配置完https后，服务起不来

Question

Answer 1

慕村1342571 2019-01-02 11:40:08

参考网上的方法，或者直接用老师后面的方法，就是不用输入密码那种，貌似是可以。

步骤1：openssl genrsa -des3 -out ca.key 2048

步骤2：openssl rsa -in ca.key -out ca.key

步骤3：openssl req -new -key zhaoy6.key -out ca.csr

步骤4：openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt

步骤5：

nginx -tc /etc/nginx/nginx.conf

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

• Jeson #1

  你用密码的，用的哪种方式，方便的话，可以同样记录下你的操作步骤，我找时间复现下？

• 慕村1342571 回复 Jeson #2

  回复 Jeson老师：
  openssl version
  OpenSSL 1.0.2k-fips  26 Jan 2017 
  问题复现，按照视频操作：
  1、生成Key 
  openssl genrsa -idea -out ca.key 1024 输入简单密码 如123456
  2、生成证书签名请求文件
  openssl req -new -key ca.key -out ca.csr
  Enter pass phrase for ca.key:  刚才输入的密码
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) [XX]:CN
  State or Province Name (full name) []:SiChuan
  Locality Name (eg, city) [Default City]:ChengDu
  Organization Name (eg, company) [Default Company Ltd]:UNICOM
  Organizational Unit Name (eg, section) []:INFO
  Common Name (eg, your name or your server's hostname) []:ca.com
  Email Address []:[e-mail]
  
  Please enter the following 'extra' attributes
  to be sent with your certificate request
  A challenge password []:                           留空
  An optional company name []:UNICOM

• 慕村1342571 #3

  3、生成证书签名文件
  openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt
  Signature ok
  subject=/C=CN/ST=SiChuan/L=ChengDu/O=UNICOM/OU=INFO/CN=ca.com/emailAddress=[e-mail]
  Getting Private key
  Enter pass phrase for ca.key: 输入刚才的密码
  
  4、验证
  nginx -tc /etc/nginx/nginx.conf 
  nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/conf.d/ssl_key/ca.key") failed (SSL: error:0906B072:PEM routines:PEM_get_EVP_CIPHER_INFO:unsupported encryption error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)
  nginx: configuration file /etc/nginx/nginx.conf test failed

Answer 2

慕村1342571 2019-01-02 11:25:11

nginx -tc /etc/nginx/nginx.conf

nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/conf.d/ssl_key/zhaoy6.key") failed (SSL: error:0906B072:PEM routines:PEM_get_EVP_CIPHER_INFO:unsupported encryption error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)

nginx: configuration file /etc/nginx/nginx.conf test failed

按照操作，报SSL签名错误

Answer 3

Jeson 2017-12-18 20:52:49

可以截个清楚图给我吗？这个图它小了，看不清楚。

• 提问者 慕虎3033596 #1

  2017/12/18 17:20:57 [emerg] 2470#2470: SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl_key/jesonc.key") failed (SSL: error:0906406D:PEM routines:PEM_def_callback:problems getting password error:0906A068:PEM routines:PEM_do_header:bad password read error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)

• 提问者 慕虎3033596 #2

  2017/12/18 17:20:57 [emerg] 2470#2470: SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl_key/jesonc.key") failed (SSL: error:0906406D:PEM routines:PEM_def_callback:problems getting password error:0906A068:PEM routines:PEM_do_header:bad password read error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)

• 提问者 慕虎3033596 #3

  报这个错