1.转换前准备

http转https需要一个证书、本文已ssl证书举例，只有认证的证书才能被认可。阿里云可以申请免费的证书， 但是生成证书需要域名。且域名要绑定ip。故ssl申请前需要域名。可上阿里云购买。

证书申请教程:证书申请

绑定ip:如果没有服务器、也可以用本地ip代替。

 

2.后端spring boot http 转 https

1) 下载对应tomcat证书

2) 将证书移动到spring boot 中的resources文件夹下、配置application.yml或application.properties

application.properties:

#https 端口
server.port: 7001 
#http端口
server.http.port: 7000
# 用的是公司的证书 此处不再提供，请替换成自己的证书
server.ssl.key-store: classpath:xx.pfx
server.ssl.key-store-password: 96XP9E9F
server.ssl.keyStoreType: PKCS12

application.yml

server:
  port: 9004
  http:
    port: 9003
  ssl:
    key-store: classpath:XX.pfx
    key-store-type: PKCS12
    enabled: true
    #密码
    key-store-password: j0B2b291Dd

3) http的端口自动跳转到https端口

HttpsConfig.java

import org.apache.catalina.Context;
import org.apache.catalina.connector.Connector;
import org.apache.tomcat.util.descriptor.web.SecurityCollection;
import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Component;

/**
 * HTTP自动转向HTTPS的配置
 *
 */
@Component
public class HttpsConfig {
    /**
     *  http的端口
     */
    @Value("${server.http.port}")
    private int httpPort;

    /**
     * https的端口
     */
    @Value("${server.port}")
    private int httpsPort;
    @Bean
    public TomcatServletWebServerFactory tomcatServletWebServerFactory() {
        TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection securityCollection = new SecurityCollection();
                securityCollection.addPattern("/*");
                securityConstraint.addCollection(securityCollection);
                context.addConstraint(securityConstraint);
            }
        };
        factory.addAdditionalTomcatConnectors(httpConnector());
        return factory;
    }

    @Bean
    public Connector httpConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        //Connector监听的http的端口号
        connector.setPort(httpPort);
        connector.setSecure(false);
        //监听到http的端口号后转向到的https的端口号
        connector.setRedirectPort(httpsPort);
        return connector;
    }
}

报红是因为当前的域名所对应的ip和服务器ip不一致所致， 将域名对应的IP和服务器ip对应即可解决问题。可通过ping 域名查询域名所对应的地址。

 3.nginx 配置http转https（docker）

nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
	
	
	server { 
        listen       80;    
        server_name www.aaa.bbb.fun;
 rewrite ^(.*)$ https://${server_name}$1 permanent;
	}
	server {
        listen       443 ssl;
         server_name www.aaa.bbb.fun;
 		 ssl_certificate /ssl/6431157_aaa.bbb.fun.pem;
        ssl_certificate_key /ssl/6431157_aaa.bbb.fun.key;
        ssl_session_cache           shared:SSL:10m;
        ssl_session_timeout         5m;
        ssl_protocols               SSLv3 TLSv1.1 TLSv1.2;
        ssl_ciphers                 HIGH:!ADH:!EXPORT56:RC4+RSA:+MEDIUM;
        ssl_prefer_server_ciphers   on;
        location / {
                proxy_set_header            Host $host;  
            proxy_set_header            X-real-ip $remote_addr;  
            proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;  
            root /usr/share/nginx/html;
            index  index.html index.htm;
			add_header Access-Control-Allow-Origin *;
        }
		  error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }


		
    }
}

dokcer运行：

#运行容器
docker run -d  -p 30014:443  --name jsjmh-web -v ~/nginx/jsj/dist:/usr/share/nginx/html -v ~/nginx/jsj/conf/nginx.conf:/etc/nginx/nginx.conf -v ~/nginx/jsj/logs:/var/log/nginx -v  ~/nginx/jsj/ssl:/ssl  nginx

#运行说明
-v ~/nginx/jsj/dist:/usr/share/nginx/html 静态页面挂载
-v ~/nginx/jsj/conf/nginx.conf:/etc/nginx/nginx.conf 配置文件挂载
-v ~/nginx/jsj/logs:/var/log/nginx 日志挂载
-v  ~/nginx/jsj/ssl:/ssl ssl证书挂载