Nginx 서버 https를 구성하는 방법

openssl req -newkey rsa:2048 -keyout weizhimiao.cn.key -out weizhimiao.cn.csr

...
http {
 ...
 include /etc/nginx/conf.d/*.conf;

 server {
  ...
 }
}

server{
 listen 443 ssl;
 server_name weizhimiao.cn;

 ssl_certificate /data/secret/1_weizhimiao.cn_bundle.crt;
 ssl_certificate_key /data/secret/weizhimiao.cn.key;
 ssl_prefer_server_ciphers on;
 ssl_protocols tlsv1 tlsv1.1 tlsv1.2;

 ssl_ciphers 'keecdh+ecdsa+aes128 keecdh+ecdsa+aes256 keecdh+aes128 keecdh+aes256 kedh+aes128 kedh+aes256 des-cbc3-sha +sha !anull !enull !low !md5 !exp !dss !psk !srp !kecdh !camellia !rc4 !seed';

 add_header strict-transport-security 'max-age=31536000; preload';
 add_header x-frame-options deny;
 ssl_session_cache shared:ssl:10m;
 ssl_session_timeout 10m;
 keepalive_timeout 70;
 ssl_dhparam /data/secret/dhparam.pem;

 add_header x-content-type-options nosniff;

 add_header x-xss-protection 1;

 root /data/www/weizhimiao.cn;
 index index.html;

 location / {

 }
}

cd /data/secret/
openssl dhparam 2048 -out dhparam.pem

server{
 listen 80;
 server_name weizhimiao.cn;
 return 301 https://weizhimiao.cn$request_uri;
}

nginx -t
enter pem pass phrase:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

nginx -s stop
enter pem pass phrase:
nginx
enter pem pass phrase:

cd /data/secret/
openssl rsa -in weizhimiao.cn.key -out weizhimiao.cn.key.unsecure

server {
 ...
 ssl_certificate /data/secret/1_weizhimiao.cn_bundle.crt;
 ssl_certificate_key /data/secret/weizhimiao.cn.key.unsecure;
 ...
}