Shulou(Shulou.com)05/31 Report--

This article mainly introduces "how to configure HTTPS security communication between Nginx server and iOS". In daily operation, I believe many people have doubts about how to configure HTTPS security communication between Nginx server and iOS. Xiaobian consulted all kinds of materials and sorted out simple and easy-to-use operation methods. I hope it will be helpful to answer the doubts about "how to configure HTTPS security communication between Nginx server and iOS". Next, please follow the editor to study!

Brief introduction

In network communication, packet capture software can be used to analyze network requests and carry out replay attacks. The solution to replay attacks is generally to use a changing parameter, such as rsa encrypted timestamp, but considering the network transmission delay, timestamps need to have a certain error tolerance, which still can not fundamentally prevent replay attacks. In order to better solve the problem of replay attacks, we should consider using https communication. Https protocol is a network protocol built by ssl+http protocol for encrypted transmission and identity authentication, which is more secure than http protocol.

Realize

For websites visited by browsers, you need to apply for a certificate from ca to ensure that https pages can be browsed normally, otherwise you will be warned that they are unsafe or unauthenticated, and for some background data transmission, you can use a self-signed certificate.

Server configuration

Generate a certificate

From the command line of the server, do the following

① generates the private key of the server, and you need to enter a password of 40008191 bits.

Openssl genrsa-des3-out server.key 2048

② removes the password from the key file. You need to enter the password entered in ①.

Openssl rsa-in server.key-out server.key

③ generates csr files. This step requires entering a variety of information, which can be skipped by pressing enter.

Openssl req-new-key server.key-out server.csr

④ generates a crt file. The validity period is after-days in this step, so you can write it longer.

Openssl x509-req-days 3650-in server.csr-signkey server.key-out server.crt

⑤ combines crt and key to make pem, which is used to generate cer for client verification.

Cat server.crt server.key > server.pem

⑥ uses pem to generate cer,cer files and stores them on the client side for verification

Openssl x509-in server.pem-outform der-out server.cer

two。 Modify nginx configuration file

If you don't know the path to the configuration file, use the following command to print.

Nginx-t

This command can be used to test whether the configuration file is correct and print out the path.

According to the printed content, open nginx.conf, and you can find a http {... } configure the tag and add a server configuration tag to the http tag.

Server {listen 443nserverSecretname localhost;# configure the root directory of the website and the file name and type of the home page index index.html index.htm index.php;root ssl on The following is the configuration of php under ssl_certificate ssl_certificate_key #. If it is not configured, the php file cannot be parsed properly. This configuration is copied from the port 80 configuration of nginx to http. If this configuration does not work properly, copy it from the configuration file of your own server for port 80. Location ~. *\. (php | php5)? ${# fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_pass 127.0.0.1 fastcgi_pass unix:/tmp/php-cgi.sock; fastcgi_pass 9000; fastcgi_index index.php; include fastcgi.conf;} location ~. *\. (gif | jpg | jpeg | png | bmp | swf) ${expires 30d;} location ~. *\. (js | css)? ${expires 1h;} # if you don't know how to fill it here, please refer to the configuration file include / rewrite/default.conf;access_log / default.log; for port 80.

3. Update configuration

Nginx-t # tests whether the configuration file is correct nginx-s reload # reloads the configuration file

At this point, the configuration of the server is over.

Configuration of the client

If it is a certificate issued by ca, you can directly use the https request, but we have a self-signed certificate. If you access the certificate directly, you will get an error. Here's how to use afn to configure the https request for a self-signed certificate.

1. Import the cer certificate mentioned above into the bundle of app

Import server.cer into bundle

two。 Before using afn to make a request, make the following configuration

Afsecuritypolicy * policy = [afsecuritypolicy policywithpinningmode:afsslpinningmodepublickey]; policy.allowinvalidcertificates = yes;afhttpsessionmanager * manager = [afhttpsessionmanager manager]; manager.securitypolicy = policy;// use manager to make https request. At this point, the study on "how to configure HTTPS secure communication between Nginx server and iOS" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.