nginx与tomcat集成，开启https-CSDN博客

本文链接：https://blog.csdn.net/u014788227/article/details/81705365

本文介绍了如何将Nginx与Tomcat集成，以实现HTTPS服务。Nginx配置中，它监听443端口，处理静态资源，同时将API请求代理到Tomcat。Tomcat配置HTTPS使用8888端口，同时讨论了只通过Nginx配置安全证书的可能性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

先看nginx配置

    upstream tomcat {
        server domain:8888 fail_timeout=0;
    }

    # HTTPS server
    
    server {
        listen       443 ssl;
        server_name  domain;
        ssl on;

        ssl_certificate      /usr/local/nginx/cert/xx.pem;
        ssl_certificate_key  /usr/local/nginx/cert/xx.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
        ##前端库图片还是tomcat处理
        location ^~ /admin/ {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Proto https;
            proxy_redirect off;
            proxy_connect_timeout      240;
            proxy_send_timeout         240;
            proxy_read_timeout         240;
            ##转发到tomcat tomcat对应上面的upstream 
            proxy_pass https://tomcat;
        }
        ##上传的图片交由nginx
        location ~* .*\.(gif|jpg|jpeg|bmp|png|ico|txt|pdf|xls|xlsx|doc)$ {
            root   html;
            index  index.html index.htm;
        }

        ##API交由tomcat
        location / {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Proto https;
            proxy_redirect off;
            proxy_connect_timeout      240;
            proxy_send_timeout         240;
            proxy_read_timeout         240;
            proxy_pass https://tomcat;
        }

        error_page   500 502 503 504  /50x.html;

        error_page 404 /404.html;
    }

接着是tomcat配置

<Connector port="80" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8888" />

	<Connector port="8888"
    protocol="HTTP/1.1"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="/usr/xx.pfx"
    keystoreType="PKCS12"
    keystorePass="xx"
    clientAuth="false"
    SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>


    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8888" />

这里采用的是nginx监听443，对于静态的图片由nginx处理，对于API请求转发交由tomcat处理
nginx与tomcat都配置了安全证书，

http默认80端口 https默认443

这里tomcat 配置https使用的是8888端口

应该也可以只nginx配置安全证书，tomcat只需配置开启ssl