一、服务端证书制作（针对B/S项目）

1.在Centos7上新建一个空目录，创建mySsl.conf的配置文件，包含如下内容：

[ req ]
default_bits    = 2048
distinguished_name = req_distinguished_name
req_extensions   = req_ext

[ req_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = cn
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = sc
localityName         = Locality Name (eg, city)
localityName_default     = cd
organizationName       = Organization Name (eg, company)
organizationName_default   = my
organizationalUnitName       = Organizational Unit Name (eg, section)
organizationalUnitName_default   = as
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_max        = 64
commonName_default      = yang.com

[ req_ext ]
subjectAltName = @alt_names

# 可配置多域名，用于访问的域名或ip一定要包含在此列表
[alt_names]
IP.1   = 192.168.50.62 # 服务端主机ip
DNS.1  = yang.com # 服务端域名1
DNS.2  = yang.net # 服务端域名2

2.依次执行下列命令生成服务端证书：

penssl genrsa -out server.key 2048
openssl req -new -sha256 -out server.csr -key server.key -config mySsl.conf
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt -extensions req_ext -extfile mySsl.conf

二、Nginx证书配置

# 前端项目部署http
server {
    listen    80;
    server_name  front;
    return 301 https://$host$request_uri;  # 自动将80的请求转发到443
}

# 前端项目部署https
server {
	ssl on;
	listen    443 ssl;
	server_name  front;

	keepalive_timeout 100;
	ssl_session_timeout 10M;
	ssl_session_cache shared:SSL:10M;

	ssl_certificate  \\myconf\\ssl\\server.crt;
	ssl_certificate_key \\myconf\\ssl\\server.key;

	location / {
		root  D:\\zzCloudDvd\\outer\\dist\\;
		index  index.html index.htm;
	}
	
	error_page  500 502 503 504  /50x.html;
        location = /50x.html {
        root  html;
	} 
}

# 后端接口反向代理
server {
	ssl on;
	listen    8881 ssl;
	server_name  back;	
	keepalive_timeout 100;
	
 	ssl_session_timeout 10M;
	ssl_session_cache shared:SSL:10M;

	ssl_certificate  \\myconf\\ssl\\server.crt;
	ssl_certificate_key \\myconf\\ssl\\server.key;

	location / {
		proxy_pass http://192.168.50.62:8880;
	}
}

三、浏览器端配置

1. 在浏览器本地双击server.crt文件，将证书安装到【受信任的根证书颁发机构下】。
2. 修改浏览器本地hosts文件，将证书包含的域名映射到服务端的ip。
3. 使用PostMan等客户端工具测试https接口时，由于没有在客户端配证书，所以需要关闭PostMan的ssl功能方可请求成功。