时间：2023-02-07 19:48:01 | 来源：建站知识
时间：2023-02-07 19:48:01 来源：建站知识
平常开发要求比较低, 依然在用 HTTP, 但到了微信小程序就不行了, 腾讯和苹果都对 API 提出了 HTTPS 的要求. 尤其是苹果, 不仅要求 HTTPS, 还要求
在线咨询
TLS 协议版本要在 1.2 以上, 这又被称为 App Transport Security(ATS).application.yml 中增加了两行配置而已.server: port: 8080 tomcat: protocol_header: x-forwarded-proto use-forward-headers: true address: 127.0.0.1证书申请/购买#在域名的基本信息页, 点击免费开启 SSL 证书, 输入相应的域名, 点击「申请」即可申请免费的 DV SSL 证书, 还需要做一些简单的信息补全等, 即可提交申请. 如果备案信息都齐全的话, 很快就可以验证成功, 在证书管理页面即可查看证书.pem 和 key, 下载完上传到服务器.rewrite, 这样, 当访问http://example.cn会自动转发到https://example.cn. server { listen 80; # redirect to 443 server_name AAA.example.cn www.AAA.example.cn; rewrite ^(.*)$ https://$host$1 permanent; } server { listen 80; # redirect to 443 server_name BBB.example.cn www.BBB.example.cn; rewrite ^(.*)$ https://$host$1 permanent; }然后就是真正的 https 部分了, 虽然域名不同, 但都监听 443 端口, 但有着不同的 server_name, 这样当收到请求时就可以根据请求的 server_name 不同来转发到不同的服务.8090、8091 即可. server { listen 443 ssl; server_name AAA.example.cn www.AAA.example.cn; ssl_certificate "/home/yushan/demontf/2076603_AAA.example.cn.pem"; ssl_certificate_key "/home/yushan/demontf/2076603_AAA.example.cn.key"; location / { proxy_pass http://127.0.0.1:8090; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; proxy_redirect default; } } server { listen 443 ssl; # redirect to https server_name BBB.example.cn www.BBB.example.cn; ssl_certificate "/home/yushan/demontf/2005538_BBB.example.cn.pem"; ssl_certificate_key "/home/yushan/demontf/2005538_BBB.example.cn.key"; location / { proxy_pass http://127.0.0.1:8091; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; proxy_redirect default; } }示例如下user nginx;worker_processes 1; error_log /var/log/nginx/error.log warn;pid /var/run/nginx.pid; events { # 最大连接数 worker_connections 1024;} http { include /etc/nginx/mime.types; default_type application/octet-stream; # 用来设置日志格式； log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; # 用来指定日志文件的存放路径、格式 access_log /var/log/nginx/access.log main; # 指定是否使用sendfile系统调用来传输文件。 sendfile on; #tcp_nopush on; keepalive_timeout 65; #gzip on; upstream appointment { # 请将xxx.xxx.xxx.xxx:8081 更换称自己的IP地址 server xxx.xxx.xxx.xxx:8081 weight=1 max_fails=2 fail_timeout=20; } server { listen 80; # 注意这里域名改写成自己的域名!!! server_name www.域名.com; # http请求时直接重定向到https rewrite ^(.*)$ https://${server_name}$1 permanent; root /usr/share/nginx/html; index index.html index.htm; location / { } } # Settings for a TLS enabled server.# server { listen 443 ssl; listen [::]:443 ssl; server_name localhost; ssl on; # root 根目录配置,这里设置的是 location/ 匹配访问路径的上一层目录,可根据需要重新配置 root /usr/share/nginx/html; index index.html index.htm; #证书文件名称 注意证书的放置位置 ssl_certificate cert/a.crt; #私钥文件名称 ssl_certificate_key cert/a.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; location / { } error_page 404 /404.html; location = /40x.html { } error_page 500 502 503 504 /50x.html; location = /50x.html { } } server { # 二级域名的SSL配置 listen 443 ssl; # 注意这里域名改写成自己的域名!!! server_name api.域名.com; ssl on; #证书文件名称 注意证书的放置位置 ssl_certificate cert/api.crt; #私钥文件名称 ssl_certificate_key cert/api.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; location / { # 注意这里改写成自己的域名!!! # 把8100端口映射到二级域名下，完成二级域名HTTPS proxy_pass http://www.域名.com:8100; proxy_set_header Host $host; # 获取请求的ip地址 proxy_set_header X-real-ip $remote_addr; # 获取请求的多级ip地址，当请求经过多个反向代理时，会获取多个ip，英文逗号隔开 } root /usr/share/nginx/html; index index.html index.htm; error_page 404 /404.html; location = /40x.html { } error_page 500 502 503 504 /50x.html; location = /50x.html { } } server { # 配置8100端口,用于二级域名使用 listen 8100 default_server; listen [::]:8100 default_server; server_name _; # root 根目录配置,这里设置的是端口8100 location/ 匹配访问路径的上一层目录,可根据需要重新配置 root /usr/share/nginx/html; # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; location / { } error_page 404 /404.html; location = /40x.html { } error_page 500 502 503 504 /50x.html; location = /50x.html { } } include /etc/nginx/conf.d/*.conf;}关键词：配置
