10分钟完成基于IP地址免域名的商密HTTPS改造，让商密测评整改不再头疼

一般选择免费SSL证书单域

注意：申请过程中需要保存RSA和SM2的私钥。

免费SSL证书单域

主域名：8.141.89.22

证书编号(Order #): 1956635926

以下命令需root用户操作

切换到root：

 
su root

一、安装和配置

1. 赋予安装脚本运行权限

 
chmod +x install.sh

2. 执行安装脚本

 
./install.sh

如果报错，执行下面语句：

 
yum install -y pcre pcre-devel

3. 转到nginx配置目录

 
cd /usr/local/nginx/conf

4. 使用vim或其他编辑器配置站点和证书

 
vim nginx.conf 

5. 启动nginx

 
cd /usr/local/nginx/sbin

 
./nginx

二、nginx常用命令说明

1. 测试nginx配置是否成功

 
./nginx -t

2. 修改nginx配置后重新加载

 
./nginx -s reload

三、卸载和清理

 
chmod +x uninstall.sh

 
./uninstall.sh

四、问题

1.

 
./configure: error: the HTTP rewrite module requires the PCRE library.

执行：

 
apt-get install libpcre3-dev

 
yum install -y pcre pcre-devel

Nginx Config配置信息

 
#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    # 站点1
    server {
        listen              443 ssl;
        server_name         8.141.89.22;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3:SM2-WITH-SMS4-SM3:ECDHE-SM2-WITH-SMS4-GCM-SM3:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;

    ssl_verify_client   off;                                  #关闭双向认证，如果需要，则设置为 on

    # RSA证书
    ssl_certificate     /zotrus_nginx/8.141.89.22_cersign/CerSignDVSSLCA_Nginx/8.141.89.22.crt;             # rsa证书路径
    ssl_certificate_key /zotrus_nginx/8.141.89.22_cersign/CerSignDVSSLCA_Nginx/8.141.89.22_rsa.key;                     # rsa证书密钥路径

    # 先签名证书和签名密钥
    ssl_certificate     /zotrus_nginx/8.141.89.22_cersign/8.141.89.22_SM2/8.141.89.22_sm2_sign.crt;   # 商密签名证书路径         
    ssl_certificate_key /zotrus_nginx/8.141.89.22_cersign/8.141.89.22_SM2/8.141.89.22_sm2_sign.key;           # 商密签名证书密钥路径
    # 后加密证书和加密密钥
    ssl_certificate     /zotrus_nginx/8.141.89.22_cersign/8.141.89.22_SM2/8.141.89.22_sm2_encrypt.crt;  # 商密加密证书路径
    ssl_certificate_key /zotrus_nginx/8.141.89.22_cersign/8.141.89.22_SM2/8.141.89.22_sm2_encrypt.key;  # 商密加密证书密钥路径

    ssl_prefer_server_ciphers  on;

    location / {
        root   html;
        index  index.html index.htm;
        }
    }

    # 站点2
    # server {
    #     listen              443 ssl;
    #     server_name         your_domain_name2;

    #     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    #     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3:SM2-WITH-SMS4-SM3:ECDHE-SM2-WITH-SMS4-GCM-SM3:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;

    #     ssl_verify_client   off;                                  #关闭双向认证，如果需要，则设置为 on

    #     # RSA证书
    #     ssl_certificate     /path/to/rsa/certificate;             # rsa证书路径
    #     ssl_certificate_key /path/to/rsa/key;                     # rsa证书密钥路径

    #     # 先签名证书和签名密钥
    #     ssl_certificate     /path/to/sm2/signature/certificate;   # 商密签名证书路径         
    #     ssl_certificate_key /path/to/sm2/signature/key;           # 商密签名证书密钥路径
    #     # 后加密证书和加密密钥
    #     ssl_certificate     /path/to/sm2/encryption/certificate;  # 商密加密证书路径
    #     ssl_certificate_key /path/to/sm2/encryption/certificate;  # 商密加密证书密钥路径

    #     ssl_prefer_server_ciphers  on;

    #     location / {
    #           root   html;
    #           index  index.html index.htm;
    #     }
    # }
}

除Nginx中间件，还支持Tomcat等

其他中间件自行摸索尝试。

商密web服务器

 
https://www.gmssl.cn/gmssl/index.jsp

限制

1. 免费版本每年年底失效，程序会自动退出，需更新库，重新链接。请勿用于正式/生产环境，后果自负。

配置说明
1. 需要先配置商密签名证书/私钥，再配置商密加密证书/私钥
2. 证书及其私钥需要连续配置
3. 商密算法支持ECC-SM4-CBC-SM3、ECDHE-SM4-CBC-SM3、ECC-SM4-GCM-SM3、ECDHE-SM4-GCM-SM3
4. 商密协议内置，无需配置
5. 纯商密也需配置上标准算法（兼容性原因）
6. 商密证书链配置到商密签名证书里面

免费申请地址

 
https://www.cersign.com/free-ssl-certificate.html

Nginx商密算法模块

 
https://dl.zotrus.com/dl/sm2/zotrus_nginx.tar.gz

最终效果图

商密浏览器

 
https://www.zotrus.com/browser

普通浏览器