Let's Encrypt: self-signed certificate

Official web page

https://letsencrypt.org/docs/certificates-for-localhost/

步驟

• mkdir https_keys
• 複製上述網頁中的openssl指令(我會複製一份在最底下)，並在https_keys中執行
• 會產生localhost.crt、localhost.key兩個檔案
• sudo vim /etc/nginx/conf.d/all_site.conf 打開.conf檔並仿照certbot一樣寫入下列兩行
  • ssl_certificate /home/burwei/https_keys/localhost.crt;
  • ssl_certificate_key /home/burwei/https_keys/localhost.key;
• 這兩行寫完，上面把listen 80;改成listen 443 ssl;就完成了
• P.S. /etc/nginx/conf.d/是CentOS8的位置，Ubuntu的位置不一樣，但一樣是在/etc/nginx下的某個資料夾中

openssl 指令

不用理解直接複製後執行 會產生兩個檔案 localhost.crt跟localhost.key

openssl req -x509 -out localhost.crt -keyout localhost.key \
  -newkey rsa:2048 -nodes -sha256 \
  -subj '/CN=localhost' -extensions EXT -config <( \
   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")

nginx config file

在/etc/nginx/conf.d/下新增了一個all_site.conf

server{
        #listen to https port on IPv4 and IPv6 
        listen 443 ssl;
        #server config
        server_name         192.168.43.35;
        server_tokens off;

        ssl_certificate /home/burwei/https_keys/localhost.crt;
        ssl_certificate_key /home/burwei/https_keys/localhost.key;

        #reverse proxy to express (mern_boilerplate: ./backend/api_server/app.js )
        location /api {
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_pass http://127.0.0.1:9000;
        }
}