Nginx之常用基本配置（三）

[root@test ~]# cd /etc/pki/CA/
[root@test CA]# tree
.
├── certs
├── crl
├── newcerts
└── private

4 directories, 0 files
[root@test CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...+++
...................+++
e is 65537 (0x10001)
[root@test CA]# tree
.
├── certs
├── crl
├── newcerts
└── private
    └── cakey.pem

4 directories, 1 file
[root@test CA]#

[root@test CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SICHUAN
Locality Name (eg, city) [Default City]:GUANGYUAN
Organization Name (eg, company) [Default Company Ltd]:TEST
Organizational Unit Name (eg, section) []:DEVOPS
Common Name (eg, your name or your server's hostname) []:ca.ilinux.io
Email Address []:
[root@test CA]# touch index.txt
[root@test CA]# echo 01 >serial
[root@test CA]# tree
.
├── cacert.pem
├── certs
├── crl
├── index.txt
├── newcerts
├── private
│   └── cakey.pem
└── serial

4 directories, 4 files
[root@test CA]# 

[root@www ~]# mkdir /etc/nginx/ssl
[root@www ~]# cd /etc/nginx/ssl
[root@www ssl]# ls
[root@www ssl]# (umask 077;openssl genrsa -out nginx.key 2048)
Generating RSA private key, 2048 bit long modulus
.........................................+++
.......+++
e is 65537 (0x10001)
[root@www ssl]# ll
total 4
-rw------- 1 root root 1679 Mar  2 23:06 nginx.key
[root@www ssl]# openssl req -new -key nginx.key -out nginx.csr 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SICHUAN
Locality Name (eg, city) [Default City]:GUANGYUAN
Organization Name (eg, company) [Default Company Ltd]:TEST
Organizational Unit Name (eg, section) []:DEVOPS
Common Name (eg, your name or your server's hostname) []:www.ilinux.io
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@www ssl]# ll
total 8
-rw-r--r-- 1 root root 1009 Mar  2 23:07 nginx.csr
-rw------- 1 root root 1679 Mar  2 23:06 nginx.key
[root@www ssl]#

[root@www ssl]# scp -P 41319 nginx.csr qiuhom@192.168.0.99:/tmp/
qiuhom@192.168.0.99's password: 
nginx.csr                                                     100% 1009   225.4KB/s   00:00    
[root@www ssl]# 

[root@test CA]# openssl ca -in /tmp/nginx.csr -out certs/nginx.pem -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Mar  2 15:11:02 2020 GMT
            Not After : Mar  2 15:11:02 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = SICHUAN
            organizationName          = TEST
            organizationalUnitName    = DEVOPS
            commonName                = www.ilinux.io
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                F7:76:62:31:04:D8:CE:0E:6E:CD:C5:14:05:EF:7F:E4:A5:AD:A0:91
            X509v3 Authority Key Identifier: 
                keyid:D5:61:A5:2F:BF:67:51:78:D7:5D:F8:51:F4:3C:FB:22:F9:E5:A7:3B

Certificate is to be certified until Mar  2 15:11:02 2021 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@test CA]# tree
.
├── cacert.pem
├── certs
│   └── nginx.pem
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│   └── 01.pem
├── private
│   └── cakey.pem
├── serial
└── serial.old

4 directories, 9 files
[root@test CA]# 

[root@test CA]# scp certs/nginx.pem 192.168.0.30:/etc/nginx/ssl/
The authenticity of host '192.168.0.30 (192.168.0.30)' can't be established.
ECDSA key fingerprint is SHA256:EG9nua4JJuUeofheXlgQeL9hX5H53JynOqf2vf53mII.
ECDSA key fingerprint is MD5:57:83:e6:46:2c:4b:bb:33:13:56:17:f7:fd:76:71:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.30' (ECDSA) to the list of known hosts.
root@192.168.0.30's password: 
nginx.pem                                                             100% 4464     2.1MB/s   00:00    
[root@test CA]# 

[root@www conf.d]# cat login.conf 
server {
        listen 443 ssl;
        server_name 192.168.0.30;
        root https://img.qb5200.com/download-x/data/web/html;
        gzip on;
        gzip_types text/xml text/plain;
        gzip_disable Firefox;
        location /basic_status {
                stub_status;
                auth_basic "please input you username and passwd login";
                auth_basic_user_file /etc/nginx/conf.d/.ngxpasswd;
        }
        ssl_certificate "/etc/nginx/ssl/nginx.pem";
        ssl_certificate_key "/etc/nginx/ssl/nginx.key";
        ssl_protocols sslv2 sslv3 tlsv1 tlsv1.1 tlsv1.2;
        ssl_session_cache shared:SSL:10m;


}
[root@www conf.d]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@www conf.d]# nginx -s reload
[root@www conf.d]# 

rewrite /(.*)$ https://www.ilinux.io/basic_status;

 rewrite /(.*)\.jpg  /test/ redirect;

if ($http_user_agent ~ MSIE) {
    rewrite ^(.*)$ /msie/$1 break;
}

if ($http_cookie ~* "id=([^;]+)(?:;|$)") {
    set $id $1;
}

if ($request_method = POST) {
    return 405;
}

if ($slow) {
    limit_rate 10k;
}

if ($invalid_referer) {
    return 403;
}