nginx配置https证书

NET::ERR_CERT_COMMON_NAME_INVALID
证书域名和实际访问的域名要匹配:SAN
证书中增加SAN域名

open ssl

openssl genrsa -out server.key 1024
openssl req -new -x509 -days 3650 -key server.key -out server.crt -subj "/C=CN/ST=mykey/L=mykey/O=mykey/OU=mykey/CN=*.alibaba-inc.com/CN=*.alibaba.net/CN=domain3"

nginx配置

 # HTTPS server
    
    server {
        
        listen       443 ssl;
        server_name  xxxx.alibaba.net;

        ssl_certificate      server.crt;
        ssl_certificate_key  server.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        proxy_set_header Host            $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    
        location ~ / {
           proxy_pass   http://127.0.0.1:7001;
        }

        location = /nginx_status {
            return 200;
        }
    }

结果

在chrome中的正确示例

chrome://net-internals/#hsts

nginx配置https证书

原文：https://www.cnblogs.com/yszzu/p/11188731.html