Nginx使用自签ssl证书实现https连接的方法

openssl genrsa -des3 -out server.key 1024

openssl req -new -key server.key -out server.csr

#---------------------------------------------------------------------------------------------------------------
Enter pass phrase for server.key:                                      #之前输入的密码
Country Name (2 letter code) [XX]:                   #国家
State or Province Name (full name) []:                 #区域或是省份
Locality Name (eg, city) [Default City]:                #地区局部名字
Organization Name (eg, company) [Default Company Ltd]:         #机构名称：填写公司名
Organizational Unit Name (eg, section) []:               #组织单位名称:部门名称
Common Name (eg, your name or your server's hostname) []:     #网站域名
Email Address []:                             #邮箱地址
A challenge password []:                         #输入一个密码，可直接回车
An optional company name []:                       #一个可选的公司名称，可直接回车
#---------------------------------------------------------------------------------------------------------------

cp server.key server.key.org

openssl rsa -in server.key.org -out server.key

#以下命令生成v1版证书
openssl x509 -req  -days 365 -sha256   -in server.csr -signkey server.key -out servernew.crt

openssl x509 -req  -days 365 -sha256 -extfile openssl.cnf -extensions v3_req   -in server.csr -signkey server.key -out servernew.crt

openssl rsa -noout -text -in myserver.key
openssl req -noout -text -in myserver.csr
openssl x509 -noout -text -in ca.crt

openssl pkcs12 -in myserver.pfx -out myserver.pem -nodes

openssl x509 -outform der -in myserver.pem -out myserver.[der|crt]

openssl RSA -in myserver.pem -out myserver.key

openssl x509 -inform der -in myserver.[cer|crt] -out myserver.pem

openssl pkcs12 -export -out myserver.pfx -inkey myserver.key -in myserver.pem -certfile ca.crt

server {
    listen 443 ssl;
    server_name your.domain.name;
    index index.html index.htm index.php;
    ssl on;
    ssl_certificate      ssl/hotyq.com.crt;
    ssl_certificate_key  ssl/hotyq.com.key;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols    TLSv1 TLSv1.1 TLSv1.2;
}

server {
    listen 80;
    server_name your.domain.name;
    rewrite ^(.*) https://$server_name$1 permanent;
}

curl   https://your.domain.name

curl -3  https://your.domain.name