<p><br></p><h3>1.&nbsp;pfx 파일을 crt 및 rsa로 변환</h3><p>아래와 같은 명령어로 crt, rsa 파일 생성</p><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;"><div>openssl&nbsp;pkcs12&nbsp;-in&nbsp;ssl.mysite.com.pfx&nbsp;&nbsp;-clcerts&nbsp;-nokeys&nbsp;-out&nbsp;ssl.mysite.com.crt</div><div>openssl&nbsp;pkcs12&nbsp;-in&nbsp;ssl.mysite.com.pfx&nbsp;-nocerts&nbsp;-nodes&nbsp;-out&nbsp;ssl.mysite.com.rsa</div></div><p><br></p><h3>2. 파일 복사</h3><p>나는 /etc/nginx/ssl 폴더에 복사했다.</p><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;">cp&nbsp;-r&nbsp;./ssl/&nbsp;/etc/nginx/ssl</div><p><br></p><p>/etc/nginx/ssl 이동해서 권한 변경</p><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;">chmod&nbsp;775&nbsp;*</div><p><br></p><h3>3. nginx.conf 수정</h3><p>redirect 부분과 인증서 설정 부분을 잘 보자.</p><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Consolas, &quot;Courier New&quot;, monospace; font-size: 14px; line-height: 19px; white-space: pre;"><div><span style="color: #6a9955;">#&nbsp;nginx.conf</span></div><br><div>user&nbsp;&nbsp;nginx;</div><div>worker_processes&nbsp;&nbsp;1;</div><br><div>error_log&nbsp;&nbsp;/var/log/nginx/error.log&nbsp;warn;</div><div>pid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/var/run/nginx.pid;</div><br><br><div>events&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;worker_connections&nbsp;&nbsp;1024;</div><div>}</div><br><br><div>http&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/etc/nginx/mime.types;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;default_type&nbsp;&nbsp;application/octet-stream;</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #6a9955;">#&nbsp;이동할&nbsp;대상</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;upstream&nbsp;nwkim&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server&nbsp;10.2.10.65:8080&nbsp;max_fails=3&nbsp;fail_timeout=2s;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;keepalive&nbsp;1024;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;keepalive_requests&nbsp;10240;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;keepalive_timeout&nbsp;120;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;}</div><div>&nbsp;&nbsp;&nbsp;&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #6a9955;">#&nbsp;SSL&nbsp;redirect</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;server&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;listen&nbsp;80&nbsp;default_server;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;listen&nbsp;[::]:80;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server_name&nbsp;_;&nbsp;&nbsp;&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #c586c0;">return</span>&nbsp;301&nbsp;https://<span style="color: #9cdcfe;">$host</span>:8443<span style="color: #9cdcfe;">$request_uri</span>;&nbsp;&nbsp;&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;}</div><div>&nbsp;&nbsp;&nbsp;&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;server&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;listen&nbsp;8443&nbsp;ssl&nbsp;default_server;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;listen&nbsp;[::]:8443&nbsp;ssl;</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server_name&nbsp;localhost;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;charset&nbsp;utf-8;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;client_max_body_size&nbsp;1G;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #6a9955;">#&nbsp;nwkim&nbsp;이라는&nbsp;주소를&nbsp;없애주기&nbsp;위해서&nbsp;location을&nbsp;두&nbsp;개&nbsp;설정하고&nbsp;하나는&nbsp;리다이렉트&nbsp;시킨다</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location&nbsp;/nwkim&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #c586c0;">return</span>&nbsp;302&nbsp;/nwkim/;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;location&nbsp;/nwkim/&nbsp;{</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_pass&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://nwkim/;&nbsp;<span style="color: #6a9955;">#&nbsp;마지막에&nbsp;/를&nbsp;꼭&nbsp;써주어야&nbsp;정상적으로&nbsp;포워딩&nbsp;됨</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_redirect&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;off;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp;Host&nbsp;<span style="color: #9cdcfe;">$host</span>;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp;X-Real-IP&nbsp;<span style="color: #9cdcfe;">$remote_addr</span>;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp;X-Forwarded-For&nbsp;<span style="color: #9cdcfe;">$proxy_add_x_forwarded_for</span>;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp;Authorization&nbsp;<span style="color: #9cdcfe;">$http_authorization</span>;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_pass_header&nbsp;&nbsp;Authorization;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #6a9955;">#&nbsp;ssl&nbsp;인증서&nbsp;설정</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl&nbsp;on;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl_certificate&nbsp;&nbsp;&nbsp;&nbsp;/etc/nginx/ssl/dspf.doctorsoft.co.kr.crt;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ssl_certificate_key&nbsp;&nbsp;&nbsp;&nbsp;/etc/nginx/ssl/dspf.doctorsoft.co.kr.rsa;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;}</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;log_format&nbsp;&nbsp;main&nbsp;&nbsp;<span style="color: #ce9178;">'$remote_addr&nbsp;-&nbsp;$remote_user&nbsp;[$time_local]&nbsp;"$request"&nbsp;'</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #ce9178;">'$status&nbsp;$body_bytes_sent&nbsp;"$http_referer"&nbsp;'</span></div><div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #ce9178;">'"$http_user_agent"&nbsp;"$http_x_forwarded_for"'</span>;</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;access_log&nbsp;&nbsp;/var/log/nginx/access.log&nbsp;&nbsp;main;</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;sendfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;on;</div><div>&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #6a9955;">#tcp_nopush&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;on;</span></div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;keepalive_timeout&nbsp;&nbsp;65;</div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #6a9955;">#gzip&nbsp;&nbsp;on;</span></div><br><div>&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;/etc/nginx/conf.d/*.conf;</div><div>}</div><br><br></div><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p>

[nginx] HTTPS SSL 인증서 적용