自签SSL证书配置Nginx代理Vue+SpringBoot前后端分离服务

[root@hadoop2 ~]# cd /opt/
# 生成RSA密钥文件server.key（要设置并记住密码，后面要用到）
[root@hadoop2 opt]# openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus (2 primes)
..................+++++
.................................................+++++
e is 65537 (0x010001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
# 生成证书的申请文件server.csr
[root@hadoop2 opt]# openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:ShanXi
Locality Name (eg, city) []:TaiYuan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:YourCompany
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:YourEmail
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# 备份密钥文件
[root@hadoop2 opt]# cp server.key server.key.bk
# 移除文件口令，输出到新的server.key（这时，需要输入第一步设置的密码）
[root@hadoop2 opt]# openssl rsa -in server.key.bk -out server.key
Enter pass phrase for server.key.bk:
writing RSA key
# 生成证书文件server.crt
[root@hadoop2 opt]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=C = CN, ST = ShanXi, L = TaiYuan, O = YourCompany, emailAddress = YourEmail
Getting Private key

Enter pass phrase for root.key: <—— 前面设置的密码
Country Name (2 letter code) [AU]:CN <—— 国家代号，中国输入CN
State or Province Name (full name) [Some-State]:ShanXi <—— 省的全名，拼音
Locality Name (eg, city) []:TaiYuan <—— 市的全名，拼音
Organization Name (eg, company) [Internet Widgits Pty Ltd]:YourCompany <—— 公司英文名
Organizational Unit Name (eg, section) []: <—— 可不填
Common Name (eg, YOUR name) []: <—— 可不填
Email Address []:YourEmail <—— 电子邮箱
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []: <—— 可不填
An optional company name []: <—— 可不填

[root@hadoop2 ~]# nginx -V
nginx version: nginx/1.20.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --with-http_stub_status_module --with-http_ssl_module
Note：如果一开始在安装 Nginx 时没有安装 SSL 模块，需要重新编译安装 Nginx 。

# HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  localhost;
        ssl_certificate      /opt/ssl-cert/server.crt;
        ssl_certificate_key  /opt/ssl-cert/server.key;
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
        location / {
            root   html;
            index  index.html index.htm;
        }
    }

# HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  localhost;
        ssl_certificate      /opt/ssl-cert/server.crt;
        ssl_certificate_key  /opt/ssl-cert/server.key;
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
        #location / {
        #    root   html;
        #    index  index.html index.htm;
        #}
        location / {
            root       /opt/frontend/dist;
            try_files $uri $uri/ /index.html;
        }
        location /prod-api  {                              # custom prefix: third party API
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            rewrite  ^/prod-api/(.*)$ /$1 break;           # rewrite the URL and redirect
            include  uwsgi_params;
            proxy_pass   http://localhost:8080;   # Third party API URL
        }
    }