[Nginx] 在Nginx服务器下配置StartSSL和SSL的教程

[root@e2fsck ~]# openssl genrsa -des3 -out e2fsck.org.key 2048 
Generating RSA private key, 1024 bit long modulus 
………..++++++ 
………..++++++ 
e is 65537 (0×10001) 
Enter pass phrase for e2fsck.org.key: 输入密码 
Verifying – Enter pass phrase for e2fsck.org.key: 输入密码 
  
[root@e2fsck ~]# openssl req -new -key e2fsck.org.key -out e2fsck.org.csr 
Enter pass phrase for e2fsck.org.key: 输入密码 
You are about to be asked to enter information that will be incorporated 
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank 
For some fields there will be a default value, 
If you enter ‘.', the field will be left blank. 
—– 
  
Country Name (2 letter code) [XX]:CN 
State or Province Name (full name) []:JS 
Locality Name (eg, city) [Default City]:SZ 
Organization Name (eg, company) [Default Company Ltd]:e2fsck 
Organizational Unit Name (eg, section) []:e2fsck.org 
Common Name (eg, your name or your server's hostname) []:*.e2fsck.org 
Email Address []:root@e2fsck.org 
  
Please enter the following ‘extra' attributes 
to be sent with your certificate request 
A challenge password []: 直接回车 
An optional company name []: 直接回车 
  
[root@e2fsck ~]# openssl rsa -in e2fsck.org.key -out e2fsck.org_nopass.key 
Enter pass phrase for e2fsck.org.key: 输入上面的密码 
writing RSA key 
  
[root@e2fsck ~]# ls 
  
e2fsck.org.csr e2fsck.org.key e2fsck.org_nopass.key

[root@e2fsck ~]# cd /usr/local/nginx/conf/   #我这里把证书都放在了这个目录 
  
[root@e2fsck conf]# wget http://cert.startssl.com/certs/ca.pem 
  
[root@e2fsck conf]# wget http://cert.startssl.com/certs/sub.class1.server.ca.pem 
  
[root@e2fsck conf]# cp e2fsck.org.crt e2fsck.org.bak   #先备份下 
  
[root@e2fsck conf]# cat ca.pem sub.class1.server.ca.pem >> e2fsck.org.crt

—–END CERTIFICATE———-BEGIN CERTIFICATE—–

—–END CERTIFICATE—– 
—–BEGIN CERTIFICATE—–

server {   listen  443;   server_name www.e2fsck.org;   index index.html index.htm index.php;   ssl     on;      <span id="note">#主要是这段</span>   ssl_certificate   e2fsck.org.crt;   ssl_certificate_key e2fsck.org_nopass.key;   ssl_session_timeout 5m;   ssl_protocols SSLv2 SSLv3 TLSv1;   ssl_ciphers HIGH:!aNULL:!MD5;   ssl_prefer_server_ciphers  on;   location ~ .php$ {         <span id="note">#这一小段是为了 https 能解析 php</span>   root    html;   fastcgi_pass  127.0.0.1:9000;   fastcgi_index index.php;   fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;   fastcgi_param HTTPS on;   include  fastcgi.conf;   }   if (-f $request_filename/index.html){    <span id="note">#如果非SSL做了伪静态，这里也要</span>   rewrite (.*) $1/index.html break;   }   if (-f $request_filename/index.php){    rewrite (.*) $1/index.php;   }   if (!-f $request_filename){   rewrite (.*) /index.php;   }   #location / {   #root  html;   #index index.html index.htm index.php;   #} }