openssl自签nginx证书

前言

因为国内备案非常麻烦，我又需要服务器具备https的加密保护能力，用于保护webdav访问时防止信息被明文泄露，于是想到了通过 ip地址的自签名证书，来实现https的访问。

自签名IP证书

 openssl genrsa -aes256 -out server.key 2048
 openssl req -new -key server.key -out server.csr
 cp server.key server.key.org
 openssl rsa -in server.key.org -out server.key
 openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt

执行上面命令即可签发证书。

-aes256 表示对生成的rsa私钥进行aes256算法的加密保存，所以敲完后会让输入口令。
2048 表示生成的密钥对长度是2048，nginx低于2048会提示密钥过短
有一步会让输入很多信息，其中Common Name这项输入自己的域名，或者ip地址，其他项直接回车即可

nginx ssl配置

server {
        #listen 80 default_server;
        #listen [::]:80 default_server;

        # SSL configuration
        #
         listen 32700 ssl default_server;
         listen [::]:32700 ssl default_server;
        #
        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        #
        # Read up on ssl_ciphers to ensure a secure configuration.
        # See: https://bugs.debian.org/765782
        #
        # Self signed certs generated by the ssl-cert package
        # Don't use them in a production server!
        #
        # include snippets/snakeoil.conf;

        ssl_certificate /xxxx/server.crt;
        ssl_certificate_key /xxxx/server.key;

        #root /var/www/html;

        # Add index.php to the list if you are using PHP
        #index index.html index.htm index.nginx-debian.html;

        server_name _;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                proxy_pass http://<your IP or Domain>:<Port>;
        }

        # pass PHP scripts to FastCGI server
        #
        #location ~ \.php$ {
        #       include snippets/fastcgi-php.conf;
        #
        #       # With php-fpm (or other unix sockets):
        #       fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        #       # With php-cgi (or other tcp sockets):
        #       fastcgi_pass 127.0.0.1:9000;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #       deny all;
        #}
}

系统是ubuntu22.04，nginx通过apt安装，直接修改default默认模板，配置ssl证书，然后加入反向代理服务就完成了。