摘要：生成證書可以在網(wǎng)上買一個或者自己做一個這里有一個腳本可以自動生成證書假設(shè)得到了兩個文件配置假設(shè)運(yùn)行的端口是域名為那么可以配置如下本配置只有部分不全強(qiáng)制如果不需要請注釋這一行修改路徑到下同

可以在網(wǎng)上買一個, 或者自己做一個.
這里有一個shell腳本可以自動生成證書:

#!/bin/sh

# create self-signed server certificate:

read -p "Enter your domain [www.example.com]: " DOMAIN

echo "Create server key..."

openssl genrsa -des3 -out $DOMAIN.key 1024

echo "Create server certificate signing request..."

SUBJECT="/C=US/ST=Mars/L=iTranswarp/O=iTranswarp/OU=iTranswarp/CN=$DOMAIN"

openssl req -new -subj $SUBJECT -key $DOMAIN.key -out $DOMAIN.csr

echo "Remove password..."

mv $DOMAIN.key $DOMAIN.origin.key
openssl rsa -in $DOMAIN.origin.key -out $DOMAIN.key

echo "Sign SSL certificate..."

openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt

假設(shè)得到了兩個文件: a.com.crt, a.com.key

假設(shè)Leanote運(yùn)行的端口是9000, 域名為a.com, 那么nginx.conf可以配置如下:

# 本配置只有http部分, 不全
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    
    upstream  a.com  {
        server   localhost:9000;
    }

    # http
    server
    {
        listen  80;
        server_name  a.com;
        
        # 強(qiáng)制https
        # 如果不需要, 請注釋這一行rewrite
        rewrite ^/(.*) https://jp_linode2.com/$1 permanent;
        
        location / {
            proxy_pass        http://a.com;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
    }
    
    # https
    server
    {
        listen  443 ssl;
        server_name  a.com;
        ssl_certificate     /root/a.com.crt; # 修改路徑, 到a.com.crt, 下同
        ssl_certificate_key /root/a.com.key;
        location / {
            proxy_pass        http://a.com;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
    }
}