Question

sudo mkdir /etc/nginx/ssl

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

成功创建ngnix.key和ngnix.crt

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        listen 443 ssl;

        root /usr/share/nginx/html;
        index index.html index.htm;

        server_name your_domain.com;
        ssl_certificate /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key /etc/nginx/ssl/nginx.key;

        location / {
                try_files $uri $uri/ =404;
        }
}

sudo service nginx restart

我已经生成了.crt文件和.key文件，但是经过上述过程，证书在域中无效，请帮助逐步在AWS ec2实例中进行配置。

Answer 1

Nginx使用“主机”头进行server_name匹配。您的代码段中缺少default_server。

server {
 server_name _yourdomain.com;
 listen 80 default_server ipv6only=on;
 listen 443 ssl default_server;
 ssl_certificate /etc/nginx/ssl/nginx.crt;
 ssl_certificate_key /etc/nginx/ssl/nginx.key;
 return 404; # or whatever
 }

Answer 2

首先，我们必须在单个文件中生成.key和.crt文件，然后生成SSL证书密钥和.crt文件concat，并将该文件路径提供给nginx配置文件。 https://nicolas.perriault.net/code/2012/gandi-standard-ssl-certificate-nginx/

使用Gandi.net SSL证书的AWS SSL配置

2 个答案: