80 lines
2.8 KiB
Plaintext
80 lines
2.8 KiB
Plaintext
worker_processes 1;
|
|
error_log logs/error.log debug;
|
|
pid logs/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include mime.types;
|
|
default_type application/octet-stream;
|
|
sendfile on;
|
|
keepalive_timeout 65;
|
|
|
|
# 国密 HTTPS 服务 - 单向认证
|
|
server {
|
|
listen 8443 ssl;
|
|
server_name localhost;
|
|
|
|
ssl_certificate /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
|
|
ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;
|
|
|
|
# 国密套件优先
|
|
ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
|
|
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
|
|
|
location / {
|
|
default_type text/plain;
|
|
return 200 "GMSSL One-Way Auth OK!\nHost: $host\nCipher: $ssl_cipher\nProtocol: $ssl_protocol\n";
|
|
}
|
|
}
|
|
|
|
# 国密 HTTPS 服务 - 双向认证
|
|
server {
|
|
listen 9443 ssl;
|
|
server_name localhost;
|
|
|
|
ssl_certificate /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
|
|
ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;
|
|
|
|
ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
|
|
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
|
|
|
# 双向认证
|
|
ssl_verify_client on;
|
|
ssl_client_certificate /mnt/d/workbench/gateway2/java-client/certs/ca-sm2-cert.pem;
|
|
|
|
location / {
|
|
default_type text/plain;
|
|
return 200 "GMSSL Two-Way Auth OK!\nHost: $host\nCipher: $ssl_cipher\nProtocol: $ssl_protocol\nClient: $ssl_client_s_dn\n";
|
|
}
|
|
}
|
|
}
|
|
|
|
stream {
|
|
# TCP+SSL 单向认证代理
|
|
server {
|
|
listen 9444 ssl;
|
|
ssl_certificate /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
|
|
ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;
|
|
ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
|
|
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
|
|
|
proxy_pass 127.0.0.1:8080;
|
|
}
|
|
|
|
# TCP+SSL 双向认证代理
|
|
server {
|
|
listen 9445 ssl;
|
|
ssl_certificate /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-cert.pem;
|
|
ssl_certificate_key /mnt/d/workbench/gateway2/java-client/certs/server-sm2-sign-key.pem;
|
|
ssl_ciphers ECDHE-SM2-SM4-GCM-SM3:ECDHE-SM2-SM4-CBC-SM3:TLS_SM4_GCM_SM3:TLS_SM4_CCM_SM3:HIGH:!aNULL:!MD5;
|
|
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
|
|
|
ssl_verify_client on;
|
|
ssl_client_certificate /mnt/d/workbench/gateway2/java-client/certs/ca-sm2-cert.pem;
|
|
|
|
proxy_pass 127.0.0.1:8080;
|
|
}
|
|
} |