详解Nginx SSL快速双向认证配置(脚本)

下面我来详细讲解如何快速地配置Nginx SSL双向认证。

1. 前置条件

在配置Nginx SSL双向认证之前，需要满足以下几个前置条件：

• 已经安装了Nginx服务器
• 已经准备好了SSL证书和密钥
• 已经安装了openssl工具和expect脚本

2. 创建SSL证书

首先，需要创建SSL证书和密钥。你可以使用openssl工具来创建自签名证书和密钥，具体操作如下：

# 创建私钥
openssl genrsa -out server.key 2048

# 生成证书签名请求文件
openssl req -new -key server.key -out server.csr

# 创建自签名证书
openssl x509 -req -in server.csr -out server.crt -signkey server.key -days 3650

如果你要创建双向认证证书，则还需要为客户端创建相应的证书、密钥和证书签名请求文件，具体操作与上面的步骤类似。

需要注意的是，通常情况下，客户端证书需要在Web服务器端导入，因此需要将客户端证书导出为PKCS12格式，具体操作如下：

# 导出客户端证书和密钥到PKCS12格式文件
openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12

3. 编写SSL认证配置文件

在Nginx服务器上，需要编写SSL认证配置文件。你可以使用下面的代码块作为模板：

# Nginx SSL双向认证配置
server {
    listen 443 ssl;
    server_name your_domain.com;

    # 服务器证书和密钥文件
    ssl_certificate /path/to/server.crt;
    ssl_certificate_key /path/to/server.key;

    # 客户端证书验证
    ssl_client_certificate /path/to/ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;

    location / {
        # your_server_location_settings
    }
}

在上面的代码块中，ssl_client_certificate指令用于指定证书颁发机构的根证书，ssl_verify_client指令用于开启客户端证书验证，ssl_verify_depth指令用于设置证书验证深度。可以根据实际需求来修改这些指令的值。

如果你要为不同的服务器添加SSL认证，则需要在每个服务器的配置文件中添加相应的代码块，除了listen和server_name之外的指令都可以统一设置。

4. 使用脚本快速配置SSL认证

如果你觉得手动编辑配置文件比较麻烦，可以使用下面的脚本进行快速配置：

#!/usr/bin/expect
spawn openssl genrsa -out server.key 2048
expect "Enter pass phrase for server.key:"
send "\n"
expect "Verifying - Enter pass phrase for server.key:"
send "\n"

spawn openssl req -new -key server.key -out server.csr
expect "Country Name (2 letter code) [AU]:"
send "CN\n"
expect "State or Province Name (full name) [Some-State]:"
send "Beijing\n"
expect "Locality Name (eg, city) []:"
send "Beijing\n"
expect "Organization Name (eg, company) [Internet Widgits Pty Ltd]:"
send "Your Company\n"
expect "Organizational Unit Name (eg, section) []:"
send "Your Division\n"
expect "Common Name (e.g. server FQDN or YOUR name) []:"
send "your_domain.com\n"
expect "Email Address []:"
send "your_email@your_domain.com\n"
expect "A challenge password []:"
send "\n"
expect "An optional company name []:"
send "\n"

spawn openssl x509 -req -in server.csr -out server.crt -signkey server.key -days 3650
expect "Enter pass phrase for server.key:"
send "\n"

spawn openssl genrsa -out client.key 2048
expect "Enter pass phrase for client.key:"
send "\n"
expect "Verifying - Enter pass phrase for client.key:"
send "\n"

spawn openssl req -new -key client.key -out client.csr
expect "Country Name (2 letter code) [AU]:"
send "CN\n"
expect "State or Province Name (full name) [Some-State]:"
send "Beijing\n"
expect "Locality Name (eg, city) []:"
send "Beijing\n"
expect "Organization Name (eg, company) [Internet Widgits Pty Ltd]:"
send "Your Company\n"
expect "Organizational Unit Name (eg, section) []:"
send "Your Division\n"
expect "Common Name (e.g. server FQDN or YOUR name) []:"
send "your_domain.com\n"
expect "Email Address []:"
send "your_email@your_domain.com\n"
expect "A challenge password []:"
send "\n"
expect "An optional company name []:"
send "\n"

spawn openssl x509 -req -in client.csr -out client.crt -signkey client.key -days 3650
expect "Enter pass phrase for client.key:"
send "\n"

spawn openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12
expect "Enter pass phrase for client.key:"
send "\n"
expect "Enter Export Password:"
send "\n"

spawn openssl x509 -outform der -in ca.crt -out ca.der
expect "Enter pass phrase for ca.crt:"
send "\n"

spawn expect -c "
set timeout 10
spawn ssh [e-mail]
expect \"password:\"
send \"your-password\n\"
expect \"*# \"
send \"cd /etc/nginx/\n\"
expect \"*# \"
send \"ls\n\"
expect \"*# \"
send \"exit\n\"
expect \"closed.\"
"

spawn scp *.p12 [e-mail]:/etc/nginx/
expect "password:"
send "your-password\n"

spawn scp server.* [e-mail]:/etc/nginx/
expect "password:"
send "your-password\n"

spawn scp nginx.conf [e-mail]:/etc/nginx/
expect "password:"
send "your-password\n"

spawn scp client.* [e-mail]:/etc/nginx/
expect "password:"
send "your-password\n"

spawn scp ca.der [e-mail]:/etc/nginx/
expect "password:"
send "your-password\n"

spawn ssh [e-mail]
expect "password:"
send "your-password\n"
expect "*# "
send "mv server.crt /etc/pki/tls/certs/\n"
expect "*# "
send "mv server.key /etc/pki/tls/private/\n"
expect "*# "
send "mv client.crt /etc/pki/tls/certs/\n"
expect "*# "
send "mv client.key /etc/pki/tls/private/\n"
expect "*# "
send "mv client.p12 /etc/pki/tls/private/\n"
expect "*# "
send "mv ca.der /etc/pki/tls/certs/\n"
expect "*# "
send "exit\n"
expect "closed."

上面的脚本可以自动生成SSL证书和密钥，并将其上传到服务器上，同时还可以修改Nginx的配置文件。需要修改脚本中的IP地址、密码和文件路径等参数才能正常运行。

总结

通过以上步骤，你可以快速地配置Nginx SSL双向认证，并在保证安全性的情况下提供Web服务。其中，手动编辑配置文件和使用脚本都是可行的方法，可以根据实际情况选择适合自己的方法。