前端配置

  1. 找到云厂商的ssl证书管理版面

image-20260318135556065

  1. 下载云厂商申请的免费证书：

image-20260318135518355

  1. 把在云厂商申请到的ssl证书指定格式通过scp传送到自己的云服务器：
1
2
3
scp -r *.pem *.key ubuntu@公网ip:/etc/nginx/ssl

scp *.pem *.key ubuntu@134.175.7.57:/etc/nginx/ssl

如下图所示位置，没有文件夹可以自己创建一个新的

image-20260318134845207

如果ssh文件夹访问受限，也可以先上传到根目录，在用sudo权限移动到ssl文件夹下

1
2
3
4
5
scp *.pem *.key ubuntu@134.175.7.57:~

cd ~

sudo mv *.pem *.key /etc/nginx/ssl

image-20260318140908068

image-20260318141031810

  1. 然后在需要的添加ssl层的应用的.conf文件中增加ssl配置，以我的考试服务系统为例，我为我的考试服务系统增加了exam-system.wlwhonest.top的域名解析，同时通过配置server对ssl证书的验证如下：

image-20260318141220534

1
2
3
4
5
6
7
8
9
10
11
server {
    listen 443 ssl;
    server_name exam-system.wlwhonest.top;   # 需要修改的地方
    ssl_certificate     /etc/nginx/certs/your-cert.crt;  #上传证书到指定的位置
    ssl_certificate_key /etc/nginx/certs/your-cert.key;  #上传证书到指定的位置
    root /var/www/exam-system/dist;   # 改成自己上传的编译好的dist文件夹位置
    index index.html;
    location / {
        try_files $uri /index.html;
    }
}
1
2
ssl_certificate     /etc/nginx/ssh/exam-system.wlwhonest.top_bundle.pem;  
ssl_certificate_key /etc/nginx/ssh/exam-system.wlwhonest.top.key;
  1. 最后验证一下nginx配置，然后重载：
1
2
sudo nginx -t
sudo systemctl reload nginx

后端配置

如果你有同一域名下的后端服务，也需要进行修改配置，原来如下图：

image-20260318142120456

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
server {
    listen 80;
    server_name exam-system.wlwhonest.top;

    root /var/www/exam-system/dist;
    index index.html;

    location / {
        try_files $uri /index.html;
    }

    # 如果你有统一的后端网关，可以在这里做反向代理
    # 例如，把 /api 转发到后端（按实际端口改）
# user 服务 -> 3001
    location /api/user-service/ {
        proxy_pass http://127.0.0.1:3001/;
    }
    # exam 服务 -> 3002
    location /api/exam-service/ {
        proxy_pass http://127.0.0.1:3002/;
    }
    # answer 服务 -> 3003
    location /api/answer-service/ {
        proxy_pass http://127.0.0.1:3003/;
    }
    # analyse 服务 -> 3004
    location /api/analyse-service/ {
        proxy_pass http://127.0.0.1:3004/;
    } 
}

server {
    listen 443 ssl;
    server_name exam-system.wlwhonest.top;   # 需要修改的地方
    ssl_certificate     /etc/nginx/ssl/exam-system.wlwhonest.top_bundle.pem;  #上传证>书到指定的位置
    ssl_certificate_key /etc/nginx/ssl/exam-system.wlwhonest.top.key;  #上传证书到指定的位置    
    root /var/www/exam-system/dist;   # 改成自己上传的编译好 的dist文件夹位置
    index index.html;
    location / {
        try_files $uri /index.html;
    }
}

改之后，全面跳转到https

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# HTTP -> HTTPS
server {
    listen 80;
    server_name exam-system.wlwhonest.top;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name exam-system.wlwhonest.top;

    ssl_certificate     /etc/nginx/ssl/exam-system.wlwhonest.top_bundle.pem;
    ssl_certificate_key /etc/nginx/ssl/exam-system.wlwhonest.top.key;

    root /var/www/exam-system/dist;
    index index.html;

    location / {
        try_files $uri /index.html;
    }

    # user -> 3001
    location /api/user-service/ {
        proxy_pass http://127.0.0.1:3001/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # exam -> 3002
    location /api/exam-service/ {
        proxy_pass http://127.0.0.1:3002/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # answer -> 3003
    location /api/answer-service/ {
        proxy_pass http://127.0.0.1:3003/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # analyse -> 3004
    location /api/analyse-service/ {
        proxy_pass http://127.0.0.1:3004/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

最后也不要忘记检测和重载