如何为私有子域名app.myorg-local.net在RHEL9的NGINX上配置SSL/TLS证书

一、先排查现有证书无效的原因 #

• 检查域名匹配：执行openssl x509 -in /path/to/your/cert.crt -text -noout | grep DNS，确认输出包含DNS:app.myorg-local.net
• 检查有效期：openssl x509 -in /path/to/your/cert.crt -text -noout | grep Not，确认证书未过期
• 检查证书链：如果是CA签发的，确保证书文件包含从服务器证书到根CA的完整链

二、重新生成有效的内部SSL证书（OpenSSL方式） #

如果现有证书存在问题，用OpenSSL生成内部CA及服务器证书：

1. 创建CA目录结构：

   mkdir -p ~/ca/{certs,crl,newcerts,private}
   chmod 700 ~/ca/private
   touch ~/ca/index.txt
   echo 1000 > ~/ca/serial
   

2. 创建CA配置文件~/ca/openssl.cnf：

   [ ca ]
   default_ca = CA_default
   
   [ CA_default ]
   dir               = ~/ca
   certs             = $dir/certs
   crl_dir           = $dir/crl
   database          = $dir/index.txt
   new_certs_dir     = $dir/newcerts
   certificate       = $dir/cacert.pem
   serial            = $dir/serial
   crlnumber         = $dir/crlnumber
   crl               = $dir/crl.pem
   private_key       = $dir/private/cakey.pem
   name_opt          = ca_default
   cert_opt          = ca_default
   default_days      = 3650
   default_crl_days  = 30
   default_md        = sha256
   preserve          = no
   policy            = policy_match
   
   [ policy_match ]
   countryName             = match
   stateOrProvinceName     = match
   organizationName        = match
   organizationalUnitName  = optional
   commonName              = supplied
   emailAddress            = optional
   
   [ req ]
   default_bits        = 2048
   distinguished_name  = req_distinguished_name
   string_mask         = utf8only
   
   [ req_distinguished_name ]
   countryName                 = Country Name (2 letter code)
   stateOrProvinceName         = State or Province Name
   localityName               = Locality Name
   organizationName           = Organization Name
   organizationalUnitName     = Organizational Unit Name
   commonName                 = Common Name
   emailAddress               = Email Address
   
   [ v3_ca ]
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid:always,issuer
   basicConstraints = critical, CA:true
   keyUsage = critical, digitalSignature, cRLSign, keyCertSign
   
   [ server_cert ]
   subjectKeyIdentifier = hash
   authorityKeyIdentifier = keyid,issuer
   basicConstraints = CA:FALSE
   keyUsage = critical, digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = app.myorg-local.net
   

3. 生成根CA证书和私钥：

   openssl req -x509 -config ~/ca/openssl.cnf -newkey rsa:2048 -days 3650 -nodes -keyout ~/ca/private/cakey.pem -out ~/ca/cacert.pem
   

   按提示填写信息，Common Name填内部CA名称（如MyOrg Internal CA）
4. 生成服务器证书签名请求（CSR）：

   openssl req -config ~/ca/openssl.cnf -newkey rsa:2048 -nodes -keyout ~/ca/private/app.myorg-local.net.key -out ~/ca/app.myorg-local.net.csr
   

   填写信息时，Common Name必须为app.myorg-local.net
5. 用根CA签发服务器证书：

   openssl ca -config ~/ca/openssl.cnf -extensions server_cert -days 365 -notext -md sha256 -in ~/ca/app.myorg-local.net.csr -out ~/ca/certs/app.myorg-local.net.crt
   

三、安装证书到NGINX #

1. 复制证书和私钥到标准目录：

   sudo cp ~/ca/certs/app.myorg-local.net.crt /etc/pki/tls/certs/
   sudo cp ~/ca/private/app.myorg-local.net.key /etc/pki/tls/private/
   sudo cp ~/ca/cacert.pem /etc/pki/ca-trust/source/anchors/
   

2. 更新系统信任的CA：

   sudo update-ca-trust extract
   

四、配置NGINX的SSL虚拟主机 #

1. 编辑NGINX配置文件（如/etc/nginx/conf.d/app.conf）：

   server {
       listen 443 ssl;
       server_name app.myorg-local.net;
   
       # React应用静态文件目录
       root /var/www/react-app/build;
       index index.html;
   
       # SSL证书配置
       ssl_certificate /etc/pki/tls/certs/app.myorg-local.net.crt;
       ssl_certificate_key /etc/pki/tls/private/app.myorg-local.net.key;
   
       # SSL优化配置
       ssl_protocols TLSv1.2 TLSv1.3;
       ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
       ssl_prefer_server_ciphers off;
   
       # React单页应用路由处理
       location / {
           try_files $uri $uri/ /index.html;
       }
   }
   
   # HTTP重定向到HTTPS
   server {
       listen 80;
       server_name app.myorg-local.net;
       return 301 https://$host$request_uri;
   }
   

2. 验证配置语法：

   sudo nginx -t
   

3. 重启NGINX服务：

   sudo systemctl restart nginx
   

五、客户端信任内部CA（关键步骤） #

内部自签证书需客户端信任根CA才不会提示“无效证书”：

• Linux客户端：复制cacert.pem到/etc/pki/ca-trust/source/anchors/，执行sudo update-ca-trust extract
• Windows客户端：双击cacert.pem，选择“安装证书”→存储位置选“本地计算机”→“将所有证书放入下列存储”→选择“受信任的根证书颁发机构”完成安装
• macOS客户端：双击cacert.pem添加到“钥匙串访问”，找到证书右键“显示简介”，在“信任”选项卡设置“使用此证书时”为“始终信任”

内容的提问来源于stack exchange，提问作者Rajneesh Srivastava