server {
listen 80;
listen [::]:80;
server_name zhangmingrui.cool;
return 301 https://$host$request_uri;
}
server {
listen 80;
listen [::]:80;
server_name doc.zhangmingrui.cool;
return 301 https://$host$request_uri;
}
说明:此处按域名不同配置了两个虚拟主机,监听ipv4/ipv6网段对80端口的访问;return行的目的是把所有的HTTP请求重定向到https,强制所有的访问都走https模式。
server {
if (!-e $request_filename) {
rewrite ^(.*)$ /index.php$1 last;
}
listen 443 ssl;
server_tokens off;
keepalive_timeout 5;
root /usr/share/nginx/html;
index index.php index.html;
server_name zhangmingrui.cool;
ssl_certificate /etc/nginx/conf.d/zhangmingrui.cool_bundle.crt;
ssl_certificate_key /etc/nginx/conf.d/zhangmingrui.cool.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
ssl_prefer_server_ciphers on;
location ~ \.php(\/.*)*$ {
root /usr/share/nginx/html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
include fastcgi_params;
client_max_body_size 20m;
fastcgi_connect_timeout 30s;
fastcgi_send_timeout 30s;
fastcgi_read_timeout 30s;
fastcgi_intercept_errors on;
}
}
说明:该段配置是启用https功能。
if判断的功能是为了将动态链接伪装成静态链接。
ssl_certificate 与 ssl_certificate_key是配置公私钥,其后跟的是公私钥的存储地址。
评论