. Install compiled files

yum -y install make zlib zlib-devel gcc-c++ libtool openssl openssl-devel

4. Unzip nginx

tar -zxvf nginx-1.20.1.tar.gz

5. Create temporary directory

mkdir -p /var/temp/nginx

6. Enter the installation package path and compile the installation

cd nginx-1.20.1
./configure \
--prefix=/usr/local/nginx \
--pid-path=/var/run/ \
--lock-path=/var/lock/nginx.lock \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--with-http_gzip_static_module \
--http-client-body-temp-path=/var/temp/nginx/client \
--http-proxy-temp-path=/var/temp/nginx/proxy \
--http-fastcgi-temp-path=/var/temp/nginx/fastgi \
--http-uwsgi-temp-path=/var/temp/nginx/uwsgi \
--http-scgi-temp-path=/var/temp/nginx/scgi \
--with-http_stub_status_module \
--with-http_ssl_module \

7. Compile and install

make && make install

8. Enter sbin directory and start nginx

cd /usr/local/nginx/sbin
#Execution start
#stop it:
./nginx -s stop
./nginx -s reload 

9. Configure nginx environment variables

vim /etc/profile

Add at the end

export NGINX_HOME=/usr/local/nginx
export PATH=$NGINX_HOME/sbin:$PATH


source /etc/profile

If you install nginx for the pagoda, you do not need to follow the above steps, but it is not recommended to use the pagoda installation

07. Upload ssl certificate

Create a new cert directory under the conf directory of nginx, and upload the two files to the cert directory

08. Configure ssl

# Turn on gzip compression
gzip on;
gzip_min_length 10k;
gzip_buffers 4 16k;
#gzip_http_version 1.0;
gzip_comp_level 2;
gzip_types text/plain application/x-javascript text/css application/xml text/javascript image/jpeg image/gif image/png image/jpg;
gzip_vary off;
gzip_disable "MSIE [1-6]\.";

# tomcat service
upstream tomcatservers {

server {
    listen 80;
    server_name; #You need to add yourdomain COM is replaced by the domain name bound by the certificate.
    rewrite ^(.*)$ https://$host$1; # Redirect all HTTP requests to HTTPS through the rewrite instruction.
    location / {
        proxy_pass http://tomcatservers;

#Among the following attributes, attributes starting with ssl are related to certificate configuration.
server {
    listen 443 ssl;
    #The default access port configured for HTTPS is 443.
    #If the default access port of HTTPS is not configured here, Nginx may not start.
    #If you use nginx 1.15 0 and above, please use listen 443 ssl instead of listen 443 and ssl on.
    server_name; #You need to add yourdomain COM is replaced by the domain name bound by the certificate.
    root html;
    index index.html index.htm;
    ssl_certificate cert/;  #You need to set cert file name Replace PEM with the name of the uploaded certificate file.
    ssl_certificate_key cert/; #You need to set cert file name Key is replaced by the name of the uploaded certificate key file.
    ssl_session_timeout 5m;
    #Indicates the type of encryption suite used.
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #Indicates the type of TLS protocol used.
    ssl_prefer_server_ciphers on;
    location / {
        proxy_pass http://tomcatservers;

Restart nginx service

Note: if nginx is installed in the pagoda, port 443 needs to be released on the pagoda panel. After https is configured on the website, the resources of http service cannot be loaded through js.

Keywords: Nginx http https

Added by tomm098 on Mon, 27 Dec 2021 21:03:22 +0200