Centos7.2下Nginx配置SSL支持https访问(站点是基于.Net Core2.0开发的WebApi)

准备工作

1.基于nginx部署好的站点(本文站点是基于.Net Core2.0开发的WebApi,有兴趣的同学可以跳http://www.cnblogs.com/GreedyL/p/7422796.html)

2.证书颁发机构（CA）颁发的有效证书,其中我们需要两个文件,一个是 .key文件(私钥)，另一个是 .crt或.pem文件(公钥)

核心配置

HTTP Strict-Transport-Security

nginx -V

vi etc/nginx/proxy.conf

proxy_redirect             off;
proxy_set_header         Host             $host;
proxy_set_header        X-Real-IP         $remote_addr;
proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
proxy_set_header    X-Forwarded-Proto $scheme;
client_max_body_size     10m;
client_body_buffer_size 128k;
proxy_connect_timeout     90;
proxy_send_timeout         90;
proxy_read_timeout         90;
proxy_buffers            32 4k;

http

server

vi /etc/nginx/nginx.conf

http {
include    /etc/nginx/proxy.conf;
limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
server_tokens off;

sendfile on;
keepalive_timeout 29; # Adjust to the lowest possible value that makes sense for your use case.
client_body_timeout 10; client_header_timeout 10; send_timeout 10;

upstream hellomvc{
server localhost:5000;
}

server {
listen *:80;
add_header Strict-Transport-Security max-age=15768000;
return 301 https://$host$request_uri; }

server {
listen *:443    ssl;
server_name     example.com;
ssl_certificate /etc/ssl/certs/testCert.crt;
ssl_certificate_key /etc/ssl/certs/testCert.key;
ssl_protocols TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on; #ensure your cert is capable
ssl_stapling_verify on; #ensure your cert is capable

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

#Redirects all traffic
location / {
proxy_pass  http://hellomvc; limit_req   zone=one burst=10;
}
}
}

有几处需要更改

一些安全配置

防止Clickjacking(点击劫持),Clickjacking是一种恶意技术来收集受感染的用户的点击。劫持受害者（访问者）点击感染的网站,使用X-FRAME-OPTIONS。

vi /etc/nginx/nginx.conf

将配置中的
add_header X-Frame-Options DENY;
更改为
add_header X-Frame-Options SAMEORIGIN;

service nginx reload

MIME类型的嗅探,此标头防止大多数浏览器从声明的内容类型中嗅探响应，因为标头指示浏览器不要覆盖响应内容类型,使用

nosniff

选项

vi /etc/nginx/nginx.conf

添加行
add_header X-Content-Type-Options nosniff;