[英]nginx configuration for ssl certificate installation with rails application
I have a site that I built using ruby on rails on nginx server with passenger. 我有一个我在nginx服务器上使用旅客在Rails上使用ruby构建的站点。 My client decided to install ssl certificate.I am a newbie to that kind of issues and I have never did it before and I need to confirm that my sites-enabled/default file is configured properly.
我的客户决定安装ssl证书。我是此类问题的新手,以前从未这样做过,我需要确认是否已正确配置启用站点的默认文件。 My current configuration is :
我当前的配置是:
server {
listen 80;
listen [::]:80 ipv6only=on;
server_name www.mysite.com;
passenger_enabled on;
rails_env production;
root /home/directory;
# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
and for adding ssl certificate, I will add another server block like below: 为了添加ssl证书,我将添加另一个服务器块,如下所示:
server {
listen 443;
server_name www.mysite.com;
passenger_enabled on;
rails_env production;
root /home/directory;
ssl on;
ssl_certificate /etc/ssl/my_certificate;
ssl_certificate_key /etc/ssl/my_private_key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_prefer_server_ciphers on;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_stapling on
# redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
is that a right way and parameters to configure nginx or I need to combine them in one server block ? 这是配置nginx的正确方法和参数,还是我需要将它们组合在一个服务器块中?
is there any thing missing should I add to the previous config ? 我应该添加到以前的配置中缺少什么吗?
in the : server_name www.mysite.com;
在:
server_name www.mysite.com;
can I replace it with my IP address instead of the domain name ? 我可以用我的IP地址代替域名代替它吗?
Thanks for your time in advance 谢谢你的时间
You can have HTTP and HTTPS servers in the same server section 您可以在同一服务器部分中拥有HTTP和HTTPS服务器
server { listen 80; listen [::]:80 ipv6only=on; listen 443 ssl; ... }
For complete SSL related configuration I would recommend to use Mozilla generator 对于完整的SSL相关配置,我建议使用Mozilla生成器
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.