Zabbix 利用 Nginx 实现 HTTPS 访问

#安装openssl组件
yum install openssl

#生成key
openssl genrsa -out openssl.key 1024
#生成CA crt（用于签署csr）
openssl req -new -x509 -key openssl.key -out ca.crt -days 3650
#生成csr（生成的csr文件交给CA签名后形成服务端证书）
openssl req -new -key openssl.key -out server.csr
#生成crt（CSR文件必须有CA的签名才可形成服务器端证书）
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey openssl.key -CAcreateserial -out server.crt
#参数解释
-CA选项指明用于被签名的csr证书
-CAkey选项指明用于签名的密钥
-CAserial指明序列号文件
-CAcreateserial指明文件不存在时自动生成。#合并证书（openssl.key和ssl证书crt）
 cat openssl.key server.crt  > server.pem

[root@ZABBIX-Server conf.d]# egrep -v "*#|^$" zabbix.conf 
server {
    listen       6989;
    listen       443 ssl;
    server_name  192.168.99.50;
   fastcgi_buffers 8 128k;
   fastcgi_buffer_size 128k;
    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm index.php;
    }
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
    location ~ \.php$ {
        root           html;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /usr/share/nginx/html$fastcgi_script_name;
        include        fastcgi_params;
    }
location ~ ^/(php_status|ping)$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /usr/share/nginx/html$fastcgi_script_name;
        include        fastcgi_params;
    }
    ssl_certificate     /etc/ssl/server.pem;
    ssl_certificate_key /etc/ssl/server.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    if ($server_port = 6989){
    rewrite ^(.*)$ https://$host$1 permanent;
    }
}

#验证配置文件
nginx -t
#重启nginx服务
systemctl   restart  nginx

if ($server_port = 6989){
    rewrite ^(.*)$ https://$host$1 permanent;
    }

https://192.168.99.50/zabbix/