Knowledge/1 使用/Windows/Nginx + 铜锁编译指南.md

我来详细介绍一下如何将铜锁（Tongsuo）作为 OpenSSL 替代与 Nginx 进行编译的完整过程。

1. 环境准备

安装编译依赖

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install -y build-essential libpcre3 libpcre3-dev zlib1g-dev

# CentOS/RHEL
sudo yum install -y gcc make pcre-devel zlib-devel

2. 编译铜锁（Tongsuo）

下载铜锁源代码

# 从 GitHub 下载最新版本
git clone https://github.com/Tongsuo-Project/Tongsuo.git
cd Tongsuo

# 或者下载特定版本（如 8.3.3）
wget https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/8.3.3.tar.gz
tar -xzf 8.3.3.tar.gz
cd Tongsuo-8.3.3

编译安装铜锁

# 配置编译选项
./config --prefix=/usr/local/tongsuo \
         --openssldir=/usr/local/tongsuo/ssl \
         enable-ntls \
         enable-weak-ssl-ciphers

# 编译并安装
make -j$(nproc)
sudo make install

# 配置动态库路径
echo "/usr/local/tongsuo/lib" | sudo tee /etc/ld.so.conf.d/tongsuo.conf
sudo ldconfig

# 验证安装
/usr/local/tongsuo/bin/openssl version

3. 编译 Nginx 使用铜锁

下载 Nginx 源代码

# 下载最新稳定版 Nginx
wget http://nginx.org/download/nginx-1.24.0.tar.gz
tar -xzf nginx-1.24.0.tar.gz
cd nginx-1.24.0

配置 Nginx 编译参数

# 基本配置
./configure \
    --prefix=/usr/local/nginx \
    --with-http_ssl_module \
    --with-http_v2_module \
    --with-http_stub_status_module \
    --with-stream \
    --with-stream_ssl_module \
    --with-openssl=/usr/local/tongsuo \
    --with-openssl-opt="enable-ntls enable-weak-ssl-ciphers" \
    --with-cc-opt="-I/usr/local/tongsuo/include" \
    --with-ld-opt="-L/usr/local/tongsuo/lib"

编译并安装

make -j$(nproc)
sudo make install

4. NTLS（国密双证书）配置示例

Nginx 配置文件

server {
    listen 443 ssl;
    server_name example.com;
    
    # 国际标准 TLS 证书（RSA/ECC）
    ssl_certificate /path/to/rsa.crt;
    ssl_certificate_key /path/to/rsa.key;
    
    # 国密证书
    ssl_certificate /path/to/sm2_sign.crt;
    ssl_certificate_key /path/to/sm2_sign.key;
    ssl_enc_certificate /path/to/sm2_enc.crt;
    ssl_enc_certificate_key /path/to/sm2_enc.key;
    
    # 启用 NTLS
    ssl_enable_ntls on;
    
    # 密码套件配置
    ssl_ciphers "ECC-SM2-WITH-SM4-SM3:ECDHE-SM2-WITH-SM4-SM3";
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    
    # 其他配置...
}

5. 编译脚本示例

完整的自动化脚本

#!/bin/bash
# nginx-tongsuo-build.sh

set -e

# 版本配置
TONGSUO_VERSION="8.3.3"
NGINX_VERSION="1.24.0"
INSTALL_DIR="/usr/local"

# 下载并编译铜锁
echo "正在下载铜锁 ${TONGSUO_VERSION}..."
cd /tmp
wget -q https://github.com/Tongsuo-Project/Tongsuo/archive/refs/tags/${TONGSUO_VERSION}.tar.gz
tar -xzf ${TONGSUO_VERSION}.tar.gz
cd Tongsuo-${TONGSUO_VERSION}

echo "编译铜锁..."
./config --prefix=${INSTALL_DIR}/tongsuo \
         --openssldir=${INSTALL_DIR}/tongsuo/ssl \
         enable-ntls \
         enable-weak-ssl-ciphers \
         shared
make -j$(nproc)
sudo make install
sudo ldconfig

# 下载并编译 Nginx
echo "正在下载 Nginx ${NGINX_VERSION}..."
cd /tmp
wget -q http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
tar -xzf nginx-${NGINX_VERSION}.tar.gz
cd nginx-${NGINX_VERSION}

echo "配置 Nginx..."
./configure \
    --prefix=${INSTALL_DIR}/nginx \
    --with-http_ssl_module \
    --with-http_v2_module \
    --with-http_stub_status_module \
    --with-stream \
    --with-stream_ssl_module \
    --with-openssl=${INSTALL_DIR}/tongsuo \
    --with-openssl-opt="enable-ntls" \
    --with-cc-opt="-I${INSTALL_DIR}/tongsuo/include" \
    --with-ld-opt="-L${INSTALL_DIR}/tongsuo/lib"

echo "编译 Nginx..."
make -j$(nproc)
sudo make install

# 创建服务文件
echo "创建 systemd 服务..."
cat << EOF | sudo tee /etc/systemd/system/nginx.service
[Unit]
Description=NGINX with Tongsuo
After=network.target

[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/usr/local/nginx/sbin/nginx -s quit
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

echo "安装完成！"
echo "Nginx 路径: ${INSTALL_DIR}/nginx/sbin/nginx"
echo "铜锁路径: ${INSTALL_DIR}/tongsuo/bin/openssl"

6. Docker 编译示例

# Dockerfile
FROM ubuntu:20.04 AS builder

# 安装依赖
RUN apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y \
    build-essential libpcre3-dev zlib1g-dev wget git

# 编译铜锁
RUN git clone https://github.com/Tongsuo-Project/Tongsuo.git /tongsuo && \
    cd /tongsuo && \
    ./config --prefix=/opt/tongsuo enable-ntls && \
    make -j$(nproc) && \
    make install

# 编译 Nginx
RUN wget http://nginx.org/download/nginx-1.24.0.tar.gz && \
    tar -xzf nginx-1.24.0.tar.gz && \
    cd nginx-1.24.0 && \
    ./configure \
        --prefix=/opt/nginx \
        --with-http_ssl_module \
        --with-stream_ssl_module \
        --with-openssl=/opt/tongsuo \
        --with-openssl-opt="enable-ntls" && \
    make -j$(nproc) && \
    make install

# 运行时镜像
FROM ubuntu:20.04
COPY --from=builder /opt /opt
RUN ldconfig
CMD ["/opt/nginx/sbin/nginx", "-g", "daemon off;"]

7. 验证和测试

# 验证 Nginx 版本
/usr/local/nginx/sbin/nginx -V

# 查看是否包含铜锁支持
/usr/local/nginx/sbin/nginx -V 2>&1 | grep -i tongsuo

# 测试 NTLS 连接
openssl s_client -connect localhost:443 -enable_ntls -ntls

注意事项

1. 版本兼容性：确保铜锁和 Nginx 版本兼容
2. 功能选择：根据需求选择编译的模块
3. 生产环境：建议使用静态链接避免依赖问题
4. 证书管理：国密证书需要专门的 CA 机构签发
5. 性能优化：可以根据服务器硬件调整编译参数

这样编译出来的 Nginx 就支持国密算法和 NTLS 协议了。