原理：使用nginx的stream、 stream_ssl_preread模块
由于stream和stream_ssl_preread模块非默认引入，需要在编译安装nginx时引入；编译时添加配置参数 --with-stream --with-stream_ssl_preread_module
1、编译nginx
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module --with-stream --with-stream_ssl_preread_module --with-stream_ssl_module
执行make & make install
2、配置nginx.conf
添加stream配置，让其识别到http访问时默认走http,其余走https
stream {upstream http_gateway {server 127.0.0.1:80801;}upstream https_gateway {server 127.0.0.1:80802;}map $ssl_preread_protocol $upstream {default http_gateway;"TLSv1.0" https_gateway;"TLSv1.1" https_gateway;"TLSv1.2" https_gateway;"TLSv1.3" https_gateway;}server {listen 8080;ssl_preread on;proxy_pass $upstream;}upstream http_gateway_8081 {server 127.0.0.1:80811;}upstream https_gateway_4664 {server 127.0.0.1:80812;}map $ssl_preread_protocol $upstream_8081 {default http_gateway_8081;"TLSv1.0" https_gateway_8081;"TLSv1.1" https_gateway_8081;"TLSv1.2" https_gateway_8081;"TLSv1.3" https_gateway_8081;}server {listen 8081;ssl_preread on;proxy_pass $upstream_8081;}
}
3、简单的nginx.conf示例供参考
http {include mime.types;default_type application/octet-stream;sendfile on;server {access_log logs/demo-info.log;listen 80801;listen 80802 ssl;server_name localhost;ssl_certificate /usr/local/nginx/conf/ssl/server.crt;ssl_certificate_key /usr/local/nginx/conf/ssl/server.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 10m;ssl_protocols TLSv1.2; ssl_prefer_server_ciphers on;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; location / {proxy_pass http://127.0.0.1:4399;}}server {access_log logs/demo-test.log;listen 80811;listen 80812 ssl;server_name localhost;ssl_certificate /usr/local/nginx/conf/ssl/server.crt;ssl_certificate_key /usr/local/nginx/conf/ssl/server.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 10m;ssl_protocols TLSv1.2; ssl_prefer_server_ciphers on;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;location / {proxy_pass http://127.0.0.1:4340;}}}
的基本知识)
01)
