一：生成证书

$ cd /usr/local/nginx/conf
创建服务器私钥，命令会让你输入一个口令：

$ openssl genrsa -des3 -out server.key 1024
创建签名请求的证书（CSR）：

$ openssl req -new -key server.key -out server.csr
在加载SSL支持的Nginx并使用上述私钥时除去必须的口令：

$ cp server.key server.key.org
$ openssl rsa -in server.key.org -out server.key

二：配置nginx
最后标记证书使用上述私钥和CSR：

$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
修改Nginx配置文件，让其包含新标记的证书和私钥：

server {
server_name localhost;
listen 443;
ssl on;
ssl_certificate /usr/local/nginx/conf/server.crt;
ssl_certificate_key /usr/local/nginx/conf/server.key;
}
重启nginx。

另外还可以加入如下代码实现80端口重定向到443

server {
listen 80;
server_name ww.centos.bz;
rewrite ^(.*) https://$server_name$1 permanent;
}

三： Apache HttpClient模拟https调用

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import org.apache.http.client.HttpClient;
import org.apache.http.conn.ClientConnectionManager;
import org.apache.http.conn.scheme.PlainSocketFactory;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.impl.conn.PoolingClientConnectionManager;
import org.apache.log4j.Logger;

public class SSLHttpClientFactory {

private static Logger logger = Logger.getLogger(SSLHttpClientFactory.class);

/**
* @description 获取支持http,https两种协议的httpClient
* @param
* @return
* @throws
*/
public static HttpClient wrapClient(HttpClient httpClient) {
try {
SSLContext ctx = SSLContext.getInstance("TLS");
X509TrustManager tm = new X509TrustManager() {

@Override
public void checkClientTrusted(
java.security.cert.X509Certificate[] chain,
String authType)
throws java.security.cert.CertificateException {

}

@Override
public void checkServerTrusted(
java.security.cert.X509Certificate[] chain,
String authType)
throws java.security.cert.CertificateException {

}

@Override
public java.security.cert.X509Certificate[] getAcceptedIssuers() {

return null;
}

};
ctx.init(null, new TrustManager[] { tm }, null);
SSLSocketFactory ssf = new SSLSocketFactory(ctx,
SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
SchemeRegistry registry = new SchemeRegistry();
registry.register(new Scheme("https", 443, ssf));
registry.register(new Scheme("http", 80, PlainSocketFactory
.getSocketFactory()));
ClientConnectionManager mgr = new PoolingClientConnectionManager(
registry);
return new DefaultHttpClient(mgr, httpClient.getParams());
} catch (Exception e) {
logger.error("封装https client异常", e);
return httpClient;
}

}

}
=====================================================================

/**
* @description 发送json请求，并返回结果
* @param url
* 请求地址
* @param jsonRequest
* 请求参数
* @return jsonResponse 返回结果
* @throws
*/
public static String sendJsonRequest(String url, String jsonRequest)
throws Exception {
logger.info("请求URL：" + url);
logger.info("请求参数：" + jsonRequest);
String jsonResponse = null;
httpClient = new DefaultHttpClient();
httpClient = SSLHttpClientFactory.wrapClient(httpClient );
postMethod = new HttpPost(url);

StringEntity entity = new StringEntity(jsonRequest, "UTF-8");
entity.setContentEncoding(new BasicHeader(HTTP.CONTENT_ENCODING,
Consts.UTF_8.toString()));
entity.setContentType(new BasicHeader(HTTP.CONTENT_TYPE,
"application/json;charset=UTF-8"));

postMethod.setEntity(entity);
postMethod.getParams().setParameter(
CoreProtocolPNames.USER_AGENT,
System.getProperty("os.name") + "(version "
+ System.getProperty("os.version") + " "
+ System.getProperty("os.arch") + ") "
+ System.getProperty("user.language"));
//添加头信息告诉服务端可以对Response进行GZip压缩
postMethod.setHeader("Accept-Encoding", "gzip, deflate");
// 开始请求
startTime = System.currentTimeMillis();
HttpResponse response = httpClient.execute(postMethod);

logger.info("status:"+response.getStatusLine().getStatusCode());

// 读取请求结果
if (HttpStatus.SC_OK == response.getStatusLine().getStatusCode()) {
HttpEntity httpEntity = response.getEntity();
//对gzip压缩过的返回结果进行解密
if(response.getFirstHeader("Content-Encoding") != null && response.getFirstHeader("Content-Encoding").getValue().toLowerCase().indexOf("gzip") > -1)
{
jsonResponse =dealGzipResponse(response);
}
else {
jsonResponse = EntityUtils.toString(httpEntity);

}

}
endTime = System.currentTimeMillis();
logger.info("返回结果size：" + jsonResponse.length());
logger.info("返回结果：" + Des3.decode(jsonResponse,"B30588A0EF18527DBBFB5ADB"));
logger.info("本次请求花费时间:" + (endTime - startTime) + "ms");

return jsonResponse;

}



/**
* @description 解析gzip返回结果
* @param
* @return
* @throws
*/
public static String dealGzipResponse(HttpResponse response) throws IOException
{
logger.info("=======解析gzip返回结果==========");
InputStream is = response.getEntity().getContent();
GZIPInputStream gzin = new GZIPInputStream(is);

InputStreamReader isr = new InputStreamReader(gzin,"UTF-8");
java.io.BufferedReader br = new java.io.BufferedReader(isr);
StringBuffer sb = new StringBuffer();
String tempbf;
while ((tempbf = br.readLine()) != null) {
sb.append(tempbf);
}
isr.close();
gzin.close();

return sb.toString();
}

ITPub博客

nginx使用ssl模块配置HTTPS支持

最新文章