Nginx Tomcat http 强制跳转https ssl crt key

user  www www;

worker_processes auto;

error_log  /home/wwwlogs/nginx_error.log  crit;

pid        /usr/local/nginx/logs/nginx.pid;

#Specifies the value for maximum file descriptors that can be opened by this process.

worker_rlimit_nofile 51200;

events

    {

        use epoll;

        worker_connections 51200;

        multi_accept on;

    }

http

    {

        include       mime.types;

        default_type  application/octet-stream;

        server_names_hash_bucket_size 128;

        client_header_buffer_size 32k;

        large_client_header_buffers 4 32k;

        client_max_body_size 50m;

        sendfile on;

        tcp_nopush     on;

        keepalive_timeout 60;

        tcp_nodelay on;

        fastcgi_connect_timeout 300;

        fastcgi_send_timeout 300;

        fastcgi_read_timeout 300;

        fastcgi_buffer_size 64k;

        fastcgi_buffers 4 64k;

        fastcgi_busy_buffers_size 128k;

        fastcgi_temp_file_write_size 256k;

        gzip on;

        gzip_min_length  1k;

        gzip_buffers     4 16k;

        gzip_http_version 1.0;

        gzip_comp_level 2;

        gzip_types       text/plain application/x-javascript text/css application/xml;

        gzip_vary on;

        gzip_proxied        expired no-cache no-store private auth;

        gzip_disable        "MSIE [1-6]\.";

        server_tokens off;

        log_format  access  '$remote_addr - $remote_user [$time_local] "$request" '

        '$status $body_bytes_sent "$http_referer" '

        '"$http_user_agent" $http_x_forwarded_for';

server

    {

            listen       80;

            server_name 192.168.1.150;

            index index.html index.htm index.php default.html default.htm default.php;

            root        /home/wwwroot/default;

location /logs {

 alias ../logs;

 #Nginx日志目录

 

 autoindex on;

 #打开目录浏览功能

 

 autoindex_exact_size off;

 #默认为on，显示出文件的确切大小，单位是bytes

 #显示出文件的大概大小，单位是kB或者MB或者GB

 

 autoindex_localtime on;

 #默认为off，显示的文件时间为GMT时间。

 #改为on后，显示的文件时间为文件的服务器时间

 

 add_header Cache-Control no-store;

 #让浏览器不保存临时文件

}

location /status {

   stub_status on;

   access_log /usr/local/nginx/logs/status.log;    #日志

   auth_basic "NginxStatus";            

}

            location ~ \.php($|/) {

                fastcgi_pass   unix:/tmp/php-cgi.sock;

                fastcgi_index  index.php;

                fastcgi_split_path_info ^(.+\.php)(.*)$;

                fastcgi_param   PATH_INFO $fastcgi_path_info;

                fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;

                include        fastcgi_params;

            }

            location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$

                    {

                            expires      30d;

                    }

            location ~ .*\.(js|css)?$

                    {

                            expires      12h;

                    }

            if (!-e $request_filename) {

                rewrite ^/(.*)$ /index.php/$1 last;

                break;

            }

    }

upstream httpsTest{
ip_hash;
server 172.16.16.48:8010;
}
server{
listen 8900;
server_name  172.16.14.26;
server_name_in_redirect off;
location / {
proxy_pass http://httpsTest; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# client_max_body_size 1024m;
proxy_set_header Host $http_host;
}
}

  upstream qixin_http{

        ip_hash;

        server 172.16.14.26:8800;

      #server 172.16.16.47:80;
server 172.16.14.26:9900;
server 172.16.14.26:7700;

    }

upstream tomcat_https {

   server 172.16.14.26:7443 fail_timeout=0;

   server 172.16.14.26:8443 fail_timeout=0;

   server 172.16.14.26:9443 fail_timeout=0;

}

# HTTPS server

server {

    listen       443 ssl;

    server_name  172.16.14.26;

   #server_name  tomcat_https;
ssl on;

    ssl_certificate      /usr/local/nginx/conf/bonc.buruohuainian.cn.bundle.crt;

    ssl_certificate_key  /usr/local/nginx/conf/bonc.buruohuainian.cn.key;

    ssl_session_cache    shared:SSL:1m;

    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;

    ssl_prefer_server_ciphers  on;

    location / {

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header Host $http_host;

        proxy_set_header X-Forwarded-Proto https;

        proxy_set_header X-Real-IP $remote_addr;  
proxy_headers_hash_max_size 51200;
proxy_headers_hash_bucket_size 6400;

        proxy_redirect off;

        proxy_connect_timeout      240;

        proxy_send_timeout         240;

        proxy_read_timeout         240;

        # note, there is not SSL here! plain HTTP is used

        proxy_pass https://tomcat_https;
    }

}

    server {

        listen       8010;

        server_name  qixin_http;

# rewrite ^(.*)$ https://$host:443 permanent;   

        return 301 https://$host:2611$request_uri;
        server_name_in_redirect off;

        #location / {

        #    root   html;

        #    index  index.html index.htm;

        #}

location /logs {

 alias ../logs;

 #Nginx日志目录

 autoindex on;

 #打开目录浏览功能

 autoindex_exact_size off;

 #默认为on，显示出文件的确切大小，单位是bytes

 #显示出文件的大概大小，单位是kB或者MB或者GB

 autoindex_localtime on;

 #默认为off，显示的文件时间为GMT时间。

 #改为on后，显示的文件时间为文件的服务器时间

 add_header Cache-Control no-store;

 #让浏览器不保存临时文件

}

location /status {

   stub_status on;

   access_log /usr/local/nginx/logs/status.log;    #日志

   auth_basic "NginxStatus";            

}

        location / {

            proxy_pass http://qixin_http;   #来自jsp请求交给tomcat处理

            proxy_redirect off;

            proxy_set_header Host $http_host;    #后端的Web服务器可以通过X-Forwarded-For获取用户真实IP

            proxy_set_header X-Real-IP $remote_addr;

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            client_max_body_size 10m;   #允许客户端请求的最大单文件字节数

            client_body_buffer_size 128k; #缓冲区代理缓冲用户端请求的最大字节数

            proxy_connect_timeout 90;   #nginx跟后端服务器连接超时时间(代理连接超时)

            proxy_read_timeout 90;      #连接成功后，后端服务器响应时间(代理接收超时)

            proxy_buffer_size 4k;       #设置代理服务器（nginx）保存用户头信息的缓冲区大小

            proxy_buffers 6 32k;        #proxy_buffers缓冲区，网页平均在32k以下的话，这样设置

            proxy_busy_buffers_size 64k;#高负荷下缓冲大小（proxy_buffers*2）

            proxy_temp_file_write_size 64k; #设定缓存文件夹大小，大于这个值，将从upstream服务器传

        }

        error_page   500 502 503 504  /50x.html;

        location = /50x.html {

            root   html;

        }

    }

}