ssl - NGINX http ://example. com 到 https ://www. example.com 重写，如何？

Question

我最近购买了一个 SSL 证书，想要试用。我还第一次创建了 VPS 服务器，经过多次斗争和愤怒的管理，我成功地在 Ubuntu 14.04 上安装了 LEMP 和 NGINX，并安装了 SSL 证书。我的网站是wknet.se .

现在，我想重写 url:

----------------------------------------------------------------
|             From                 |              To           |
----------------------------------------------------------------
|   http://wknet.se                |   https://www.wknet.se    |
|   http://wknet.se/index.php      |   https://www.wknet.se    |
|   http://www.wknet.se/index.php  |   https://www.wknet.se    |
|   wknet.se                       |   https://www.wknet.se    |
|   wknet.se/index.php             |   https://www.wknet.se    |
|   www.wknet.se/index.php         |   https://www.wknet.se    |
|   https://wknet.se               |   https://www.wknet.se    |
|   https://wknet.se/index.php     |   https://www.wknet.se    |
----------------------------------------------------------------

经过多次试验和错误以及几个毁灭性的小时后，我只剩下 2 次重写来修复:

----------------------------------------------------------------
|             From                 |              To           |
----------------------------------------------------------------
|   https://wknet.se               |   https://www.wknet.se    |
|   https://wknet.se/index.php     |   https://www.wknet.se    |
----------------------------------------------------------------

现在，我不知道如何修复它们!我用谷歌搜索了又用谷歌搜索，我已经测试了几个很好的 NGINX 重写规则，但我还没有弄明白。

这是我第一次在 NGINX 上处理 SSL、重写规则等。

现在，这就是我的服务器设置的样子 wknet.se :

server {
   listen 80 default_server;
   listen [::]:80 default_server ipv6only=on;

   add_header Strict-Transport-Security max-age=15768000;
   return 301 https://www.wknet.se$request_uri; 
}
server {
   listen 443 ssl;
   server_name www.wknet.se;

   root /var/www/wknet.se/html;
   index index.php index.html index.htm;

   ssl_certificate /etc/nginx/ssl/SSL.CRT;
   ssl_certificate_key /etc/nginx/ssl/KEY.KEY;

   ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
   ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
   ssl_prefer_server_ciphers on;

   error_page 404 /404.html;
   error_page 500 502 503 504 /50x.html;

   location / {
      try_files $uri $uri/ =404;
   }

   location = /50x.html {
      root /usr/share/nginx/html;
   }

   location ~ \.php$ {
      try_files $uri =404;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      fastcgi_pass unix:/var/run/php5-fpm.sock;
      fastcgi_index index.php;
      include fastcgi_params;
   }
   location = /index {
      rewrite ^/index\.(php)$ https://www.wknet.se/ permanent;
   }

   location ~ /\.ht {
      deny all;
   }

   location = /favicon.ico {
      log_not_found off;
      access_log off;
   }

   location = /robots.txt {
      allow all;
      log_not_found off;
      access_log off;
   }

   location ~ /\. { 
      deny all; 
      error_log off; 
      log_not_found off; 
   }

   location ~* .(jpg|jpeg|png|gif|ico|css|js)$ {
      log_not_found off;
      expires 365d;
   }

   location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|png|gif|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
      access_log off;
      log_not_found off;
      expires max;
      add_header Pragma public;
      add_header Cache-Control "public, must-revalidate, proxy-revalidate";
   }

   location ~* \.(7z|ai|class|css|csv|ejs|eps|flv|html?|jar|jpe?g|js|json|lzh|m4a|m4v|mov|mp3|pdf|pict|pls|ps|psd|swf|tiff?|txt|webp)$ {
      access_log off; 
      log_not_found off;
      expires max;
      add_header Pragma public;
      add_header Cache-Control "public, must-revalidate, proxy-revalidate";
   }
}

如果有人能帮我解决这个问题，我会很高兴!此外，如果有人对我的服务器设置提出建议以进行一些改进，这也会有很大帮助，因为我不知道我是否做得正确!

谢谢!

Answer 1

要从 example.com 重定向到 www.example.com，您只需创建一个单独的服务器 block 并相应地设置 server_name .在您的设置中，您将执行以下操作:

server {
    listen 443 ssl;
    server_name wknet.se;

    ssl_certificate /etc/nginx/ssl/SSL.CRT;
    ssl_certificate_key /etc/nginx/ssl/KEY.KEY;

    # OBSOLETE:
    # ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    # ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;

    # Use currently secure protocols
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';

    ssl_prefer_server_ciphers on;

    return 301 https://www.wknet.se$request_uri;
}

以上将重定向所有 https://wknet.se/ ... 请求 https://www.wknet.se/ ...。

对于 https，您需要在 block 中包含 ssl 证书 key (或者如果您的所有服务器都在使用，您可以在 http block 中设置 ssl 证书。同一套)。

附加配置

如果你想重定向 http://wknet.se/ ... 到 http://www.wknet.se/ ... -- 普通的 http 请求到 ssl https 请求 -- 添加一个额外的服务器 block ，监听端口 80 并重定向到端口 443:

server {
    listen 80;
    server_name *.wknet.se wknet.se;
    return 301 https://www.wknet.se$request_uri;
}

以上将重定向 http://wknet.se/ ... 以及对子域的任何请求，如 http://www.wknet.se/ ... 或 http://static.wknet.se/ ... 等到 https://www.wknet.se/ ...。

2015-03-28 修订说明

• 更新了示例代码以使用安全的 SSL 协议(protocol)。原始示例使用已弃用的 SSLv3。根据当前的做法，我用更安全的设置替换了 ssl_protocols 和 ssl_ciphers。