标题：*
140 字

TAG标签：（用空格隔开）
30 字

恢复历史版本：

HTML转MD HTML转MD2

要点: &nbsp;&nbsp;&nbsp;&nbsp;1,下载证书里说cert上传到/usr/local&nbsp; &nbsp;(分别把nginx与apache上传到www.xxx.com.cert/nginx与www.xxx.com.cert/apache下)&nbsp; &nbsp; 2,在 &nbsp;/usr/local/nginx/conf/proxy.conf 最后面加上 proxy_set_header X-Forwarded-Proto $scheme;&nbsp;在对应apache站点vhost中加入SetEnvIf X-Forwarded-Proto https HTTPS=on 解决lnmpa中$_SERVER[&#39;HTTPS&#39;]无值问题 &nbsp;&nbsp;&nbsp;&nbsp;4,服务器多站点多域名HTTPS实现&nbsp; 分别参考各服务商ssl证书安装文档<a href="https://help.aliyun.com/knowledge_detail/48032.html" _src="https://help.aliyun.com/knowledge_detail/48032.html">https://help.aliyun.com/knowledge_detail/48032.html</a>&nbsp; ，逻辑就是各域名配置段上加上相应密匙&nbsp;&nbsp;&nbsp;&nbsp;5,打开 apache 安装目录下 conf 目录中的 httpd.conf 文件，找到以下内容并去掉“#”&nbsp; &nbsp;<pre class="brush:plain;toolbar:false">#LoadModule&nbsp;ssl_module&nbsp;modules/mod_ssl.so&nbsp;(如果找不到请确认是否编译过&nbsp;openssl&nbsp;插件)
#Include&nbsp;conf/extra/httpd-ssl.conf</pre>&nbsp;&nbsp; &nbsp;5,apache的NameVirtualHost *:442(高版本apache2.4不用)&nbsp; 放入httpd.conf &nbsp; Include conf/vhost/*.conf 前面&nbsp; 主要要点是对应好密匙文件与反向代理的配置 依次配置以下文件nginx中修改<h5 class="margin-top" style="box-sizing: border-box; font-family: " helvetica="" luxi="" dejavu="" hiragino="" sans="" microsoft="" font-weight:="" line-height:="" color:="" margin-top:="" margin-bottom:="" font-size:="" white-space:="" background-color:="">nginx.conf&nbsp; 在默认主机server中加上return 301 <a href="https://www.xxx.com;" target="_self" textvalue="https://www.xxx.com;">https://www.xxx.com;</a>为了让ip地址跳转到自己网站</h5><pre class="brush:plain;toolbar:false">return&nbsp;301&nbsp;https://www.xxx.com;</pre> <h5 class="margin-top" style="white-space: normal; box-sizing: border-box; font-family: " helvetica="" luxi="" dejavu="" hiragino="" sans="" microsoft="" font-weight:="" line-height:="" color:="" margin-top:="" margin-bottom:="" font-size:="" background-color:="">proxy-pass-php.conf &nbsp;注意442&nbsp; 因nginx占用了443 apache改用442端口，让nginx把php处理反向代理给apache</h5><pre class="brush:plain;toolbar:false">location&nbsp;/
{
	try_files&nbsp;$uri&nbsp;@apache;
}

location&nbsp;@apache
{
	internal;
	proxy_pass&nbsp;https://127.0.0.1:442;
	include&nbsp;proxy.conf;
}

location&nbsp;~&nbsp;[^/]\.php(/|$)
{
	proxy_pass&nbsp;https://127.0.0.1:442;
	include&nbsp;proxy.conf;
}</pre><h5 class="margin-top" style="white-space: normal; box-sizing: border-box; font-family: " helvetica="" luxi="" dejavu="" hiragino="" sans="" microsoft="" font-weight:="" line-height:="" color:="" margin-top:="" margin-bottom:="" font-size:="" background-color:="">&nbsp; &nbsp; &nbsp; &nbsp; proxy.conf &nbsp;最后加一行proxy_set_header &nbsp; X-Forwarded-Proto $scheme;&nbsp; 新版lnmp.org已加上</h5><pre class="brush:plain;toolbar:false">proxy_set_header&nbsp;&nbsp;&nbsp;X-Forwarded-Proto&nbsp;$scheme;</pre> <a href="http://www.xxx.com.conf" _src="http://www.xxx.com.conf">www.xxx.com.conf</a>&nbsp; 站点配置文件&nbsp;重点 加密匙文件&nbsp;<pre class="brush:plain;toolbar:false">server{
	listen&nbsp;80;
	#listen&nbsp;[::]:80;
	server_name&nbsp;xxx.com&nbsp;www.xxx.com;
	return&nbsp;301&nbsp;https://www.xxx.com$request_uri;
	#rewrite&nbsp;^(.*)$&nbsp;&nbsp;https://$host$1&nbsp;permanent;&nbsp;&nbsp;&nbsp;#关键代码仔细比较两者的跳转的区别&nbsp;&nbsp;
	#root&nbsp;/home/wwwroot/www.xxx.com/static;&nbsp;&nbsp;&nbsp;#index.html建个meta的跳转
	#将404的页面重定向到https的首页&nbsp;&nbsp;
	#error_page&nbsp;&nbsp;404&nbsp;https://www.xxx.com/;
}
server{
	listen&nbsp;443;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server_name&nbsp;www.xxx.com;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;root&nbsp;&nbsp;/home/wwwroot/www.xxx.com;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;index&nbsp;index.html&nbsp;index.htm&nbsp;index.php;
		#error_page&nbsp;&nbsp;&nbsp;404&nbsp;&nbsp;&nbsp;/404.html;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;Deny&nbsp;access&nbsp;to&nbsp;PHP&nbsp;files&nbsp;in&nbsp;specific&nbsp;directory
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#location&nbsp;~&nbsp;/(wp-content|uploads|wp-includes|images)/.*\.php$&nbsp;{&nbsp;deny&nbsp;all;&nbsp;}
		
		ssl&nbsp;on;
		ssl_certificate			/usr/local/www.xxx.com.cert/nignx/xxx.com.crt;
		ssl_certificate_key		/usr/local/www.xxx.com.cert/nignx/xxx.com.key;
		ssl_session_timeout&nbsp;5m;
		ssl_ciphers&nbsp;ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
		ssl_protocols&nbsp;TLSv1&nbsp;TLSv1.1&nbsp;TLSv1.2;
		ssl_prefer_server_ciphers&nbsp;on;
		
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;proxy-pass-php.conf;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location&nbsp;~&nbsp;.*\.(gif|jpg|jpeg|png|bmp|swf)$
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;expires&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;30d;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}		
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location&nbsp;~&nbsp;.*\.(js|css)?$
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;expires&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;30d;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location&nbsp;~&nbsp;/\.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;deny&nbsp;all;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;access_log&nbsp;&nbsp;/home/wwwlogs/www.xxx.com.log;
}
#顺序不要错
server&nbsp;{
	listen&nbsp;443;
	server_name&nbsp;&nbsp;xxx.com;
	rewrite&nbsp;^(.*)$&nbsp;http://www.xxx.com$1&nbsp;permanent;
}</pre> apache修改httpd.conf &nbsp; &nbsp;把NameVirtualHost *:442(高版本apache2.4不用)&nbsp; &nbsp;放入httpd.conf &nbsp; Include conf/vhost/*.conf 前面 conf/extra/httpd-ssl.conf&nbsp;把证书修改成自己的 &nbsp;<pre class="brush:plain;toolbar:false">Listen&nbsp;442
#&nbsp;证书公钥配置
SSLCertificateFile&nbsp;&quot;/usr/local/www.xxx.com.cert/apache/xxx.com.crt&quot;
#&nbsp;证书私钥配置
SSLCertificateKeyFile&nbsp;&quot;/usr/local/www.91dmy.com.cert/apache/xxx.com.key&quot;
#&nbsp;证书链配置，如果该属性开头有&nbsp;&#39;#&#39;字符，请删除掉&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;实际中可以不配置
#SSLCertificateChainFile&nbsp;cert/chain.pem</pre>conf/vhost/<a href="http://www.xxx.com.conf" _src="http://www.xxx.com.conf">www.xxx.com.conf</a>&nbsp; 重点两点 加密匙文件对应好与加一行SetEnvIf X-Forwarded-Proto https HTTPS=on &nbsp; &nbsp; &nbsp;&nbsp;解决lnmpa中$_SERVER[&#39;HTTPS&#39;]无值问题<pre class="brush:plain;toolbar:false">&lt;VirtualHost&nbsp;*:442&gt;
ServerAdmin&nbsp;xx@xx.com
php_admin_value&nbsp;open_basedir&nbsp;&quot;/home/wwwroot/www.xxx.com:/tmp/:/var/tmp/:/proc/&quot;
DocumentRoot&nbsp;&quot;/home/wwwroot/www.xxx.com&quot;
ServerName&nbsp;www.xxx.com
ErrorLog&nbsp;&quot;/home/wwwlogs/www.xxx.com-error_log&quot;
CustomLog&nbsp;&quot;/home/wwwlogs/www.xxx.com-access_log&quot;&nbsp;combined
SSLCertificateFile&nbsp;		&quot;/usr/local/www.xxx.com.cert/apache/xxx.com.crt&quot;
SSLCertificateKeyFile&nbsp;	&quot;/usr/local/www.xxx.com.cert/apache/xxx.com.key&quot;
SSLCertificateChainFile&nbsp;&quot;/usr/local/www.xxx.com.cert/apache/chain.crt&quot;
&lt;Directory&nbsp;&quot;/home/wwwroot/www.xxx.com&quot;&gt;
&nbsp;&nbsp;&nbsp;&nbsp;SetOutputFilter&nbsp;DEFLATE
&nbsp;&nbsp;&nbsp;&nbsp;Options&nbsp;FollowSymLinks
&nbsp;&nbsp;&nbsp;&nbsp;AllowOverride&nbsp;All
&nbsp;&nbsp;&nbsp;&nbsp;Order&nbsp;allow,deny
&nbsp;&nbsp;&nbsp;&nbsp;Allow&nbsp;from&nbsp;all
&nbsp;&nbsp;&nbsp;&nbsp;DirectoryIndex&nbsp;index.html&nbsp;index.php
	SetEnvIf&nbsp;X-Forwarded-Proto&nbsp;https&nbsp;HTTPS=on
&lt;/Directory&gt;
&lt;/VirtualHost&gt;</pre>