前期准备 {#前期准备}

验证Nginx SSL模块是否支持 {#验证Nginx-SSL模块是否支持}

|-----------|----------------------------------------| | 1 | /usr/local/nginx/sbin/nginx -V |

上面命令执行后提示以下信息：

|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 | nginx version: nginx/1.22.1 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --with-http_stub_status_module --with-http_ssl_module |

如果提示内容中包含--with-http_ssl_module则表示已经支持SSL模块。

SSL 证书部署 {#SSL-证书部署}

首先要从阿里云或者腾讯云上为域名申请一个SSL证书，然后将证书文件和证书密钥文件下载到本地，然后解压上传至服务器。

将证书文件xxx.com.key和xxx.com_bundle.pem两个文件上传保存到目录：/usr/local/nginx/conf

修改nginx配置文件 {#修改nginx配置文件}

编辑 /usr/local/nginx/conf/nginx.conf 配置文件

|------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | # HTTPS server # server { listen 443 ssl; server_name zsyyblog.com; ssl_certificate zsyyblog.com_bundle.crt; ssl_certificate_key zsyyblog.com.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; ssl_prefer_server_ciphers on; location / { root /home/zsyyblog; index index.html index.htm; } } |