win7 localhost 配置 nginx ssl自签名证书

步骤

1）下载并安装openssl

下载windows版本的openssl解压缩到本地。

下载地址：http://gnuwin32.sourceforge.net/packages/openssl.htm

这里选择的是：Binaries (*.zip)

2）生成ssl证书

进入目录，运行

openssl.exe

，输入如下生成脚本，假设文件生成到

d:/ssl

目录

OpenSSL> req -x509 -out d:/ssl/localhost.crt -keyout d:/ssl/localhost.key -newke
y rsa:2048 -nodes -sha256 -subj '/CN=localhost' -extensions EXT -config d:/ssl/c
onfig.txt -days 2048
Loading 'screen' into random state - done
Generating a 2048 bit RSA private key
.............................................+++
.......................................................................+++
writing new private key to 'd:/ssl/localhost.key'
-----
OpenSSL>
           

其中

d:/ssl/config.txt

内如如下：

[dn]
CN=localhost

[req]
distinguished_name = dn

[EXT]
subjectAltName=DNS:localhost
keyUsage=digitalSignature
extendedKeyUsage=serverAuth
           

支持多个域名的配置：

例子1：http://apetec.com/support/generatesan-csr.htm

例子2：https://medium.com/@pubudu538/how-to-create-a-self-signed-ssl-certificate-for-multiple-domains-25284c91142b

3）更新到nginx的配置localhost.conf

server {
	listen 80;
	listen 443;
	server_name localhost;
	root d:/localhost;
	index index.html index.htm index.php;
	autoindex on;
    autoindex_localtime on;
	
	ssl on;
	ssl_certificate     d:/ssl/localhost.crt;
	ssl_certificate_key d:/ssl/localhost.key;
	
	location ~ \.php$ {
	    fastcgi_pass   php_pool;
	    fastcgi_index  index.php;
	    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
	    include        fastcgi_params;
	}
}
           

再重启nginx，访问 https://localhost

报错

localhost 使用了无效的安全证书。 
该证书因为其自签名而不被信任。
错误代码：MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
           

解决方法：~ 暂无，网上的都是治标不治本的，修改浏览器设置的后果无法解决如下报错。

D:\>php -r "echo file_get_contents('http://localhost/robots.txt');"
Allow: *
D:\>php -r "echo file_get_contents('https://localhost/robots.txt');"

Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error me
ssages:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify faile
d in Command line code on line 1

Call Stack:
    0.0020     350368   1. {main}() Command line code:0
    0.0020     350368   2. file_get_contents() Command line code:1


Warning: file_get_contents(): Failed to enable crypto in Command line code on li
ne 1

Call Stack:
    0.0020     350368   1. {main}() Command line code:0
    0.0020     350368   2. file_get_contents() Command line code:1


Warning: file_get_contents(https://localhost/robots.txt): failed to open stream:
 operation failed in Command line code on line 1

Call Stack:
    0.0020     350368   1. {main}() Command line code:0
    0.0020     350368   2. file_get_contents() Command line code:1


D:\>
           

相关链接

Let’s Encrypt: Certificates for localhost

https://letsencrypt.org/docs/certificates-for-localhost/

How To Create a Self-Signed SSL Certificate for Nginx in Ubuntu 16.04

https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04