nginx配置ssl双向验证的方法

朱雀 2022-08-07 14:53 160阅读 0赞

**http://www.jb51.net/article/57012.htm**

**1、安装nginx略**

[http://www.jb51.net/article/49479.htm][http_www.jb51.net_article_49479.htm]

**2、使用openssl实现证书中心**  
由于是使用openssl架设私有证书中心，因此要**保证以下字段在证书中心的证书、服务端证书、客户端证书中都相同**  
Country Name  
State or Province Name  
Locality Name  
Organization Name  
Organizational Unit Name

编辑证书中心配置文件  
vim /etc/pki/tls/openssl.cnf

\[ CA\_default \]  
dir             = /etc/pki/CA  
certs           = $dir/certs            \# Where the issued certs are kept  
crl\_dir         = $dir/crl              \# Where the issued crl are kept  
database        = $dir/index.txt        \# database index file.  
\#unique\_subject = no                    \# Set to 'no' to allow creation of  
                                       \# several ctificates with same subject.  
new\_certs\_dir   = $dir/newcerts         \# default place for new certs.  
certificate     = $dir/cacert.pem       \# The CA certificate  
serial          = $dir/serial           \# The current serial number  
crlnumber       = $dir/crlnumber        \# the current crl number                                        \# must be commented out to leave a V1 CRL  
crl             = $dir/crl.pem          \# The current CRL  
private\_key     = $dir/private/cakey.pem\# The private key  
RANDFILE        = $dir/private/.rand    \# private random number file

\[ req\_distinguished\_name \]  
countryName                     = Country Name(2 letter code)  
countryName\_default             = CN  
countryName\_min                 = 2  
countryName\_max                 = 2  
stateOrProvinceName             = State or Province Name (full name)  
stateOrProvinceName\_default     = FJ  
localityName                    = Locality Name (eg, city)  
localityName\_default            = FZ  
0.organizationName              = Organization Name (eg, company)  
0.organizationName\_default      = zdz  
organizationalUnitName          = Organizational Unit Name (eg, section)  
organizationalUnitName\_default  = zdz

创建证书私钥  
cd /etc/pki/CA/private  
(umask 077;**openssl genrsa -out cakey.pem 2048**)  
生成自签证书  
cd /etc/pki/CA/  
**openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days=3655**

**3、创建服务器证书**  
mkdir /usr/local/nginx/ssl  
cd /usr/local/nginx/ssl  
(umask 077;openssl genrsa -out nginx.key 1024)  
openssl req -new -key nginx.key -out nginx.csr  
openssl ca -in nginx.csr -out nginx.crt -days=3650

**4、创建客户端浏览器证书**  
(umask 077;openssl genrsa -out client.key 1024)  
openssl req -new -key client.key -out client.csr  
openssl ca -in client.csr -out client.crt -days=3650  
将文本格式的证书转换成可以导入浏览器的证书  
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

**5、配置nginx服务器验证**  
vim /usr/local/nginx/conf/**nginx.conf**  
ssl on;  
ssl\_certificate         /usr/local/nginx/ssl/nginx.crt;  
ssl\_certificate\_key     /usr/local/nginx/ssl/nginx.key;  
ssl\_client\_certificate  /usr/local/nginx/ssl/cacert.pem;  
ssl\_session\_timeout     5m;  
\#ssl\_verify\_client       on;                         **服务器验证客户端，暂时不开启，让没有证书的客户端可以访问，先完成单向验证**  
ssl\_protocols           SSLv2 SSLv3 TLSv1;  
[![2014110300102411.png][]][2014110300102411.png]  
点击“我已充分了解可能的风险”  
[![2014110300102412.png][]][2014110300102412.png]  
点击“添加例外”  
![2014110300102413.png][]  
点击“确认安全例外”  
[![2014110300102414.png][]][2014110300102414.png]

**6、配置双向验证**  
**nginx配置开启ssl\_verify\_client       on;      
在客户端浏览器没有安装证书的情况下访问**

[![2014110300102415.png][]][2014110300102415.png]  
**在客户端浏览器导入证书，即可完成双向认证**  
![2014110300102416.png][]  
将在Linux服务器上生成的客户端证书下载到windows上  
![2014110300102417.png][]  
打开火狐浏览器的高级选项卡  
![2014110300102418.png][]  
在证书管理器中的您的证书中点击导入  
![2014110300102419.png][]  
选择证书并导入  
![2014110300102420.png][]  
再次刷新网页，弹出“使用确认”点击确定，就实现了双向验证

[http_www.jb51.net_article_49479.htm]: http://www.jb51.net/article/49479.htm
[2014110300102411.png]: /images/20220805/55115ae3b945414e993ec95b75f1ad66.png
[2014110300102412.png]: /images/20220805/d4c5a2a797204168a165a8cc0ca01788.png
[2014110300102413.png]: /images/20220805/866e5dd2545b4c2eb1c60531a5069faa.png
[2014110300102414.png]: /images/20220805/b25bfd24918641f384b9022536316157.png
[2014110300102415.png]: /images/20220805/587355804c9e4e47b306414839bf4fd6.png
[2014110300102416.png]: /images/20220805/f5b9d73f271e49748b1fe9d7b8e3bf63.png
[2014110300102417.png]: /images/20220805/3becb9b40c29487096eafc4e87853b88.png
[2014110300102418.png]: /images/20220805/47c3b9bd5b844f9f8f859cac1e628178.png
[2014110300102419.png]: /images/20220805/72b390b64698438eae0141f581380a17.png
[2014110300102420.png]: /images/20220805/7d15ee304f9547bba80c02c0d8b6bc41.png