nginx实现SSL卸载

一、场景简介
某些场景中，我们需要保证业务的安全可靠，因此难免需要使用HTTPS加密保护数据，但是除了在公网做SSL加密之外，内网之间的传输加密倒是意义不大，因此nginx的SSL加密负载就可以派上用场了

二、拓扑




三、配置
1.配置自签名CA，并且给服务器证书签名
配置CA

#cd  /etc/pki/CA
1.为CA生成i一个私钥
#（umask 077；openssl genrsa -out private/cakey.pem 2048）
2.生成自签名证书
openssl req -new -x509 -key private/cakey.pem  -out cacert.pem -days 365
touch index.txt
echo 01>serial

申请证书，并签名

# cd  /etc/nginx/
# mkdir ssl
# cd ssl
1.用户生成自己的私钥
#（umask 077；openssl genrsa 1024 >nginx.pri)
2.生成证书签署请求
# openssl req -new -key nginx.pri -out nginx.csr
3.CA为签署请求签名
# openssl ca -in nginx.csr -out nginx.crt -days 365

2.开启路由转发

# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
# sysctl -p

3.配置nginx的配置文件 /etc/nginx.conf

#user  nobody;
worker_processes  3;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {
use epoll;
worker_connections  1024;
}

http {
include       mime.types;
default_type  application/octet-stream;

#log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
#                  '$status $body_bytes_sent "$http_referer" '
#                  '"$http_user_agent" "$http_x_forwarded_for"';

#access_log  logs/access.log  main;

sendfile        on;
#tcp_nopush     on;

#keepalive_timeout  0;
keepalive_timeout  65;

#gzip  on;

server {
listen       80;
server_name  localhost;

#charset koi8-r;

#access_log  logs/host.access.log  main;
location / {
root   /var/www/html;
index  index.html index.htm;
}

#error_page  404              /404.html;

error_page   500 502 503 504  /50x.html;
location = /50x.html {
root   html;
}
}

###################具体配置#################################
upstream https {            #定义upstream模块
least_conn;               #调度算法
server  192.168.112.131:80 weight=2  max_fails=4  fail_timeout=1; #
server  127.0.0.1:80  backup;  #本地作为备份服务器
}
# HTTPS server
#
server {
listen       443 ssl;
server_name  localhost;

ssl_certificate      ssl/nginx.crt;  #证书位置
ssl_certificate_key  ssl/nginx.pri;  #私钥位置

ssl_session_cache    shared:SSL:1m;
ssl_session_timeout  5m;

ssl_ciphers  HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers  on;

location / {
proxy_pass    # 反向负载
add_header Real-Server $upstream_addr;  ##响应报文添加rs地址
}
}

}

4.配置RS服务器

略

四、测试