Nginx+SSL实现双向认证的示例代码

cd /etc/nginx
mkdir ssl
cd ssl

openssl genrsa -out ca.key 2048

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

openssl genrsa -out server.pem 1024
openssl rsa -in server.pem -out server.key

openssl req -new -key server.pem -out server.csr

openssl x509 -req -sha256 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 3650 -out server.crt

server {
    listen 443;
    server_name usb.dev;

    index index.html;

    root /data/test/;

    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_client_certificate /etc/nginx/ssl/ca.crt;
    ssl_verify_client on;
}

ip地址 usb.dev

openssl pkcs12 -export -clcerts -in client.crt -inkey client.pem -out client.p12