12.17 Nginx负载均衡12.18 ssl原理12.19 生成ssl密钥对12.20 Nginx配置ssl

阅读:477 2019-03-19 15:06:25 来源:新网

代理一台机器为代理,两台机器,就叫负载均衡代理服务器后面可以是多台web服务器,多个web服务器提供服务的时候,就可以实现一个负载均衡正常情况下,用户访问web服务器,是一台一台去请求;要么就是指定一个ip,把这域名解析到多台服务器上

例:用户1-->web1服务器用户2-->web2服务器

用户1-->web1服务器(宕机)用户1因为解析到了web1,但web1宕机了。没法访问

这时候如果使用了nginx负载均衡,web1宕机,代理服务器就不会继续把请求发送到web1

通过dig可以查看到域名的解析ip地址包“bind-utils”

[root@aminglinux-02vhost]#yuminstall-ybind-util[root@aminglinux-02vhost]#digqq.com;<<>>dig9.9.4-redhat-9.9.4-50.el7_3.1<<>>qq.com;;globaloptions:+cmd;;gotanswer:;;->>header<<-opcode:query,status:noerror,id:29688;;flags:qrrdra;query:1,answer:1,authority:0,additional:1;;optpseudosection:;edns:version:0,flags:;udp:4096;;questionsection:;qq.com.ina;;answersection:qq.com.353ina14.17.32.211;;querytime:35msec;;server:119.29.29.29#53(119.29.29.29);;when:三8月1600:14:17cst2017;;msgsizercvd:51

新增一个配置文件load.conf

upstreamqq_com//这个名字可以自定义{ip_hash;//目的是为了让同一个用户始终保持在同一个机器上server14.17.32.211:80;//如果域名解析端口是80,这段配置上的指定端口80是可以省略的}server{listen80;//定义监听端口server_namewww.qq.com;//域名location/{proxy_passhttp://qq_com;//这里填写的是upstream的名字即“http://upstream”,因为作为一个模块,代理访问的是通过解析后的ip访问;proxy_set_headerhost$host;proxy_set_headerx-real-ip$remote_addr;proxy_set_headerx-forwarded-for$proxy_add_x_forwarded_for;}}

upstream来指定多个webserver当有多个服务器同时对一个域名提供服务的时候,长时间访问一个域名,在一定的时效内,会出现需要重新登录或者是说跳转到另外一个地址的服务器上;ip_hash,就是使通过这个代理访问的同一个域名的多个ip的服务器是,始终保持在一个ip上对这个域名进行访问

没有使用负载均衡配置的时候,curl-x127.0.0.1默认访问的是虚拟主机的

[root@aminglinux-02vhost]#curl-x127.0.0.1:80www.qq.comthisisthedefaultsite.

配置完成后检查语法和重新加载服务

-t&&-sreload

测试

[root@aminglinux-02vhost]#curl-x127.0.0.1:80www.qq.comvar_mtac={};(function(){varmta=document.createelement("script");mta.src="http://pingjs.qq.com/h5/stats.js?v2.0.2";mta.setattribute("name","mtah5");mta.setattribute("sid","500460529");vars=document.getelementsbytagname("script")[0];s.parentnode.insertbefore(mta,s);})();

这时curl到的是qq的主页,反馈回来的是网页的源码

知识点:nginx不支持去代理https,支持http、tcp解决办法,nginx监听443端口,但web服务必须是80端口

https通信是加密的,如果不加密,中间传输数据包的时候会被截到,就会导致信息泄露,https就是对这个通信的数据包进行加密

在自己的虚拟机生成ssl需要用到openssl工具如果没有安装就安装

[root@aminglinux-02conf]#rpm-qf`whichopenssl`openssl-1.0.1e-60.el7_3.1.x86_64生成密钥

[root@aminglinux-02conf]#opensslgenrsa-des3-outtmp.key2048generatingrsaprivatekey,2048bitlongmodulus.+++.......................................+++eis65537(0x10001)enterpassphrasefortmp.key://输入密码verifying-enterpassphrasefortmp.key://再次输入密码

命令解释

opensslgenrsa-des3-outtmp.key2048genrsa生成rsa的密码20482048长度名字为tmp.key

因为这个加密,之后在nginx访问的时候还会提示输入密码,这样会很麻烦,所以就需要去掉密码

转换key,取消密码

[root@aminglinux-02conf]#opensslrsa-intmp.key-outaminglinux.keyenterpassphrasefortmp.key:unabletoloadprivatekey139930989189024:error:06065064:digitalenveloperoutines:evp_decryptfinal_ex:baddecrypt:evp_enc.c:604:139930989189024:error:0906a065:pemroutines:pem_do_header:baddecrypt:pem_lib.c:483:

输入错误密码会提示

[root@aminglinux-02conf]#opensslrsa-intmp.key-outaminglinux.keyenterpassphrasefortmp.key:writingrsakey

完成取消密码

命令解释

-intmp.key输入tmp.key-outaminglinux.key输出aminglinux.key生成公钥

生成证书请求文件,需要拿这个文件和私钥一起生产公钥文件

[root@aminglinux-02conf]#opensslreq-new-keyaminglinux.key-outaminglinux.csryouareabouttobeaskedtoenterinformationthatwillbeincorporatedintoyourcertificaterequest.whatyouareabouttoenteriswhatiscalledadistinguishednameoradn.therearequiteafewfieldsbutyoucanleavesomeblankforsomefieldstherewillbeadefaultvalue,ifyouenter'.',thefieldwillbeleftblank.-----countryname(2lettercode)[xx]:cn//国家,2个字母stateorprovincename(fullname)[]:guangxi//省或州localityname(eg,city)[defaultcity]:liuzhou//城市organizationname(eg,company)[defaultcompanyltd]:aming//公司organizationalunitname(eg,section)[]:aming//组织commonname(eg,yournameoryourserver'shostname)[]:aminglinux//您的主机名emailaddress[]:amin@adminlinux.com//邮箱pleaseenterthefollowing'extra'attributestobesentwithyourcertificaterequestachallengepassword[]:1231512315//设置密码anoptionalcompanyname[]://一个可选的公司名称

用请求证书文件和私钥文件,生成一个公钥

[root@aminglinux-02conf]#opensslx509-req-days365-inaminglinux.csr-signkeyaminglinux.key-outaminglinux.crtsignatureoksubject=/c=cn/st=guangxi/l=liuzhou/o=aming/ou=aming/cn=aminglinux/emailaddress=amin@adminlinux.comgettingprivatekey12.20nginx配置ssl生成一个新的配置文件

[root@aminglinux-02conf]#cdvhost/[root@aminglinux-02vhost]#pwd/usr/local/nginx/conf/vhostserver{listen443;server_nameaming.com;//主机名indexindex.htmlindex.php;root/data/wwwroot/aming.com;//root目录sslon;//打开sslssl_certificateaminglinux.crt;//指定公钥ssl_certificate_keyaminglinux.key;//指定私钥ssl_protocolstlsv1tlsv1.1tlsv1.2;//ssl的协议}

因为是新的主机,所以需要去创建对应的目录

配置完成后检查语法

[root@aminglinux-02vhost]#/usr/local/nginx/sbin/nginx-tnginx:[emerg]unknowndirective"ssl"in/usr/local/nginx/conf/vhost/ssl.conf:7nginx:configurationfile/usr/local/nginx/conf/nginx.conftestfailed

报错,因为安装nginx的时候是最简单的配置,不支持ssl

查看配置

[root@aminglinux-02vhost]#/usr/local/nginx/sbin/nginx-vnginxversion:nginx/1.12.1builtbygcc4.8.520150623(redhat4.8.5-11)(gcc)configurearguments:--prefix=/usr/local/nginx

需要重新编译,加上一条支持ssl

进入nginx目录重新编译

[root@aminglinux-02src]#cdnginx-1.12.1[root@aminglinux-02nginx-1.12.1]#pwd/usr/local/src/nginx-1.12.1

查看所需的依赖配置

[root@aminglinux-02nginx-1.12.1]#./configure--help|grep-issl--with-http_ssl_moduleenablengx_http_ssl_module--with-mail_ssl_moduleenablengx_mail_ssl_module--with-stream_ssl_moduleenablengx_stream_ssl_module--with-stream_ssl_preread_moduleenablengx_stream_ssl_preread_module--with-openssl=dirsetpathtoopenssllibrarysources--with-openssl-opt=optionssetadditionalbuildoptionsforopenssl

所需“--with-http_ssl_module”

[root@aminglinux-02nginx-1.12.1]#./configure--prefix=/usr/local/nginx--with-http_ssl_modulecheckingforos+linux3.10.0-514.el7.x86_64x86_64checkingforccompiler...found+usinggnuccompiler+gccversion:4.8.520150623(redhat4.8.5-11)(gcc)checkingforgcc-pipeswitch...found......nginxerrorlogfile:"/usr/local/nginx/logs/error.log"nginxhttpaccesslogfile:"/usr/local/nginx/logs/access.log"nginxhttpclientrequestbodytemporaryfiles:"client_body_temp"nginxhttpproxytemporaryfiles:"proxy_temp"nginxhttpfastcgitemporaryfiles:"fastcgi_temp"nginxhttpuwsgitemporaryfiles:"uwsgi_temp"nginxhttpscgitemporaryfiles:"scgi_temp"[root@aminglinux-02nginx-1.12.1]#make&&makeinstall......test-d'/usr/local/nginx/logs'||mkdir-p'/usr/local/nginx/logs'make[1]:离开目录“/usr/local/src/nginx-1.12.1”[root@aminglinux-02nginx-1.12.1]#echo$?0

检查配置

[root@aminglinux-02nginx-1.12.1]#/usr/local/nginx/sbin/nginx-vnginxversion:nginx/1.12.1builtbygcc4.8.520150623(redhat4.8.5-11)(gcc)builtwithopenssl1.0.1e-fips11feb2013tlssnisupportenabledconfigurearguments:--prefix=/usr/local/nginx--with-http_ssl_module

重新检查语法

[root@aminglinux-02nginx-1.12.1]#/usr/local/nginx/sbin/nginx-tnginx:theconfigurationfile/usr/local/nginx/conf/nginx.confsyntaxisoknginx:configurationfile/usr/local/nginx/conf/nginx.conftestissuccessful

重启配置

[root@aminglinux-02nginx-1.12.1]#/etc/init.d/nginxrestartrestartingnginx(viasystemctl):[确定]

检查监听端口

[root@aminglinux-02nginx-1.12.1]#netstat-lntpactiveinternetconnections(onlyservers)protorecv-qsend-qlocaladdressforeignaddressstatepid/programnametcp000.0.0.0:800.0.0.0:*listen5761/nginx:mastertcp000.0.0.0:220.0.0.0:*listen995/sshdtcp00127.0.0.1:250.0.0.0:*listen2181/mastertcp000.0.0.0:4430.0.0.0:*listen5761/nginx:mastertcp600:::3306:::*listen1773/mysqldtcp600:::22:::*listen995/sshdtcp600::1:25:::*listen2181/master

多了一个443端口的监听

创建测试文件

[root@aminglinux-02nginx-1.12.1]#cd/data/wwwroot/aming.com/[root@aminglinux-02aming.com]#pwd/data/wwwroot/aming.com[root@aminglinux-02aming.com]#vimindex.htmlthisisssl

不能继续使用curl-x测试

[root@aminglinux-02aming.com]#curl-x127.0.0.1:443https://aming.comcurl:(56)receivedhttpcode400fromproxyafterconnect

会报错

改hosts,直接访问

[root@aminglinux-02aming.com]#vi/etc/hosts[root@aminglinux-02aming.com]#curlhttps://aming.comcurl:(60)peer'scertificateissuerhasbeenmarkedasnottrustedbytheuser.moredetailshere:http://curl.haxx.se/docs/sslcerts.htmlcurlperformssslcertificateverificationbydefault,usinga"bundle"ofcertificateauthority(ca)publickeys(cacerts).ifthedefaultbundlefileisn'tadequate,youcanspecifyanalternatefileusingthe--cacertoption.ifthishttpsserverusesacertificatesignedbyacarepresentedinthebundle,thecertificateverificationprobablyfailedduetoaproblemwiththecertificate(itmightbeexpired,orthenamemightnotmatchthedomainnameintheurl).ifyou'dliketoturnoffcurl'sverificationofthecertificate,usethe-k(or--insecure)option.

报错:curl:(60)peer的证书发行者被标记为不受用户信任。这是ssl已经是安装上了

可以尝试用浏览器访问改动本机windows主机hosts如果还是访问不到,就需要加上443端口放行,或者清空默认规则

相关文章
{{ v.title }}
{{ v.description||(cleanHtml(v.content)).substr(0,100)+'···' }}
你可能感兴趣
推荐阅读 更多>
推荐商标

{{ v.name }}

{{ v.cls }}类

立即购买 联系客服