[英]certbot and nginx subdomain set on centos7
我正在尝试在Centos7服务器上的Nginx中设置一个带有一个子域(暂时)的网站,并由Let's Encrypt的certbot提供ssl加密。
我已经成功安装了nginx,我已经设置了域: example.com
www.example.com
和ci.example.com
并获得了发行的证书,没有任何问题(我的浏览器说“安全”,它会自动从http重定向到https要求。)
现在,我想让ci.example.com
代理到localhost:6500端口(我相信它称为proxy_pass
)。 我尝试过以下内容: 这篇2014年的博客文章,但nginx始终提供标准的“欢迎使用Nginx页面”。
其他所有文章/教程均针对较旧版本的nginx(不使用/etc/nginx/nginx.conf。
这是/etc/nginx/nginx.conf
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
server_name example.com www.example.com;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server {
if ($host = www.example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = ci.example.com) {
return 301 https://$host$request_uri;
} #added by me
listen 80 default_server;
listen [::]:80 default_server;
server_name example.com www.example.com;
return 404; # managed by Certbot
我已经弄清楚了,并将其保存以供后代使用。
在运行certbot --nginx命令之前,我没有正确设置nginx。
这是您应该做的:
从全新安装的Centos 7
通过sudo yum update -y
确保Centos是最新的
然后通过以下方式安装nginx: sudo yum install nginx -y
它是默认设置,但是可以确保它是最新的。
然后按照本指南操作,使不受保护的http://ci.yoursite.com
和http://www.yoursite.com
按需要工作。
注-如果由于以下原因而无法启动Nginx,则有以下问题: [emerg] open() "/usr/share/nginx/logs/ci.yoursite.access.log" failed (13: Permission denied)
使用: su -c "setenforce 0"
它将把SELinux设置为许可模式并允许nginx启动。
然后按照以下步骤操作: 本指南可让我们开始加密和Certbot --nginx。
在此示例中,最终的/etc/nginx/conf.d/ci.yourserver.conf
应该看起来像这样重新路由到端口6500:
server {
server_name ci.example.com;
access_log logs/ci.example.access.log main;
root /var/www/ci.example.com/html;
index index.html index.htm;
location / {
proxy_pass http://localhost:6500;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 150;
proxy_send_timeout 100;
proxy_read_timeout 100;
proxy_buffers 4 32k;
client_max_body_size 8m;
client_body_buffer_size 128k;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/ci.example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/ci.example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = ci.example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
listen [::]:80;
server_name ci.example.com;
return 404; # managed by Certbot
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.