Nginx安装SSL证书实现https

openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr

server { listen 443 ssl http2; server_name www.domain.com; include /etc/nginx/blacklistwjl.conf; root /srv/domain.com; index index.html; ssl_certificate domain.crt; ssl_certificate_key domain.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; error_page 404 /Error.html; access_log /var/log/nginx/domain.com.access.log; error_log /var/log/nginx/domain.com.error.log; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Strict-Transport-Security "max-age=31536000" always; add_header Cache-Control "max-age=31536000"; if ($http_user_agent ~* "(zgrab|sqlmap|nikto|masscan|nmap|acunetix|netsparker|dirbuster)") { return 444; } location ~* (\.env|wp-admin|wp-login|xmlrpc\.php|phpmyadmin|cgi-bin) { return 444; } location ~* \.(php|jsp|asp|aspx|sh|bash|exe|pl|py)$ { return 444; } location ~* (\/\.|(?:\.(?:log|swp|bak|conf|git|env)))$ { return 444; } } server { listen 443 ssl http2; server_name domain.com; include /etc/nginx/blacklistwjl.conf; ssl_certificate domain.crt; ssl_certificate_key domain.key; return 301 https://www.domain.com$request_uri; } server { listen 80; server_name domain.com www.domain.com; include /etc/nginx/blacklistwjl.conf; return 301 https://www.domain.com$request_uri; }

service nginx restart