使用和配置更安全的HTTPS协议

域名备案完成

一、HTTPS介绍

　　是以安全为目标的HTTP通道，在HTTP的基础上通过传输加密和身份认证保证了传输过程的安全性

　　HTTPS是在HTTP的基础下加入SSL层，HTTPS的安全基础是SSL，因此加密的详细内容就需要SSL

　　因此，部署https的时候需要申请或者生成ssl证书的

　　1、域名申请https证书 -- 两个文件 pem+key

centos本地生成证书（dev模式下的 server.crt+server.key）
1	创建服务器证书密钥文件： server.key	openssl genrsa -des3 -out server.key 1024
2	创建服务器证书的申请文件： server.csr	openssl req -new -key server.key -out server.csr 输出内容为： 1 [lenin@archer ~]$ openssl req -new -key root.key -out root.csr 2 You are about to be asked to enter information that will be incorporated 3 into your certificate request. 4 What you are about to enter is what is called a Distinguished Name or a DN. 5 There are quite a few fields but you can leave some blank 6 For some fields there will be a default value, 7 If you enter ‘.’, the field will be left blank. 8 —– 9 Country Name (2 letter code) [AU]:CN ← 国家代号，中国输入CN 10 State or Province Name (full name) [Some-State]:BeiJing ← 省的全名，拼音 11 Locality Name (eg, city) []:BeiJing ← 市的全名，拼音 12 Organization Name (eg, company) []:MyCompany Corp. ← 公司英文名 13 Organizational Unit Name (eg, section) []: ← 可以不输入 14 Common Name (eg, YOUR name) []: ← 此时不输入 15 Email Address []:admin@mycompany.com ← 电子邮箱，可随意填 16 17 Please enter the following ‘extra’ attributes 18 to be sent with your certificate request 19 A challenge password []: ← 可以不输入 20 21 An optional company name []: ← 可以不输入
3	去除文件口令	openssl rsa -in ./server.key -out server.key
4	生成证书	openssl x509 -req -days 365 -in server.csr -signkey server.crt -out server.crt

　　2、nginx+https部署

nginx支持https
1	安装模块	yum -y install openssl openssl-devel
2	重新配置	./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module 原来的配置：
3	重新编译	make　　记：make编译的，make install是安装
4	备份原有已经安装好的nginx	cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak
5	将刚刚编译好的nginx覆盖掉原来的nginx	rm -rf /usr/local/nginx/sbin/ cp ./objs/nginx /usr/local/nginx/sbin/　　记：(ngixn必须停止)
6	执行进入目录，启动	cd /usr/local/nginx/sbin/ ./nginx -s reload

　　3、先打开443端口，放行443（https）端口

　　4、前端项目配置https配置server

 1 # HTTPS server
 2 #
 3     server {
 4         listen       443 ssl; // 开火墙，配置安全组
 5         server_name  localhost;
 6 
 7         ssl_certificate      /root/server.crt; # dev crt; online .pem
 8         ssl_certificate_key  /root/server.key;
 9 
10         ssl_session_cache    shared:SSL:1m;
11         ssl_session_timeout  5m;
12 
13         ssl_ciphers  HIGH:!aNULL:!MD5;
14         ssl_prefer_server_ciphers  on;
15 
16         location / {
17             root   /usr/local/nginx/html/dist;
18             index  index.html index.htm;
19         }
20     }

　　5、nodejs使用https证书

nginx配置

# node-https
    server {
        listen       443 ssl;
        server_name  localhost;

        ssl_certificate      /root/server.crt; # dev crt; online pem
        ssl_certificate_key  /root/server.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            proxy_redirect off;
           proxy_set_header Host $host;
           proxy_set_header X-Real-Ip $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_pass https://172.25.0.124:3001;
        }
    }

nodejs代码

const express = require('express')
const https = require('https')
const http = require('http')
const fs = require('fs')

// configure https
const httpsOption = {
  key: fs.readFileSync("/root/server.key"), // key
  cert: fs.readFileSync("/root/server.crt") // pem crt
}

console.log('httpsOption---', httpsOption)

const app = express()

// 开启https服务
https.createServer(httpsOption, app).listen(3001, () => {
  console.log('https 服务已经开启，端口号是 3001')
})
app.get('/apiHttps', function(req, res) {
  console.log('收到请求了，--，主机ip：', req.hostname)
  if(req.protocol === 'https') {
    res.status(200).send('https ----- Hello https!')
  } else {
    res.status(200).send('http ----- Hello http!')
  }
})

http.createServer(app).listen('3002', ()=> {
  console.log('http 服务已经开启，端口号是 3002')
})

拓展：