证书的获取略
服务器的端口443确保外界网络能够进行访问。
是否配置https：
nginx：是
tomcat：否
1.首先查看nginx是否支持SSL。
参考链接： 实战http切换成https
查看nginx支持SSL
[root@ytkj bin]# /usr/local/nginx/sbin/nginx -Vnginx version: nginx/1.13.3built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) built with OpenSSL 1.0.2k-fips ?26 Jan 2017TLS SNI support enabledconfigure arguments: --with-http_ssl_module[root@ytkj bin]#
看到有--with-http_ssl_module。说明支持SSL。
此处我遇到了第一个坑：
按照我上面的参考链接增加了SSL模块的小伙伴们注意了。在执行命令
[root@ytkj bin]# /usr/local/nginx/sbin/nginx -s reload
重启后，可能SSL模块并不会生效。而是要通过重启nginx主线程来重新加载配置。
[root@ytkj nginx-1.13.3]# ps -ef | grep nginxroot ?????8802 10800 ?0 10:23 ? ???????00:00:00 nginx: worker process is shutting downroot ?????8803 10800 ?0 10:23 ? ???????00:00:00 nginx: worker process is shutting downroot ?????9992 ?4681 ?0 14:45 pts/0 ???00:00:00 grep --color=auto nginxroot ????10800 ????1 ?0 6月29 ? ??????00:00:00 nginx: master process /usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf[root@ytkj nginx-1.13.3]# kill -QUIT 10800[root@ytkj nginx-1.13.3]# /usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
2.nginx的配置
server { ???????listen ??????443 ssl; ???????server_name ?uhear.com.cn; ???????ssl on; ???????????ssl_certificate ?????cert/yourCA.pem; ????#当前conf/目录下 ???????ssl_certificate_key ?cert/yourCA.key; ???????ssl_session_cache ???shared:SSL:10m; ???????ssl_session_timeout ?5m; ???????#ssl_server_tokens off; ???????ssl_ciphers ?ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ???????ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ???????ssl_prefer_server_ciphers ?on; ???????location / { ???????????proxy_pass http://127.0.0.1:8080; #映射到本地的8080端口。 ???????????proxy_redirect off; ???????????proxy_set_header Host $http_host; ???????????proxy_set_header X-Real-IP $remote_addr; ???????????proxy_set_header X-Forwarded-Proto https; ???????????proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; ???????} ???????location /webSocket/ {
#webSocket在https下的配置 ???????????proxy_pass http://127.0.0.1:8080; ???????????proxy_http_version 1.1; ???????????proxy_set_header Host $http_host; ???????????proxy_set_header X-Real-IP $remote_addr; ???????????proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#主要是通过下方的两个属性来升级该请求，告诉服务器，我这个是webSocket请求。 ???????????proxy_set_header Upgrade $http_upgrade; ???????????proxy_set_header Connection "Upgrade"; ???????} ???}nginx proxy_set_header设置、自定义header
关于nginx代理中请求头的一些设置的具体原因和原理
在这个配置中，我遇到的坑是listen 433 ssl；和 ssl on;
有的是只写listen 433；即可。这是由于nginx 版本的原因。最开始我也没写，但是一直不能访问，添加后，一切正常。
光是有这个是不够的，同时还要对我们的服务器进行配置。既Tomcat.
3.tomcat的配置
<Connector port="8080" protocol="HTTP/1.1" ??????????????connectionTimeout="20000" ??????????????redirectPort="8443" />变成<Connector port="8080" protocol="HTTP/1.1" ??????????????connectionTimeout="20000" ??????????????redirectPort="443" ??????????????proxyPort="443" />
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" ??????????????prefix="localhost_access_log" suffix=".txt" ??????????????pattern="%h %l %u %t "%r" %s %b" />上面的value是tomcat自带的，下面的使我们要添加的 ???????<Valve className="org.apache.catalina.valves.RemoteIpValve" ???????????????????remoteIpHeader="x-forwarded-for" ????????????????????remoteIpProxiesHeader="x-forwarded-by" ????????????????????protocolHeader="x-forwarded-proto" />
Linux下 nginx+tomcat配置https的总结和遇到的坑
原文地址：https://www.cnblogs.com/wbq1113/p/9357332.html