阿里雲SSL證書申請及部署

證書申請

這裏以阿里雲Symantec證書爲例

申請通配符域名證書

在xxx.cn 中配置location如下：

完整配置參考：

    server {
        listen 443 ssl;
        server_name xxx.cn;

        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 5m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        set $mobile_rewrite do_not_perform;
        if ($http_user_agent ~* "(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino") {
            set $mobile_rewrite perform;
        }
        location / {
            if ($mobile_rewrite = perform) {
                root /usr/local/nginx/m/mobile;
            }
            if ($mobile_rewrite = do_not_perform) {
                root html;
            }
        }
		location /.well-known/pki-validation/fileauth.txt {
            root /usr/local/nginx/html;
        }
    }

把驗證文件fileauth.txt上傳到服務器上一步配置的目錄中，本例的具體目錄是：
/usr/local/nginx/html/.well-known/pki-validation

E:\wy>scp fileauth.txt root@ip:/usr/local/nginx/html/.well-known/pki-validation
root@ip's password:
fileauth.txt                                                                          100%   64     1.7KB/s   00:00

E:\wy>

查看文件：

[root@izwz96u1ukkfo2k pki-validation]# ll
total 4
-rw-r--r-- 1 root root 64 Feb 18 11:00 fileauth.txt
[root@izwz96u1ukkfo2k pki-validation]# pwd
/usr/local/nginx/html/.well-known/pki-validation
[root@izwz96u1ukkfo2k pki-validation]# 

完成後重啓nginx

[root@izwz96u1ukkfo2k conf]# ../sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@izwz96u1ukkfo2k conf]# ../sbin/nginx -s reload

然後驗證，通過後提交。

坐等審覈

下載並部署證書

審覈通過後，下載證書，並選擇nginx

上傳證書到服務器

E:\wy\ssl\3472164__xxx.cn_nginx>scp 3472164__xxx.cn.* root@ip:/usr/local/nginx/conf/ssl/www.xxx.cn
root@ip's password:
3472164__xxx.cn.key                                                              100% 1679    39.0KB/s   00:00
3472164__xxx.cn.pem                                                              100% 3671    61.1KB/s   00:00

E:\wy\ssl\3472164__xxx.cn_nginx>

配置nginx配置文件

server {
        listen 80;
        server_name www.xxx.cn xxx.cn;
        return      301 https://$server_name$request_uri;
        set $mobile_rewrite do_not_perform;
        if ($http_user_agent ~* "(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino") {
            set $mobile_rewrite perform;
        }
        location / {
            if ($mobile_rewrite = perform) {
                root /usr/local/nginx/m/mobile;
            }
            if ($mobile_rewrite = do_not_perform) {
                root html;
            }
        }
        location /.well-known/pki-validation/fileauth.txt {
            root /usr/local/nginx/html;
        }
        location = /50x.html {
            root html;
        }
        error_page 500 502 503 504 /50x.html;
    }
    server {
        listen 443 ssl;
        server_name www.xxx.cn;
        
        ssl_session_cache shared:SSL:1m;
        ssl_certificate ./ssl/www.xxx.cn/3472164__xxx.cn.pem;
        ssl_certificate_key ./ssl/www.xxx.cn/3472164__xxx.cn.key;   
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        set $mobile_rewrite do_not_perform;
        if ($http_user_agent ~* "(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino") {
            set $mobile_rewrite perform;
        }
        location / {
            if ($mobile_rewrite = perform) {
                root /usr/local/nginx/m/mobile;
            }
            if ($mobile_rewrite = do_not_perform) {
                root html;
            }
        }
    }

安裝完成並驗證：

部署前：

部署後