跳至主要內容

Nginx 国密SM2 Docker容器构建

itouxin大约 2 分钟

Nginx 国密SM2 Docker容器构建

提示

适用场景：针对CentOS服务器。

镜像构建

当前已发布镜像

  • docker.clzytech.com:1024/nginx-gmssl:1.0.0
    • 支持国密单向
    • 支持国密双向
    • 支持国密/RSA单向自适应

Dockerfile

FROM centos:7
WORKDIR /root
COPY gmssl_openssl_1.1_b8.tar.gz .
ADD nginx-1.18.0.tar.gz .

RUN yum install pcre-devel gcc gcc-c++ zlib-devel automake autoconf libtool make -y
RUN cd /root && tar xzfm gmssl_openssl_1.1_b8.tar.gz -C /usr/local \
    && cd /root/nginx-1.18.0 && sed -i "s/\$OPENSSL\/.openssl\//\$OPENSSL\//g" auto/lib/openssl/conf \
    && ./configure --without-http_gzip_module --with-http_ssl_module --with-http_stub_status_module \
    --with-http_v2_module --with-file-aio --with-openssl="/usr/local/gmssl" --with-cc-opt="-I/usr/local/gmssl/include" --with-ld-opt="-lm" \
    && make install \
    && rm -rf /root/*.tar.gz
ADD rsa /usr/local/nginx/conf/certs/rsa
ADD sm2 /usr/local/nginx/conf/certs/sm2
COPY nginx.conf /usr/local/nginx/conf/nginx.conf
COPY conf.d /usr/local/nginx/conf/conf.d
VOLUME [ "/usr/local/nginx/conf/conf.d" ]
EXPOSE 80 443
CMD [ "sh", "-c", "/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf && tail -f /usr/local/nginx/logs/error.log" ]

gmssl_openssl_1.1_b8.tar.gz 下载地址: gmssl_openssl_1.1_b8.tar.gzopen in new window
nginx-1.18.0.tar.gz 下载地址: nginx-1.18.0.tar.gzopen in new window

默认配置文件

/usr/local/nginx/conf/conf.d/default.conf

server {
    listen       80;
    server_name  localhost;

    #charset koi8-r;

    #access_log  logs/host.access.log  main;

    location / {
        root   html;
        index  index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    #location ~ \.php$ {
    #    root           html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #    deny  all;
    #}
}


# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
#    listen       8000;
#    listen       somename:8080;
#    server_name  somename  alias  another.alias;

#    location / {
#        root   html;
#        index  index.html index.htm;
#    }
#}


# HTTPS server
#
#server {
#    listen       443 ssl;
#    server_name  localhost;

#    ssl_certificate      cert.pem;
#    ssl_certificate_key  cert.key;

#    ssl_session_cache    shared:SSL:1m;
#    ssl_session_timeout  5m;

#    ssl_ciphers  HIGH:!aNULL:!MD5;
#    ssl_prefer_server_ciphers  on;

#    location / {
#        root   html;
#        index  index.html index.htm;
#    }
#}
server {
    listen 0.0.0.0:443 ssl;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;
    ssl_verify_client off;

    ssl_certificate /usr/local/nginx/conf/certs/rsa/rsa.gmssl.clzytech.com.crt.pem;
    ssl_certificate_key /usr/local/nginx/conf/certs/rsa/rsa.gmssl.clzytech.com.key.pem;

    ssl_certificate /usr/local/nginx/conf/certs/sm2/sm2.gmssl.clzytech.com.sig.crt.pem;
    ssl_certificate_key /usr/local/nginx/conf/certs/sm2/sm2.gmssl.clzytech.com.sig.key.pem;

    ssl_certificate /usr/local/nginx/conf/certs/sm2/sm2.gmssl.clzytech.com.enc.crt.pem;
    ssl_certificate_key /usr/local/nginx/conf/certs/sm2/sm2.gmssl.clzytech.com.enc.key.pem;

    location / {
        root html;
        index index.html index.htm;
    }
}

RSA及SM2 证书目录结构

证书目录结构
证书目录结构

效果

Microsoft Edge浏览器访问效果

Microsoft Edge浏览器访问效果
Microsoft Edge浏览器访问效果

360安全浏览器访问效果

360安全浏览器访问效果
360安全浏览器访问效果

配置示例

配置示例(国密单向)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;
  ssl_verify_client off;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

  location /
  {
    root html;
    index index.html index.htm;
  }
}

注释：测试证书使用www.gmcrt.cn签发。

配置示例(国密双向)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;
  ssl_client_certificate /usr/local/nginx/conf/demo1.sm2.trust;
  ssl_verify_client on;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

  location /
  {
    root html;
    index index.html index.htm;
  }
}

注释：测试证书使用www.gmcrt.cn签发，浏览器国密U盾可使用国密U盾伴侣导入证书/私钥。

配置示例(国密/RSA单向自适应)

server
{
  listen 0.0.0.0:443 ssl;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-CBC-SM3:ECC-SM4-GCM-SM3;
  ssl_verify_client off;

  ssl_certificate /usr/local/nginx/conf/demo1.rsa.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.rsa.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;

  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;
  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;

  location /
  {
    root html;
    index index.html index.htm;
  }
}
版权所有 © 2019-present 成理智源科技（成都）有限公司