HTTPS Server Configuration
Update Time：2025.02.20I. SSL Certificate Application
1 . Confirm the domain name that needs to apply for the certificate.
2 . Generate a private key and csr file.
On a Linux machine, run the following command to generate a private key:
#openssl genrsa -out server.key 2048
On a Linux machine, run the following command to generate a csr file:
#openssl req -new -key server.key -out certreq.csr
The text in bold is only for reference and should be replaced by the merchant based on actual conditions.
Country Name： CN //The ISO code for your country. The code for China is CN.
State or Province Name：guandong //The province/autonomous region/municipality directly under the Central Government where your organization is located
Locality Name：shenzhen //The city/county/district where your organization is located
Organization Name：Tencent Technology (Shenzhen) Company Limited //The legal name of your organization/institution/company
Organizational Unit Name： R&D //Department name
Common Name： www.example.com //Common name, such as www.itrus.com.cn. This item must be identical with the domain name used to access the server providing SSL services.
Email Address： //Your email address (Not required. Press Enter to
skip this). "extra"attributes //The following information is not required. Press Enter to skip this until the command is executed.
After the command above is executed, the private key file server.key and the csr file certreq.csr are generated in the current directory.
3 . Submit the generated csr file to a third-party certificate issuing institution to apply for the server certificate for the corresponding domain name, and save the private key file properly.
4 . After you apply for the certificate, the certificate issuing institution will provide the server certificate content and two intermediate CA certificates. Follow the instructions provided by the certificate issuer to generate the server certificate. Here, we assume that the name of the server certificate file is server.pem.
5 . Copy the generated private key file server.key and the server certificate server.pem to the directory specified by the server. Now, you can configure the HTTPS server.
II. HTTPS Server Configuration
1. Nginx configuration
server {
listen 443; #Specify the SSL listener port
server_name www.example.com;
ssl on; #Enable SSL support
ssl_certificate /etc/nginx/server.pem; #Specify the server certificate path
ssl_certificate_key /etc/nginx/server.key; #Specify the private key certificate path
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #Specify the protocol versions supported by the SSL server
ssl_ciphers ALL：!ADH：!EXPORT56：RC4+RSA：+HIGH：+MEDIUM：+LOW：+SSLv2：+EXP; #Specify the encryption algorithm
ssl_prefer_server_ciphers on; #When using SSLv3 and TLS protocols, the specified server encryption algorithm takes precedence over the client encryption algorithm
#The following content is only for reference and should be configured according to the actual domain name.
location / {
return 444;
}
}
2. Configuration of other web servers
Refer to the document: Server Certificate Configuration Guide
III. Related Matters
1 . Certificate issuing institution
We recommend iTrusChina. For more information, see
2 . Reference documents:《ngx_http_ssl_module》
Nginx Configuration for HTTPS Servers
Server Certificate Configuration Guide
3 . FAQ
Certificate trust issue
1 . Some SSL certificates issued in China are not trusted by Android devices. We recommend GeoTrust.
2 . If the page uses static/dynamic separation and the static resources have an independent domain name, you must also apply for a certificate for this domain name.
3 . Older Android versions do not support SNI extension. Due to this limitation, a server can only deploy one digital certificate.
