nginx中怎么实现双向认证，很多新手对此不是很清楚，为了帮助大家解决这个难题，下面小编将为大家详细讲解，有这方面需求的人可以来学习下，希望你能有所收获。
客户端证书生成：
1)创建根证私钥
计算
安全
数据库
网络和加速
企业服务
openssl genrsa -out root-key.key 20482)创建根证书请求文件
openssl req -new -out root-req.csr -key root-key.key具体如下
[root@localhost sslKey]# openssl req -new -out root-req.csr -key root-key.key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:bj
Locality Name (eg, city) [Default City]:bj
Organization Name (eg, company) [Default Company Ltd]:dc
Organizational Unit Name (eg, section) []:dc
Common Name (eg, your name or your server's hostname) []:root
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:其中国家,省市,公司等需要和后面的证书保持一致.后面challenge password的地方直接回车就好
3)自签根证书
openssl x509 -req -in root-req.csr -out root-cert.cer -signkey root-key.key -CAcreateserial -days 36504)生成p12格式根证书,密码填写123456
openssl pkcs12 -export -clcerts -in root-cert.cer -inkey root-key.key -out root.p12至此客户端证书生成完毕。
我们得到root-cert.cer 和 root.p12，将root.p12导入至浏览器，在nignx中开启客户端认证
server {
listen 443;
server_name abc.com;
ssl on;
ssl_certificate cert/server.pem;
ssl_certificate_key cert/server.key;
ssl_client_certificate cert/root.cer; #本文生成cer文件
ssl_verify_client on; #开启校验
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
client_max_body_size 10m;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://192.168.0.138:8081;
}
}看完上述内容是否对您有帮助呢？如果还想对相关知识有进一步的了解或阅读更多相关文章，请关注亿速云行业资讯频道，感谢您对亿速云的支持。
亿速云「云服务器」，即开即用、新一代英特尔至强铂金CPU、三副本存储NVMe SSD云盘，价格低至29元/月。点击查看>>
免责声明：本站发布的内容（图片、视频和文字）以原创、转载和分享为主，文章观点不代表本网站立场，如果涉及侵权请联系站长邮箱：is@yisu.com进行举报，并提供相关证据，一经查实，将立刻删除涉嫌侵权内容。
原文链接：https://my.oschina.net/illone/blog/3105032
