{"id":101573,"date":"2026-09-07T00:37:21","date_gmt":"2026-09-06T16:37:21","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/101573.html"},"modified":"2026-09-07T00:37:21","modified_gmt":"2026-09-06T16:37:21","slug":"nginx-ssl-tls-%e9%85%8d%e7%bd%ae%e5%ae%9e%e6%88%98%ef%bc%9a%e4%bb%8e%e8%af%81%e4%b9%a6%e7%94%9f%e6%88%90%e5%88%b0-https-%e9%83%a8%e7%bd%b2","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/101573.html","title":{"rendered":"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72"},"content":{"rendered":"

\u4e00\u3001\u524d\u8a00<\/h3>\n

SSL\/TLS \u914d\u7f6e\u662f Nginx \u751f\u4ea7\u90e8\u7f72\u4e2d\u5fc5\u4e0d\u53ef\u5c11\u7684\u4e00\u73af\u3002\u672c\u6587\u5c06\u4ece\u81ea\u5efa CA \u5f00\u59cb，\u4e00\u6b65\u6b65\u5b8c\u6210\u8bc1\u4e66\u7b7e\u53d1\u3001Nginx HTTPS \u914d\u7f6e\u3001HTTP\u2192HTTPS \u8df3\u8f6c，\u4ee5\u53ca TLS \u6027\u80fd\u4f18\u5316，\u6700\u540e\u8865\u5145 F5 \u5230 Nginx \u7684\u8bc1\u4e66\u8fc1\u79fb\u8981\u70b9\u3002<\/p>\n

\n

\u4e8c\u3001\u8bc1\u4e66\u4f53\u7cfb\u57fa\u7840<\/h3>\n

\u8bc1\u4e66\u94fe\u7ed3\u6784<\/h4>\n

\u6839\u8bc1\u4e66（CA）
\n \u2514\u2500\u2500 \u4e2d\u95f4\u8bc1\u4e66（Intermediate CA）
\n \u2514\u2500\u2500 \u670d\u52a1\u5668\u8bc1\u4e66（Server Certificate） \u2190 \u914d\u5728 Nginx \u4e0a<\/p>\n

\u4e09\u79cd\u8bc1\u4e66\u7c7b\u578b<\/h4>\n\n\u7c7b\u578b\u8986\u76d6\u8303\u56f4\u9002\u7528\u573a\u666f<\/tr>\n\n\n\n\n
\u5355\u57df\u540d\u8bc1\u4e66<\/td>\n\u4e00\u4e2a\u57df\u540d<\/td>\n\u5355\u4e00\u670d\u52a1<\/td>\n<\/tr>\n
\u901a\u914d\u7b26\u8bc1\u4e66<\/td>\n*.example.com<\/td>\n\u591a\u4e2a\u5b50\u57df\u540d\u5171\u7528<\/td>\n<\/tr>\n
SAN \u8bc1\u4e66<\/td>\n\u591a\u4e2a\u6307\u5b9a\u57df\u540d<\/td>\n\u591a\u57df\u540d\u9700\u8981\u540c\u4e00\u5f20\u8bc1\u4e66<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

\u4e09\u3001\u81ea\u5efa CA \u4e0e\u8bc1\u4e66\u7b7e\u53d1<\/h3>\n

\u7b2c 1 \u6b65：\u751f\u6210 CA \u6839\u8bc1\u4e66<\/h4>\n

# \u751f\u6210 CA \u79c1\u94a5<\/span>
\nopenssl genrsa -out<\/span> ca.key 2048<\/span><\/p>\n

# \u751f\u6210 CA \u6839\u8bc1\u4e66（\u6709\u6548\u671f 10 \u5e74）<\/span>
\nopenssl req -x509<\/span> -new<\/span> -nodes<\/span> -key<\/span> ca.key -days<\/span> 3650<\/span> \\\\<\/span>
\n -subj<\/span> "\/C=CN\/ST=Shanghai\/L=Shanghai\/O=Demo\/CN=Demo CA"<\/span> \\\\<\/span>
\n -out<\/span> ca.crt<\/p>\n

\u7b2c 2 \u6b65：\u751f\u6210\u670d\u52a1\u5668\u8bc1\u4e66<\/h4>\n

# \u751f\u6210\u670d\u52a1\u5668\u79c1\u94a5<\/span>
\nopenssl genrsa -out<\/span> server.key 2048<\/span><\/p>\n

# \u751f\u6210\u8bc1\u4e66\u7b7e\u540d\u8bf7\u6c42（CSR）<\/span>
\nopenssl req -new<\/span> -key<\/span> server.key \\\\<\/span>
\n -subj<\/span> "\/C=CN\/ST=Shanghai\/L=Shanghai\/O=Demo\/CN=nginx.demo"<\/span> \\\\<\/span>
\n -out<\/span> server.csr<\/p>\n

# \u7528 CA \u7b7e\u53d1\u670d\u52a1\u5668\u8bc1\u4e66（\u6709\u6548\u671f 1 \u5e74）<\/span>
\nopenssl x509 -req<\/span> -in<\/span> server.csr -CA<\/span> ca.crt -CAkey<\/span> ca.key \\\\<\/span>
\n -CAcreateserial<\/span> -days<\/span> 365<\/span> -out<\/span> server.crt<\/p>\n

\u7b2c 3 \u6b65：\u751f\u6210\u5b8c\u6574\u8bc1\u4e66\u94fe<\/h4>\n

# \u5408\u5e76\u670d\u52a1\u5668\u8bc1\u4e66\u548c CA \u8bc1\u4e66<\/span>
\ncat<\/span> server.crt ca.crt ><\/span> fullchain.pem<\/p>\n

# \u751f\u6210 DH \u53c2\u6570（\u589e\u5f3a PFS \u5b89\u5168\u6027）<\/span>
\nopenssl dhparam -out<\/span> dhparam.pem 2048<\/span><\/p>\n

\u6587\u4ef6\u7ed3\u6784<\/h4>\n

\/etc\/nginx\/ssl\/
\n\u251c\u2500\u2500 ca.key # CA \u79c1\u94a5（\u59a5\u5584\u4fdd\u7ba1）
\n\u251c\u2500\u2500 ca.crt # CA \u6839\u8bc1\u4e66（\u5ba2\u6237\u7aef\u9700\u8981\u5bfc\u5165）
\n\u251c\u2500\u2500 server.key # \u670d\u52a1\u5668\u79c1\u94a5（\u6743\u9650 600）
\n\u251c\u2500\u2500 server.crt # \u670d\u52a1\u5668\u8bc1\u4e66
\n\u251c\u2500\u2500 server.csr # \u8bc1\u4e66\u7b7e\u540d\u8bf7\u6c42（\u53ef\u5220\u9664）
\n\u251c\u2500\u2500 fullchain.pem # \u670d\u52a1\u5668\u8bc1\u4e66 + CA \u8bc1\u4e66（Nginx \u914d\u7f6e\u7528）
\n\u2514\u2500\u2500 dhparam.pem # DH \u53c2\u6570<\/p>\n

\n

\u56db\u3001Nginx HTTPS \u914d\u7f6e<\/h3>\n

\u5b8c\u6574\u914d\u7f6e<\/h4>\n

# HTTP \u2192 HTTPS \u5f3a\u5236\u8df3\u8f6c
\nserver {
\n listen 8082;
\n server_name localhost;
\n location \/ {
\n return 301 https:\/\/$host:8443$request_uri;
\n }
\n}<\/p>\n

# HTTPS \u4e3b server \u5757
\nserver {
\n listen 8443 ssl http2;
\n server_name localhost;<\/p>\n

# ========== \u8bc1\u4e66\u914d\u7f6e ==========
\n ssl_certificate \/etc\/nginx\/ssl\/fullchain.pem;
\n ssl_certificate_key \/etc\/nginx\/ssl\/server.key;<\/p>\n

# ========== \u534f\u8bae\u548c\u52a0\u5bc6\u5957\u4ef6 ==========
\n ssl_protocols TLSv1.2 TLSv1.3; # \u7981\u7528 TLS 1.0\/1.1
\n ssl_ciphers HIGH:!aNULL:!MD5; # \u9ad8\u5f3a\u5ea6\u52a0\u5bc6\u5957\u4ef6
\n ssl_prefer_server_ciphers on;<\/p>\n

# ========== DH \u53c2\u6570（\u589e\u5f3a PFS \u5b89\u5168\u6027） ==========
\n ssl_dhparam \/etc\/nginx\/ssl\/dhparam.pem;<\/p>\n

# ========== \u4f1a\u8bdd\u7f13\u5b58（\u63d0\u5347\u6027\u80fd） ==========
\n ssl_session_cache shared:SSL:10m; # \u5171\u4eab\u7f13\u5b58 10MB
\n ssl_session_timeout 10m; # \u4f1a\u8bdd\u8d85\u65f6 10 \u5206\u949f<\/p>\n

# ========== HSTS（\u5f3a\u5236\u6d4f\u89c8\u5668\u7528 HTTPS） ==========
\n add_header Strict-Transport-Security "max-age=63072000" always;<\/p>\n

# ========== \u54cd\u5e94\u5185\u5bb9 ==========
\n root \/var\/www\/nginx-review;
\n index index.html;<\/p>\n

location \/ {
\n default_type text\/plain;
\n return 200 "HTTPS \u8fde\u63a5\u6210\u529f！\u8bc1\u4e66\u7531 Nginx \u7ec8\u6b62\\\\n";
\n }
\n}<\/p>\n

\n

\u4e94\u3001\u9a8c\u8bc1 HTTPS<\/h3>\n

\u6d4b\u8bd5\u547d\u4ee4<\/h4>\n

# \u6d4b\u8bd5 HTTPS \u8fde\u63a5<\/span>
\ncurl<\/span> -k<\/span> https:\/\/localhost:8443\/
\n# \u8f93\u51fa：HTTPS \u8fde\u63a5\u6210\u529f！\u8bc1\u4e66\u7531 Nginx \u7ec8\u6b62<\/span><\/p>\n

# \u67e5\u770b TLS \u7248\u672c\u548c\u52a0\u5bc6\u5957\u4ef6<\/span>
\ncurl<\/span> -kv<\/span> https:\/\/localhost:8443\/ 2<\/span>><\/span>&1<\/span> |<\/span> grep<\/span> -E<\/span> "SSL|TLS|cipher"<\/span><\/p>\n

# \u6d4b\u8bd5 HTTP\u2192HTTPS \u8df3\u8f6c<\/span>
\ncurl<\/span> -I<\/span> http:\/\/localhost:8082\/
\n# \u8f93\u51fa：HTTP\/1.1 301 Moved Permanently<\/span>
\n# Location: https:\/\/localhost:8443\/<\/span><\/p>\n

\u9a8c\u8bc1\u7ed3\u679c<\/h4>\n\n\u6d4b\u8bd5\u9879\u547d\u4ee4\u9884\u671f\u7ed3\u679c<\/tr>\n\n\n\n\n\n\n
HTTPS \u8bbf\u95ee<\/td>\ncurl -k https:\/\/localhost:8443\/<\/td>\n200 OK<\/td>\n<\/tr>\n
TLS \u7248\u672c<\/td>\ncurl -kv<\/td>\nTLSv1.3<\/td>\n<\/tr>\n
\u52a0\u5bc6\u5957\u4ef6<\/td>\ncurl -kv<\/td>\nAES_256_GCM_SH384<\/td>\n<\/tr>\n
HTTP \u8df3\u8f6c<\/td>\ncurl -I http:\/\/localhost:8082\/<\/td>\n301 \u2192 HTTPS<\/td>\n<\/tr>\n
HSTS \u5934<\/td>\ncurl -I -k https:\/\/localhost:8443\/<\/td>\nStrict-Transport-Security \u5b58\u5728<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

\u516d\u3001F5 \u5230 Nginx \u7684\u8bc1\u4e66\u8fc1\u79fb<\/h3>\n

\u7b2c 1 \u6b65：\u4ece F5 \u5bfc\u51fa\u8bc1\u4e66<\/h4>\n

# \u767b\u5f55 F5<\/span>
\ntmsh list sys crypto cert example.com.crt ><\/span> \/tmp\/example.com.crt
\ntmsh list sys crypto key example.com.key ><\/span> \/tmp\/example.com.key<\/p>\n

\u7b2c 2 \u6b65：\u9a8c\u8bc1\u8bc1\u4e66<\/h4>\n

# \u68c0\u67e5\u6709\u6548\u671f<\/span>
\nopenssl x509 -in<\/span> example.com.crt -dates<\/span> -noout<\/span><\/p>\n

# \u68c0\u67e5\u8bc1\u4e66\u94fe<\/span>
\nopenssl verify -untrusted<\/span> ca-chain.crt example.com.crt<\/p>\n

# \u9a8c\u8bc1\u79c1\u94a5\u548c\u8bc1\u4e66\u662f\u5426\u5339\u914d<\/span>
\nopenssl x509 -in<\/span> example.com.crt -pubkey<\/span> |<\/span> openssl md5
\nopenssl pkey -in<\/span> example.com.key -pubkey<\/span> |<\/span> openssl md5
\n# \u4e24\u4e2a MD5 \u503c\u5fc5\u987b\u4e00\u81f4<\/span><\/p>\n

\u7b2c 3 \u6b65：\u5728 Nginx \u4e0a\u914d\u7f6e<\/h4>\n

server {
\n listen 443 ssl http2;
\n server_name example.com;<\/p>\n

ssl_certificate \/etc\/nginx\/certs\/example.com.crt;
\n ssl_certificate_key \/etc\/nginx\/certs\/example.com.key;
\n ssl_trusted_certificate \/etc\/nginx\/certs\/ca-chain.crt; # \u5f88\u591a\u4eba\u6f0f\u8fd9\u4e2a！<\/p>\n

# \u6216\u8005\u5408\u5e76\u5230\u4e00\u4e2a\u6587\u4ef6
\n ssl_certificate \/etc\/nginx\/certs\/fullchain.pem;
\n ssl_certificate_key \/etc\/nginx\/certs\/fullchain.pem;
\n}<\/p>\n

\u8fc1\u79fb\u5bf9\u6bd4<\/h4>\n\n\u5bf9\u6bd4\u9879F5Nginx<\/tr>\n\n\n\n\n\n\n\n
\u8bc1\u4e66\u5b58\u50a8<\/td>\n\u6570\u636e\u5e93（\/config\/filestore\/）<\/td>\n\u6587\u4ef6\u7cfb\u7edf<\/td>\n<\/tr>\n
\u8bc1\u4e66\u683c\u5f0f<\/td>\nPEM\/DER\/PKCS12<\/td>\nPEM<\/td>\n<\/tr>\n
\u79c1\u94a5\u5b89\u5168<\/td>\n\u52a0\u5bc6\u5b58\u50a8（secure_path）<\/td>\n\u6587\u4ef6\u6743\u9650 600<\/td>\n<\/tr>\n
\u8bc1\u4e66\u94fe<\/td>\nProfile \u4e2d\u81ea\u52a8\u914d\u7f6e<\/td>\n\u9700\u8981\u624b\u52a8\u914d\u6216\u5408\u5e76<\/td>\n<\/tr>\n
\u66f4\u65b0\u65b9\u5f0f<\/td>\n\u91cd\u65b0\u5bfc\u5165 + \u66f4\u65b0 Profile<\/td>\n\u66ff\u6362\u6587\u4ef6 + reload<\/td>\n<\/tr>\n
\u8bc1\u4e66\u5339\u914d\u9a8c\u8bc1<\/td>\n\u81ea\u52a8\u6821\u9a8c<\/td>\n\u8bed\u6cd5\u68c0\u67e5\u65f6\u6821\u9a8c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u5e38\u89c1\u5751<\/h4>\n

\u5751 1：\u8bc1\u4e66\u94fe\u7f3a\u5931<\/p>\n

\u9519\u8bef：curl: (6) SSL certificate problem: unable to get local issuer certificate
\n\u539f\u56e0：\u6ca1\u6709\u914d\u7f6e ssl_trusted_certificate \u6216 chain \u672a\u5408\u5e76
\n\u89e3\u51b3：cat server.crt ca-chain.crt > fullchain.pem<\/p>\n

\u5751 2：\u79c1\u94a5\u5bc6\u7801\u4fdd\u62a4<\/p>\n

\u5982\u679c F5 \u5bfc\u5165\u65f6\u8bbe\u4e86\u5bc6\u7801，Nginx \u4e0d\u652f\u6301 reload \u65f6\u8f93\u5165\u5bc6\u7801
\n\u89e3\u51b3：openssl rsa -in encrypted.key -out decrypted.key<\/p>\n

\n

\u4e03\u3001TLS \u914d\u7f6e\u4f18\u5316<\/h3>\n

\u5b89\u5168\u914d\u7f6e<\/h4>\n

# \u6700\u9ad8\u5b89\u5168\u7ea7\u522b
\nssl_protocols TLSv1.2 TLSv1.3;
\nssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
\nssl_ecdh_curve prime256v1:secp384r1;
\nssl_prefer_server_ciphers on;
\nssl_session_cache shared:SSL:10m;
\nssl_session_timeout 10m;
\nssl_session_tickets off;<\/p>\n

\u6027\u80fd\u914d\u7f6e<\/h4>\n\n\u914d\u7f6e\u9879\u4f5c\u7528\u5efa\u8bae\u503c<\/tr>\n\n\n\n\n\n
ssl_session_cache<\/td>\n\u590d\u7528 TLS \u4f1a\u8bdd，\u51cf\u5c11\u5b8c\u6574\u63e1\u624b<\/td>\nshared:SSL:10m（\u7ea6 8 \u4e07\u4e2a\u4f1a\u8bdd）<\/td>\n<\/tr>\n
ssl_session_timeout<\/td>\n\u4f1a\u8bdd\u7f13\u5b58\u6709\u6548\u671f<\/td>\n10m<\/td>\n<\/tr>\n
ssl_buffer_size<\/td>\n\u6570\u636e\u5757\u5927\u5c0f<\/td>\n4k（\u9ed8\u8ba4）<\/td>\n<\/tr>\n
ssl_early_data<\/td>\n0-RTT（TLS 1.3）<\/td>\n\u8c28\u614e\u5f00\u542f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

\u516b\u3001\u751f\u4ea7\u5efa\u8bae<\/h3>\n
  • \u751f\u4ea7\u73af\u5883\u4f7f\u7528\u6b63\u5f0f CA \u7b7e\u53d1\u7684\u8bc1\u4e66，\u4e0d\u8981\u7528\u81ea\u7b7e\u540d\u8bc1\u4e66<\/li>\n
  • \u901a\u914d\u7b26\u8bc1\u4e66 *.example.com \u53ea\u80fd\u8986\u76d6\u4e00\u7ea7\u5b50\u57df\u540d，\u4e0d\u80fd\u8986\u76d6 dev.www.example.com<\/li>\n
  • \u8bc1\u4e66\u5230\u671f\u524d 30 \u5929\u5f00\u59cb\u9884\u8b66，\u914d\u7f6e\u81ea\u52a8\u7eed\u671f（Let\u2019s Encrypt + certbot）<\/li>\n
  • HSTS \u5fc5\u987b\u914d\u7f6e，\u9632\u6b62 SSL Strip \u653b\u51fb<\/li>\n
  • OCSP Stapling \u5fc5\u987b\u5f00\u542f，\u63d0\u5347 TLS \u63e1\u624b\u901f\u5ea6<\/li>\n
  • TLS 1.0\/1.1 \u5fc5\u987b\u7981\u7528，\u5b58\u5728\u5df2\u77e5\u5b89\u5168\u6f0f\u6d1e<\/li>\n
    \n

    \u4e0b\u4e00\u7bc7： Nginx \u4e3b\u52a8\u5065\u5eb7\u68c0\u67e5\u5b9e\u73b0：Python \u811a\u672c\u5b88\u62a4\u8fdb\u7a0b\u5b9e\u6218<\/p>\n","protected":false},"excerpt":{"rendered":"

    \u4e00\u3001\u524d\u8a00
    \nSSL\/TLS \u914d\u7f6e\u662f Nginx \u751f\u4ea7\u90e8\u7f72\u4e2d\u5fc5\u4e0d\u53ef\u5c11\u7684\u4e00\u73af\u3002\u672c\u6587\u5c06\u4ece\u81ea\u5efa CA \u5f00\u59cb，\u4e00\u6b65\u6b65\u5b8c\u6210\u8bc1\u4e66\u7b7e\u53d1\u3001Nginx HTTPS \u914d\u7f6e\u3001HTTP\u2192HTTPS \u8df3\u8f6c，\u4ee5\u53ca TLS \u6027\u80fd\u4f18\u5316，\u6700\u540e\u8865\u5145 F5 \u5230 Nginx \u7684\u8bc1\u4e66\u8fc1\u79fb\u8981\u70b9\u3002\u4e8c\u3001\u8bc1\u4e66\u4f53\u7cfb\u57fa\u7840
    \n\u8bc1\u4e66\u94fe\u7ed3\u6784
    \n\u6839\u8bc1\u4e66（CA）\u2514\u2500\u2500 \u4e2d\u95f4\u8bc1\u4e66（Intermediate CA）\u2514\u2500\u2500 \u670d\u52a1\u5668\u8bc1\u4e66（Ser<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,117,606,44],"topic":[],"class_list":["post-101573","post","type-post","status-publish","format-standard","hentry","category-server","tag-https","tag-nginx","tag-ssl","tag-44"],"yoast_head":"\nNginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/101573.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u4e00\u3001\u524d\u8a00 SSL\/TLS \u914d\u7f6e\u662f Nginx \u751f\u4ea7\u90e8\u7f72\u4e2d\u5fc5\u4e0d\u53ef\u5c11\u7684\u4e00\u73af\u3002\u672c\u6587\u5c06\u4ece\u81ea\u5efa CA \u5f00\u59cb，\u4e00\u6b65\u6b65\u5b8c\u6210\u8bc1\u4e66\u7b7e\u53d1\u3001Nginx HTTPS \u914d\u7f6e\u3001HTTP\u2192HTTPS \u8df3\u8f6c，\u4ee5\u53ca TLS \u6027\u80fd\u4f18\u5316，\u6700\u540e\u8865\u5145 F5 \u5230 Nginx \u7684\u8bc1\u4e66\u8fc1\u79fb\u8981\u70b9\u3002\u4e8c\u3001\u8bc1\u4e66\u4f53\u7cfb\u57fa\u7840 \u8bc1\u4e66\u94fe\u7ed3\u6784 \u6839\u8bc1\u4e66（CA）\u2514\u2500\u2500 \u4e2d\u95f4\u8bc1\u4e66（Intermediate CA）\u2514\u2500\u2500 \u670d\u52a1\u5668\u8bc1\u4e66（Ser\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/101573.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-06T16:37:21+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/101573.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/101573.html\",\"name\":\"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-06T16:37:21+00:00\",\"dateModified\":\"2026-09-06T16:37:21+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/101573.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/101573.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/101573.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/101573.html","og_locale":"zh_CN","og_type":"article","og_title":"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u4e00\u3001\u524d\u8a00 SSL\/TLS \u914d\u7f6e\u662f Nginx \u751f\u4ea7\u90e8\u7f72\u4e2d\u5fc5\u4e0d\u53ef\u5c11\u7684\u4e00\u73af\u3002\u672c\u6587\u5c06\u4ece\u81ea\u5efa CA \u5f00\u59cb，\u4e00\u6b65\u6b65\u5b8c\u6210\u8bc1\u4e66\u7b7e\u53d1\u3001Nginx HTTPS \u914d\u7f6e\u3001HTTP\u2192HTTPS \u8df3\u8f6c，\u4ee5\u53ca TLS \u6027\u80fd\u4f18\u5316，\u6700\u540e\u8865\u5145 F5 \u5230 Nginx \u7684\u8bc1\u4e66\u8fc1\u79fb\u8981\u70b9\u3002\u4e8c\u3001\u8bc1\u4e66\u4f53\u7cfb\u57fa\u7840 \u8bc1\u4e66\u94fe\u7ed3\u6784 \u6839\u8bc1\u4e66（CA）\u2514\u2500\u2500 \u4e2d\u95f4\u8bc1\u4e66（Intermediate CA）\u2514\u2500\u2500 \u670d\u52a1\u5668\u8bc1\u4e66（Ser","og_url":"https:\/\/www.wsisp.com\/helps\/101573.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-06T16:37:21+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/101573.html","url":"https:\/\/www.wsisp.com\/helps\/101573.html","name":"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-06T16:37:21+00:00","dateModified":"2026-09-06T16:37:21+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/101573.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/101573.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/101573.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Nginx SSL\/TLS \u914d\u7f6e\u5b9e\u6218\uff1a\u4ece\u8bc1\u4e66\u751f\u6210\u5230 HTTPS \u90e8\u7f72"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/101573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=101573"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/101573\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=101573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=101573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=101573"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=101573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}