适用性天然情况：
Ubuntu 11.04
PCRE 8.31
Openssl 2.0.2
Nginx 1.2.5
为的是包管能在 nginx中选用法式语言展开更乖巧的适用性，加拆以后需要确认控造系统与否加拆有 PCRE（Perl Compatible Regular Expressions）包。能到ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ 阅读新一代的 PCRE 源代码包，选用下面指示阅读校对和加拆 PCRE 包：
# wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.31.tar.bz2 # tar jxvf pcre-8.31.tar.bz2 # cd pcre-8.31 # ./configure –enable-utf8 # make # make installopenssl为开放源码应用软件，在Linux（或UNIX/Cygwin）下成立两个单纯的CA。他们能借助那个CA展开PKI、公钥有关的试验。好比说，在试验用Tomcat或Apache修建HTTPS双向合格证书时，他们能借助本身成立的试验CA来为伺服器端颁授伺服器公钥，为应用流程（应用流程）聚合文档体例的公钥（能同时借助openssl聚合应用流程公钥），加拆体例和下面类似于。
下面重点项目说说nginx的加拆体例：
阅读新一代平衡版1.2.5，选用指示：
# tar zxvf nginx-1.2.5.tar.gz # cd nginx-1.2.5 # ./configure --prefix=/usr --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/nginx.lock --user=www-nginx --group=www --with-http_ssl_module --with-http_stub_status_module --with-http_flv_module --with-http_gzip_static_module --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy/ --http-fastcgi-temp-path=/var/tmp/nginx/fcgi/ # 单纯加拆 ./configure --prefix=/opt/nginx --with-http_stub_status_module --with-http_ssl_module # make # make install出格留意：在选用"--prefix"等适用性项时，后面是两横"--"，而不是"-"，那儿有些昌明显然没出格留意到，哎呀我晕了一会。
--with-http_stub_status_module 是为的是投入利用 nginx 的 NginxStatus 机能，用以监视 nginx 的现阶段情况。
--with-http_ssl_module 投入利用http_ssl组件
--with-ipv6 全力撑持ipv6加拆获得胜利后 /opt/nginx 产物目次下有五个子产物目次依次是：conf、html、logs、sbin 。此中 nginx 的适用性文档放置于 conf/nginx.conf，nginx 只要两个流程文档坐落于 sbin 产物目次下。包管控造系统的 80 路由器没被其他流程挤占，运转 sbin/./nginx 指示来开启 Nginx，关上应用流程出访此电脑的 IP，假设应用流程再次呈现 Welcome to nginx! 则暗示 nginx 已经加拆并运转获得胜利。
注：该处选用sbin/./nginx指示开启原因在于我那儿假设用网路上说的sbin/nginx开启否则，显然开启没法，并且会再次呈现加拆nginx的提醒信息，很怪！
选用openssl造做合格证书：
1、伺服器双向校正
成立并进入sslkey放置产物目次
# mkdir /opt/nginx/sslkey
# cd /opt/nginx/sslkey
①、聚合RSA密钥：
# openssl genrsa -out key.pem 2048
②、聚合两个合格证书恳求
# openssl req -new -key key.pem -out cert.csr
# //会提醒信息输入省份、城市、域名信息等，重要的是，email 必然如果你的域名后缀的你能拿着那个文档去公钥颁授机构（即CA）申请两个公钥。CA会给你两个新的文档cacert.pem，那才是你的公钥。
假设是本身做试验，就能用下面那个指示来聚合合格证书：
# openssl req -new -x509 -nodes -out server.crt -keyout server.key
③、修改 nginx 适用性
# HTTPS server # server { listen 443; server_name localhost; ssl on; ssl_certificate /opt/nginx/sslkey/server.crt; ssl_certificate_key /opt/nginx/sslkey/server.key; ssl_session_timeout 5m; ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl_prefer_server_ciphers on; location / { root /home/workspace/; index index.asp index.aspx; } }适用性好后，重启nginx，选用 https关上彀站，应用流程会提醒信息合格证书错误，点击继续阅读即可。
2、伺服器-应用流程双向校正
在nginx 产物目次下成立ca文档夹，进入ca。
# mkdir newcerts private conf server。
此中newcerts子产物目次将放置CA签订（颁授）过的公钥（合格证书备份产物目次）。而private产物目次用于放置CA的公钥。产物目次conf只是用于放置一些简化参数
用的适用性文档，server放置伺服器合格证书文档。
①、在conf产物目次成立文档openssl.conf适用性文档，内容如下：
[ ca ] default_ca = foo # The default ca section [ foo ] dir = /opt/nginx/ca # top dir database = /opt/nginx/ca/index.txt # index file. new_certs_dir = /opt/nginx/ca/newcerts # new certs dir certificate = /opt/nginx/ca/private/ca.crt # The CA cert serial = /opt/nginx/ca/serial # serial no file private_key = /opt/nginx/ca/private/ca.key # CA private key RANDFILE =/opt/nginx/ca/private/.rand # random number file default_days = 365 # how long to certify for default_crl_days= 30 # how long before next CRL default_md = md5 # message digest method to use unique_subject = no # Set to no to allow creation of # several ctificates with same subject. policy = policy_any # default policy [ policy_any ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = match localityName = optional commonName = supplied emailAddress = optional注：你也能间接修改openssl的适用性文档，如许否则后面造做合格证书的代码中就不消引用那个适用性文档了。
②、选用脚本成立合格证书
下面的几个脚本都放在/nginx/ca/产物目次下。
成立两个新的CA根合格证书。
new_ca.sh:
#!/bin/sh # Generate the key. openssl genrsa -out private/ca.key # Generate a certificate request. openssl req -new -key private/ca.key -out private/ca.csr # Self signing key is bad... this could work with a third party signed key... registeryfly has them on for $16 but Im too cheap lazy to get one on a lark. # Im also not 100% sure if any old certificate will work or if you have to buy a special one that you can sign with. I could investigate further but since this # service will never see the light of an unencrypted Internet see the cheap and lazy remark. # So self sign our root key. openssl x509 -req -days 365 -in private/ca.csr -signkey private/ca.key -out private/ca.crt # Setup the first serial number for our keys... can be any 4 digit hex string... not sure if there are broader bounds but everything Ive seen uses 4 digits. echo FACE > serial # Create the CAs key database. touch index.txt # Create a Certificate Revocation list for removing user certificates. openssl ca -gencrl -out /opt/nginx/ca/private/ca.crl -crldays 7 -config "/opt/nginx/ca/conf/openssl.conf"施行 sh new_ca.sh聚合新的CA合格证书。
聚合伺服器合格证书的脚本。
new_server.sh:
# Create us a key. Dont bother putting a password on it since you will need it to start apache. If you have a better work around Id love to hear it. openssl genrsa -out server/server.key # Take our key and create a Certificate Signing Request for it. openssl req -new -key server/server.key -out server/server.csr # Sign this bastard key with our bastard CA key. openssl ca -in server/server.csr -cert private/ca.crt -keyfile private/ca.key -out server/server.crt -config "/opt/nginx/ca/conf/openssl.conf"施行 sh new_server.sh聚合新伺服器的合格证书
适用性 nginx的ssl全力撑持：
#user www-nginx; worker_processes 1; #error_log logs/error.log; #error_log logs/error.log notice; #error_log logs/error.log info; #pid logs/nginx.pid; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; #gzip on; # HTTPS server # server { listen 443; server_name localhost; ssi on; ssi_silent_errors on; ssi_types text/shtml; ssl on; ssl_certificate /opt/nginx/ca/server/server.crt; ssl_certificate_key /opt/nginx/ca/server/server.key; ssl_client_certificate /opt/nginx/ca/private/ca.crt; ssl_session_timeout 5m; ssl_verify_client on; #开户应用流程合格证书校正 ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl_prefer_server_ciphers on; location / { root /home/workspace/; index index.asp index.aspx; } } }开启nginx ,期待客户毗连，假设此时毗连伺服器，将提醒信息400 Bad request certification的错误，故还需要聚合应用流程合格证书。
new_user.sh:
#!/bin/sh # The base of where our SSL stuff lives. base="/opt/nginx/ca" # Were we would like to store keys... in this case we take the username given to us and store everything there. mkdir -p $base/users/ # Lets create us a key for this user... yeah not sure why people want to use DES3 but at least lets make us a nice big key. openssl genrsa -des3 -out $base/users/client.key 1024 # Create a Certificate Signing Request for said key. openssl req -new -key $base/users/client.key -out $base/users/client.csr # Sign the key with our CAs key and cert and create the users certificate out of it. openssl ca -in $base/users/client.csr -cert $base/private/ca.crt -keyfile $base/private/ca.key -out $base/users/client.crt -config "/opt/nginx/ca/conf/openssl.conf" # This is the tricky bit... convert the certificate into a form that most browsers will understand PKCS12 to be specific. # The export password is the password used for the browser to extract the bits it needs and insert the key into the users keychain. # Take the same precaution with the export password that would take with any other password based authentication scheme. openssl pkcs12 -export -clcerts -in $base/users/client.crt -inkey $base/users/client.key -out $base/users/client.p12施行 shnew_user.sh聚合两个 client合格证书。
根据提醒信息一步一步来，那儿要出格留意的是客户合格证书的几个项目要和根合格证书婚配。
也就是后面适用性的:
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = match
纷歧致否则无法聚合最初的客户合格证书，合格证书聚合后，应用流程导入合格证书应用流程，即可关上彀站。出格留意事项：
1、造做合格证书时会提醒信息输入密码，伺服器合格证书和应用流程合格证书密码能不不异。
2、伺服器合格证书和应用流程合格证书造做时提醒信息输入省份、城市、域名信息等，需连结一致。
3、Nginx默认未开启SSI，下面适用性已开启。
4、Nginx不克不及自开启，需要如下适用性：
cd /etc/init.d sudo touch nginx sudo chmod +x nginxnginx内容：
#! /bin/sh # ### BEGIN INIT INFO # Provides: nginx # Required-Start: $syslog $local_fs $remote_fs # Required-Stop: $syslog $local_fs $remote_fs # Should-Start: dbus avahi # Should-Stop: dbus avahi # Default-Start: 2 3 4 5 # Default-Stop: 1 # Short-Description: Nginx Server # Description: Nginx ### END INIT INFO PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/nginx/sbin DAEMON=/opt/nginx/sbin/nginx NAME=nginx DESC="Nginx Server" PID_FILE=/opt/nginx/logs/nginx.pid test -x $DAEMON || exit 0 RUN=yes #RUN_AS_USER=root #DAEMON_OPTS="-a $RUN_AS_USER" set -e case "$1" in start) echo -n "Starting $DESC: " start-stop-daemon --start --quiet --pidfile $PID_FILE \ --exec $DAEMON echo "$NAME." ;; stop) echo -n "Stopping $DESC: " start-stop-daemon --stop --oknodo --quiet --pidfile $PID_FILE \ --exec $DAEMON echo "$NAME." ;; force-reload) # check whether $DAEMON is running. If so, restart start-stop-daemon --stop --test --quiet --pidfile \ $PID_FILE --exec $DAEMON \ && $0 restart \ || exit 0 ;; restart) echo -n "Restarting $DESC: " start-stop-daemon --stop --oknodo --quiet --pidfile \ $PID_FILE --exec $DAEMON sleep 1 start-stop-daemon --start --quiet --pidfile \ $PID_FILE --exec $DAEMON echo "$NAME." ;; status) if [ -s $PID_FILE ]; then RUNNING=$(cat $PID_FILE) if [ -d /proc/$RUNNING ]; then if [ $(readlink /proc/$RUNNING/exe) = $DAEMON ]; then echo "$NAME is running." exit 0 fi fi # No such PID, or executables dont match echo "$NAME is not running, but pidfile existed." rm $PID_FILE exit 1 else rm -f $PID_FILE echo "$NAME not running." exit 1 fi ;; *) N=/etc/init.d/$NAME echo "Usage: $N {start|stop|restart|force-reload}" >&2 exit 1 ;; esac exit 0设置自开启：
sudo chkconfig --list nginx sudo chkconfig nginx on