1.第一步 先拥有一个域名 ab.abcde.com

2.申请到阿里证书 ab.abcde.com.key , ab.abcde.com.pem

3.修改default.conf 文件

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name 你的域名;

    ssl_certificate .pem文件地址;
    ssl_certificate_key .key文件地址;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    root /usr/share/nginx/html;
    autoindex on;
    index index.html;

    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 9;
    gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_proxied any;

    include /etc/nginx/mime.types;

    location / {
        try_files $uri $uri/ =404;
    }

    location ^~/api/ {
        proxy_pass 后端接口地址;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_connect_timeout 1s;
        proxy_send_timeout 30m;
        proxy_read_timeout 30m;
        proxy_buffering off;
        chunked_transfer_encoding off;
        proxy_cache off;
        client_max_body_size 500m;
    }
location /test {
    return 200 'Hello from HTTPS!';
}
}

如果你想保留你之前的ip访问配置可以这样

server {
        listen 80;
        listen [::]:80;
        server_name _;
        gzip on;
        gzip_min_length 1k;
        gzip_comp_level 9;
        gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
        gzip_vary on;
        gzip_disable "MSIE [1-6]\.";
        root /usr/share/nginx/html;
        include /etc/nginx/mime.types;
        set $my_result_code 200;
        #set $my_server_name your-server-name;
        #if ($http_Host !~* ^your-server-name) {
        #    set $my_result_code 403;
        #}

        #if ($my_server_name ~ "0") {
        #    set $my_result_code 200;
        #}

        if ($my_result_code = 403) {
            return 403;
        }

        location / {
            index  index.html;
        }

        location ^~/api/ {
            if ($request_uri ~* ^/api/(.*)$) {
                proxy_pass 后端地址/$1;
            }
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP  $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_connect_timeout   1;
            proxy_buffering off;
            chunked_transfer_encoding off;
            proxy_cache off;
            proxy_send_timeout      30m;
            proxy_read_timeout      30m;
            client_max_body_size    500m;
        }
    }
# HTTPS Server for dc.chimsen.com

server {
     listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name 域名;

    ssl_certificate /home/XXXX.pem;
    ssl_certificate_key /home/XXXXX.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    root /usr/share/nginx/html;
    autoindex on;
    index index.html;

    gzip on;
    gzip_min_length 1k;
    gzip_comp_level 9;
    gzip_types text/plain text/css text/javascript application/json application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_disable "MSIE [1-6]\.";
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_proxied any;

    include /etc/nginx/mime.types;

    location / {
        try_files $uri $uri/ =404;
    }

    location ^~/api/ {
        proxy_pass 后端地址;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_connect_timeout 1s;
        proxy_send_timeout 30m;
        proxy_read_timeout 30m;
        proxy_buffering off;
        chunked_transfer_encoding off;
        proxy_cache off;
        client_max_body_size 500m;
    }
location /test {
    return 200 'Hello from HTTPS!';
}
}

重启nginx

nginx -s reload

通过域名打开，如果打不开 有可能有一下问题

1.如果证书错误，我们验证一下

1.1是否位置正确

ls -l /home/XXXX.pem
ls -l /home/XXXXX.key

1.2 证书是否正确

为了确保私钥与证书匹配，你可以使用以下命令生成一个指纹，并对比它们是否相同

openssl x509 -noout -modulus -in /home/nginx/xxxxx.pem | openssl md5

openssl rsa -noout -modulus -in /home/nginx/xxxx.key | openssl md5

如果一样说明证书没有问题

2.nginx有问题

2.1 nginx 配置文件没有生效

2.1.1 进入容器里面(如果是容器配置的话需要进入容器查看，虚拟机直接看修改的配置文件即可)

docker exec -it 容器名称 /bin/bash

查看文件

cat /etc/nginx/conf.d/default.conf

如果没有说明没有cp 到执行命令

docker cp /home/nginx/default.conf iot-font:/etc/nginx/conf.d/default.conf

然后重新进入容器查看并重启nginx

nginx -s reload

3.权限问题

3.1 如果是报403 说明很有可能是虚拟机拒绝访问需要配置

sudo setenforce 0

4.端口问题

4.1 看下端口是否有监听

ss -tuln | grep 443

如果没有应该是端口没开放 需要重新关闭docker 并映射443

docker stop XXX
docker rm XXXX
docker run --name 名字 -d -p 80:80 -p 443:443 镜像

成功！！！！！