Linux系统nginx反向代理实现“https://”访问tomcat项目

  |   0 评论   |   271 浏览

目标:实现 "https://" 域名访问tomcat下的项目
环境:centos7(或者其他Linux系统版本)
软件:tomcat9 jdk1.8 nginx1.16
工具:Xftp6(FTP工具) Xshell6(SSH工具)。默认在windows客户端系统下使用,mac os系统另行下载其他ftp工具。

相关软件安装下载:

如果已经安装好上述软件环境+工具了,那么可以看下一步了。

1、把证书下的crt文件和key文件传到 安装路径/nginx/conf下,并修改配置文件nginx.conf,增加以下内容(放在server { listen 80...}之上就行)

   upstream tomcat1 {
    server 127.0.0.1:8080 fail_timeout=0;
}
    server {
        listen 443  default_server ssl;
        server_name www.gjtool.cn;  #修改域名
        ssl on;
        ssl_certificate 2505161_gjtool.cn.pem; #修改证书文件
        ssl_certificate_key 2505161_gjtool.cn.key;  #修改证书文件
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        error_page 497 "https://$host$uri?$args"; #这是跳转Http请求到Https
        location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-Proto https;
                proxy_redirect off;
                proxy_connect_timeout      240;
                proxy_send_timeout         240;
                proxy_read_timeout         240;
                # note, there is not SSL here! plain HTTP is used
                proxy_pass http://tomcat1;  #修改配置,与上面tomcat1一致
        }
    }

2、修改tomcat配置文件 ,安装路径/tomcat8.5.1/conf下,并修改配置文件server.xml修改以下内容。redirectPort改为443,并增加proxyPort="443"

<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443"
               proxyPort="443" />
<Connector port="8009" protocol="AJP/1.3" redirectPort="443" />

3、重启tomcat,重启nginx,访问域名,OK了。

image.png

4、需要部署项目应用,放到tomcat下即可。

5、如果是solo博客需要转https,还需要修改solo/WEB-INF/classes下latke.properties,serverScheme=http改为serverScheme=https

image.png

6、如果需要http跳转到https,修改nginx安装路径/nginx/conf下nginx.conf,找到sever 80的,并修改

server {
listen 80;
server_name www.gjtool.cn;
return 301 https://www.gjtool.cn$request_uri;
}

7、如果需要无论什么访问都跳转到www

修改nginx安装路径/nginx/conf下nginx.conf,增加

    server {
        listen 443;
        server_name gjtool.cn;  
     return 301 https://www.gjtool.cn$request_uri;
    }

server {
listen 80;
server_name www.gjtool.cn,gjtool.cn;
return 301 https://www.gjtool.cn$request_uri;
}

最后,放出我的服务器下nginx的配置文件nginx.conf完整内容


#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;
   upstream tomcat1 {
    server 127.0.0.1:8080 fail_timeout=0;
}

server {
listen 80;
server_name www.gjtool.cn,gjtool.cn;
return 301 https://www.gjtool.cn$request_uri;
}
    server {
        listen 443;
        server_name gjtool.cn;  
     return 301 https://www.gjtool.cn$request_uri;
    }
    server {
        listen 443  default_server ssl;
        server_name www.gjtool.cn;  #修改域名
        ssl on;
        ssl_certificate 2505161_gjtool.cn.pem; #修改证书文件
        ssl_certificate_key 2505161_gjtool.cn.key;  #修改证书文件
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        error_page 497 "https://$host$uri?$args"; #这是跳转Http请求到Https
        location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-Proto https;
                proxy_redirect off;
                proxy_connect_timeout      240;
                proxy_send_timeout         240;
                proxy_read_timeout         240;
                # note, there is not SSL here! plain HTTP is used
                proxy_pass http://tomcat1;  #修改配置,与上面tomcat1一致
        }
    }


}
--------------------------------
云深不知归处
先沉稳而后爱人

评论

发表评论