一、申请https证书
可以在阿里云申请免费ssl证书，一年更换一次
二、Nginx配置ssl upstream tomcat_web{ server 127.0.0.1:8080; } server { listen 443 ssl; server_name www.xxx.com; ## 配置日志文件 access_log /var/log/nginx/web/xxx-ssl-access.log main; error_log /var/log/nginx/web/xxx-ssl-err.log; ## 配置证书所在目录 ssl_certificate sslkey/www.xxx.com.pem; ssl_certificate_key sslkey/www.xxx.com.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_prefer_server_ciphers on; ssl_session_timeout 1d; ssl_stapling on; ssl_stapling_verify on; ## 重要，否则应用redirect的时候，会跳转到http，这里强制替换成https proxy_redirect https:// $scheme://; location / { root /usr/share/nginx/html; index index.html index.htm; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass https://tomcat_web; proxy_http_version 1.1; ## 以下两个配置如果没配置，websocket会报错，链接时使用wss:// proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; ## 配置上传文件大小 300Mb client_max_body_size 300m; client_body_buffer_size 128k; ## 配置链接超时时间 10分钟 proxy_connect_timeout 600; proxy_read_timeout 600; proxy_send_timeout 600; proxy_buffer_size 64k; proxy_buffers 4 32k; proxy_busy_buffers_size 64k; proxy_temp_file_write_size 64k; } } 二、Nginx配置ssl u
