How to implement https with nginx and openssl

[root@ns3 ~]# systemctl stop firewalld
[root@ns3 ~]# iptables -F
[root@ns3 ~]# setenforce 0
[root@ns3 ~]# yum -y install pcre zlib pcre-devel zlib-devel
[root@ns3 ~]# tar xf nginx-1.16.0.tar.gz -C /usr/src/
[root@ns3 ~]#cd /usr/src/nginx-1.16.0
[root@ns3 ~]#./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_stub_status_module --with-http_ssl_module --with-http_flv_module --with-http_gzip_static_module&&make && make install #Install the modules required later at one time

[root@ns3 ~]# rpm -qa openssl 2 openssl-1.0.1e-42.el7.x86_64

[root@ns3 ~]# yum -y install openssl openssl-devel

[root@ns3 ~]# cd zhengshu/
[root@ns3 zhengshu]# openssl genrsa -out local.key 2048
Generating RSA private key, 2048 bit long modulus
...........................................................................................................................................................................................................................................+++
............................................................................................................................................................................................................+++
e is 65537 (0x10001)
[root@ns3 zhengshu]# ls
local.key

[root@ns3 zhengshu]# openssl req -new -key local.key -out local.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN #State or Province Name (full name) []:BJ #Locality Name (eg, city) [Default City]:BJ #Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:test #DepartmentCommon Name (eg, your name or your server's hostname) []:test #HostnameEmail Address []:[email protected] #EmailPlease enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:wuminyan #Password An optional company name []:wuminyan #Name [root@ns3 zhengshu]# ls
local.csr local.key

req: This is a large command that provides generation of certificate request files, verification of certificates, and creation of root CAs
 -new: means to generate a new certificate request -x509: directly output the certificate -key: the private key file used when generating the certificate request -out: output file

This command to generate a CA certificate is confusing. 1. Generate a certificate request file using a secret key. 2. Generate the final certificate using a certificate request file. -in Generate a certificate using a certificate request file. -signkey specifies the private key. This is a parameter that I don't understand yet. [root@ns3 zhengshu]# openssl x509 -req -in local.csr -extensions v3_ca -signkey local.key -out local.crt
Signature ok
subject=/C=CN/ST=BJ/L=BJ/O=Default Company Ltd/OU=test/CN=test/[email protected]
Getting Private key

[root@ns3 zhengshu]# openssl genrsa -out my_server.key 2048
Generating RSA private key, 2048 bit long modulus
.................................+++
.........................................+++
e is 65537 (0x10001)
[root@ns3 zhengshu]# ls
local.crt local.csr local.key my_server.key

[root@ns3 zhengshu]# openssl x509 -req -in local.csr -extensions v3_ca -signkey local.key -out local.crt
Signature ok
subject=/C=CN/ST=BJ/L=BJ/O=Default Company Ltd/OU=test/CN=test/[email protected]
Getting Private key
[root@ns3 zhengshu]# openssl genrsa -out my_server.key 2048
Generating RSA private key, 2048 bit long modulus
.................................+++
.........................................+++
e is 65537 (0x10001)
[root@ns3 zhengshu]# openssl req -new -key my_server.key -out my_server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []: BJ
Locality Name (eg, city) [Default City]: BJ
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your server's hostname) []:test
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:wuminyan
An optional company name []:wuminyan
[root@ns3 zhengshu]# ls
local.crt local.csr local.key my_server.csr my_server.key

[root@ns3 zhengshu]# openssl x509 -days 365 -req -in my_server.csr -extensions v3_req -CAkey local.key -CA local.crt -CAcreateserial -out my_server.crt
 Signature ok
 subject=/C=CN/ST=BJ/L=BJ/O=Default Company Ltd/OU=test/CN=test/[email protected]
 Getting CA Private Key

[root@ns3 ~]# vim /etc/nginx.cof #A soft link is set here: lln -s /usr/local/nginx/sbin/nginx /usr/local/sbin/
server {
        listen 80;
        listen 443 default ssl; #Listen to port 433 keepalive_timeout 100; #Turn on keepalive Activate keepalive long connection to reduce the number of client requests ssl_certificate /root/zhengshu/local.crt; #Server certificate location ssl_certificate_key /root/zhengshu/local.key; #Server private key location ssl_session_cache shared:SSL:10m; #Cache session ssl_session_timeout 10m; #Session expires in 10 minutes ssl_ciphers HIGH:!aNULL:!MD5;
                   ssl_prefer_server_ciphers on;

        server_name test.com;
        charset utf-8;

        location / {
            root html;
            index index.html index.htm;
        }

    }
}