阿里云申请 SSL

控制台，找到 SSL 证书菜单，购买“免费版个人 DV”，按照提示把 SSL 证书设置到对应的域名。

把 SSL 证书上传到 nginx 目录

先把 SSL 证书从阿里云控制台下载下来，服务器上新建目录 /etc/nginx/cert, 把证书文件上传到 /etc/nginx/cert。
设置 nginx.conf 如下：

  1. user root;
  2. worker_processes auto;
  3. error_log /var/log/nginx/error.log;
  4. pid /run/nginx.pid;
  6. # Load dynamic modules. See /usr/share/nginx/README.dynamic.
  7. include /usr/share/nginx/modules/*.conf;
  9. events {
  10.     worker_connections 1024;
  11. }
  13. http {
  14.     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  15.                       '$status $body_bytes_sent "$http_referer" '
  16.                       '"$http_user_agent" "$http_x_forwarded_for"';
  18.     access_log  /var/log/nginx/access.log  main;
  20.     sendfile            on;
  21.     tcp_nopush          on;
  22.     tcp_nodelay         on;
  23.     keepalive_timeout   65;
  24.     types_hash_max_size 2048;
  26.     include             /etc/nginx/mime.types;
  27.     default_type        application/octet-stream;
  29.     # Load modular configuration files from the /etc/nginx/conf.d directory.
  30.     # See http://nginx.org/en/docs/ngx_core_module.html#include
  31.     # for more information.
  32.     include /etc/nginx/conf.d/*.conf;
  33.     upstream my_nodejs_upstream {
  34.     server 127.0.0.1:3001;
  35.     keepalive 64;
  36. }
  38. server {
  39.     listen 80;
  41.     server_name wx.huizhanyt.com;
  43.     location / {
  44.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  45.         proxy_set_header X-Real-IP $remote_addr;
  46.         proxy_set_header Host $http_host;
  48.         proxy_http_version 1.1;
  49.         proxy_set_header Upgrade $http_upgrade;
  50.         proxy_set_header Connection "upgrade";
  52.         proxy_pass http://my_nodejs_upstream/;
  53.         proxy_redirect off;
  54.         proxy_read_timeout 240s;
  55.     }
  56. }
  58. server {
  59.     listen 443 ssl;
  61.     server_name wx.huizhanyt.com;
  63.         ssl_certificate cert/wx.huizhanyt.com.pem;   #将domain name.pem替换成您证书的文件名。
  64.         ssl_certificate_key cert/wx.huizhanyt.com.key;   #将domain name.key替换成您证书的密钥文件名。
  65.         ssl_session_timeout 5m;
  66.         ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
  67.         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  68.         ssl_prefer_server_ciphers on;
  69.     location / {
  70.     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  71.         proxy_set_header X-Real-IP $remote_addr;
  72.         proxy_set_header Host $http_host;
  74.         proxy_http_version 1.1;
  75.         proxy_set_header Upgrade $http_upgrade;
  76.         proxy_set_header Connection "upgrade";
  78.         proxy_pass http://my_nodejs_upstream/;
  79.         proxy_redirect off;
  80.         proxy_read_timeout 240s;
  81.     }
  82. }
  83. }

用 sudo nginx -t 检查配置是否有错误。
重启 nginx

firewallD 添加 https 服务

firewall-cmd —permanent —add-service=https