# TWCA 憑證放入 Nginx

<div id="bkmrk-"></div>### <span style="font-family: Verdana, sans-serif;">憑證安裝</span>

---

<span style="font-family: Verdana, sans-serif;">TWCA發回來憑證內容若要裝在nginx 上處理方式</span>  
<span style="font-family: Verdana, sans-serif;">解開cert.zip後會有下列檔案</span>  
<span style="font-family: Verdana, sans-serif;">  
</span> <span style="font-family: Verdana, sans-serif;">主機憑證：root.cer</span>  
<span style="font-family: Verdana, sans-serif;">網域憑證：server.cer</span>  
<span style="font-family: Verdana, sans-serif;">中繼憑證1：uca\_1.cer</span>  
<span style="font-family: Verdana, sans-serif;">中繼憑證2：uca\_2.cer</span>  
<span style="font-family: Verdana, sans-serif;">  
</span> <span style="font-family: Verdana, sans-serif;">檔案內容由上而下的順序uca\_2在上面，再來是uca\_1，透過下列指令産生檔案</span>  
<span style="background-color: white; font-size: 16px; line-height: 20px;"><span style="font-family: Verdana, sans-serif;">**cp uca\_2.cer uca.crt ; cat uca\_1.cer &gt;&gt; uca.cer**</span></span>  
<span style="font-family: Verdana, sans-serif;"><span style="background-color: white; line-height: 20px;">這個個設定可以適用於apache，apache的設定如下：</span></span>  
<span style="font-family: Verdana, sans-serif;"><span style="line-height: 20px;"> SSLEngine On</span></span>  
<span style="font-family: Verdana, sans-serif;"><span style="line-height: 20px;"> SSLCertificateFile /etc/ssl/server.cer</span></span>  
<span style="font-family: Verdana, sans-serif;"><span style="line-height: 20px;"> SSLCertificateKeyFile /</span><span style="line-height: 20px;">etc/ssl</span><span style="line-height: 20px;">/server.key</span></span>  
  
<span style="font-family: Verdana, sans-serif;"><span style="line-height: 20px;"> SSLCertificateChainFile <span style="color: red;">/</span></span><span style="color: red;"><span style="line-height: 20px;">etc/ssl</span><span style="line-height: 20px;">/uca.cer</span></span></span>  
**<span style="font-family: Verdana, sans-serif;">  
</span>** <span style="background-color: white; font-size: 16px; line-height: 20px;"><span style="font-family: Verdana, sans-serif;">若你要放在nginx上的處理方式有稍梢不同</span></span>  
<span style="font-family: Verdana, sans-serif;">nginx 上的設檔如下：</span>  
<span style="font-family: Verdana, sans-serif;"> ssl on;</span>  
<span style="font-family: Verdana, sans-serif;"> ssl\_certificate <span style="color: red;">/etc/ssl/server.pem;</span></span>  
<span style="font-family: Verdana, sans-serif;"> ssl\_certificate\_key /etc/ssl/server.key;</span>  
<span style="font-family: Verdana, sans-serif;"> ssl\_session\_timeout 5m;</span>  
<span style="font-family: Verdana, sans-serif;"> ssl\_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;</span>  
<span style="font-family: Verdana, sans-serif;"> ssl\_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";</span>  
<span style="font-family: Verdana, sans-serif;"> ssl\_prefer\_server\_ciphers on;</span>

<div id="bkmrk--1"></div>```Nginx
server{
    listen       80;
    listen       443 ssl;
    server_name  demo.server.com.tw;

    
    ssl_certificate /etc/nginx/ssl/server.pem;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_session_timeout 5m;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
    ssl_prefer_server_ciphers on;
    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        # root   /usr/share/nginx/html;
        # index  index.html index.htm;    
        proxy_http_version 1.1;
    
    	# 以下是reverse proxy 才需要
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
		proxy_set_header Host $host;
		proxy_read_timeout 60s;        
        proxy_pass   http://192.168.1.1:20599/;


    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

}
```

<div id="bkmrk-%E5%85%B6%E4%B8%AD%2Fetc%2Fssl%2Fserver.pe"><span style="font-family: Verdana, sans-serif;">  
</span> <span style="font-family: Verdana, sans-serif;">其中/etc/ssl/server.pem和原來的産生的規則有些不同，他的順序是 server.cer + uca\_2.cer + uca\_1.cer</span>  
<span style="font-family: Verdana, sans-serif;">産生方法如下</span>  
<span style="font-family: Verdana, sans-serif;">**cp server.cer server.pem;cat uca\_2.cer &gt;&gt; server.pem ; cat uca\_1.cer &gt;&gt; server.pem**</span></div><div id="bkmrk--2"></div><div id="bkmrk-https%3A%2F%2Fdavidelin.bl">**<a>https://davidelin.blogspot.com/2014/12/nginx-twca.html</a>**</div><div id="bkmrk--3"><div>---

</div></div>### 憑證需要密碼解決方案

今天設定客戶的域名遇到 `SSL_CTX_use_PrivateKey_file`、`EVP_DecryptFinal_ex:bad decrypt error` 的錯誤訊息 指出是私鑰的問題。

<div id="bkmrk-may-07-16%3A43%3A18-terr"><div><div><div>```
May 07 16:43:18 terrylin nginx[5307]: nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl/terryl.in/2020/server.key") failed (SSL: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt error:0May 07 16:43:18 terrylin nginx[5307]: nginx: configuration file /etc/nginx/nginx.conf test failed
May 07 16:43:18 terrylin systemd[1]: nginx.service: Control process exited, code=exited status=1
May 07 16:43:18 terrylin systemd[1]: nginx.service: Failed with result 'exit-code'.
May 07 16:43:18 terrylin systemd[1]: Failed to start A high performance web server and a reverse proxy server.
-- Subject: Unit nginx.service has failed
```

</div></div></div></div>打開私鑰檔案，發現在以往的長的不一樣，開頭多了一些編碼資訊。

<div id="bkmrk------begin-rsa-priva"><div><div><div>```
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,D5F9600F17CDAB82
```

</div></div></div></div>這是被密碼保護的私鑰。所以解決方法有兩種方式，一是補上設定在 nginx 的設定檔中。舉例，我們建立一個文字檔，命名為 `ssl_password.txt` 並將密碼存放在這個檔案。

在 Nginx 的設定中補上這一行。

<div id="bkmrk-ssl_password_file-%2Fe"><div><div><div>```
ssl_password_file /etc/nginx/ssl/terryl.in/2020/ssl_password.txt;
```

</div></div></div></div>重啟 Nginx，就可以了。

另外一種方法則是把有密碼保護的私鑰檔案轉成不需要密碼的私鑰。利用 OpenSSL 的指令如下：

<div id="bkmrk-openssl-rsa--in-serv"><div><div><div>```
openssl rsa -in server.key -out new_server.key
```

</div></div></div></div>會提示需要您輸入密碼。

<div id="bkmrk-enter-pass-phrase-fo"><div><div><div>```
Enter pass phrase for server.key:
```

</div></div></div></div>密碼正確輸入的話，則會匯出 `new_server.key`，這是不需要密碼保護的私鑰檔案。當然 Nginx 的設定就照之前的設定就可以了。