Linux系统nginx反向代理实现https访问tomcat项目

目标：实现 “https://“ 域名访问tomcat下的项目
环境：centos7（或者其他Linux系统版本）
软件：tomcat9 jdk1.8 nginx1.16
工具：Xftp6(FTP工具) Xshell6(SSH工具)。默认在windows客户端系统下使用，mac os系统另行下载其他ftp工具。

相关软件安装下载：

• Linux 安装JDK1.8环境
• Linux 安装nginx
• Linux安装配置Tomcat
• Xshell6+Xftp6破解版链接：https://pan.baidu.com/s/1SGi5jJDHC-uqllQogyvFVg 提取码：pnw0
• 申请ssl证书，购买域名时各云网站都会有免费证书申请

如果已经安装好上述软件环境+工具了，那么可以看下一步了。

1、把证书下的crt文件和key文件传到 安装路径/nginx/conf下，并修改配置文件nginx.conf，增加以下内容(放在server { listen 80…}之上就行)

   upstream tomcat1 {
    server 127.0.0.1:8080 fail_timeout=0;
}
    server {
        listen 443  default_server ssl;
        server_name www.gjtool.cn;  #修改域名
        ssl on;
        ssl_certificate 2505161_gjtool.cn.pem; #修改证书文件
        ssl_certificate_key 2505161_gjtool.cn.key;  #修改证书文件
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        error_page 497 "https://$host$uri?$args"; #这是跳转Http请求到Https
        location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-Proto https;
                proxy_redirect off;
                proxy_connect_timeout      240;
                proxy_send_timeout         240;
                proxy_read_timeout         240;
                # note, there is not SSL here! plain HTTP is used
                proxy_pass http://tomcat1;  #修改配置，与上面tomcat1一致
        }
    }

2、修改tomcat配置文件 ，安装路径/tomcat8.5.1/conf下，并修改配置文件server.xml修改以下内容。redirectPort改为443，并增加proxyPort=”443”

<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443"
               proxyPort="443" />
<Connector port="8009" protocol="AJP/1.3" redirectPort="443" />

3、重启tomcat，重启nginx，访问域名，OK了。

4、需要部署项目应用，放到tomcat下即可。

5、如果是solo博客需要转https，还需要修改solo/WEB-INF/classes下latke.properties，serverScheme=http改为serverScheme=https

6、如果需要http跳转到https，修改nginx安装路径/nginx/conf下nginx.conf，找到sever 80的，并修改

server {
listen 80;
server_name www.gjtool.cn;
return 301 https://www.gjtool.cn$request_uri;
}

7、如果需要无论什么访问都跳转到www

修改nginx安装路径/nginx/conf下nginx.conf，增加

    server {
        listen 443;
        server_name gjtool.cn;  
     return 301 https://www.gjtool.cn$request_uri;
    }

server {
listen 80;
server_name www.gjtool.cn,gjtool.cn;
return 301 https://www.gjtool.cn$request_uri;
}

最后，放出我的服务器下nginx的配置文件nginx.conf完整内容

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;
   upstream tomcat1 {
    server 127.0.0.1:8080 fail_timeout=0;
}

server {
listen 80;
server_name www.gjtool.cn,gjtool.cn;
return 301 https://www.gjtool.cn$request_uri;
}
    server {
        listen 443;
        server_name gjtool.cn;  
     return 301 https://www.gjtool.cn$request_uri;
    }
    server {
        listen 443  default_server ssl;
        server_name www.gjtool.cn;  #修改域名
        ssl on;
        ssl_certificate 2505161_gjtool.cn.pem; #修改证书文件
        ssl_certificate_key 2505161_gjtool.cn.key;  #修改证书文件
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
        error_page 497 "https://$host$uri?$args"; #这是跳转Http请求到Https
        location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-Proto https;
                proxy_redirect off;
                proxy_connect_timeout      240;
                proxy_send_timeout         240;
                proxy_read_timeout         240;
                # note, there is not SSL here! plain HTTP is used
                proxy_pass http://tomcat1;  #修改配置，与上面tomcat1一致
        }
    }


}