[{"data":1,"prerenderedAt":264},["ShallowReactive",2],{"docs-deploy-nginx":3,"docs-nav":218},{"id":4,"title":5,"body":6,"category":205,"dateModified":206,"datePublished":206,"description":48,"draft":207,"extension":208,"icon":209,"meta":210,"navigation":211,"order":191,"path":212,"seo":213,"sitemap":214,"stem":215,"summary":216,"__hash__":217},"docs\u002Fdocs\u002Fdeploy-nginx.md","Nginx 部署 SSL 证书",{"type":7,"value":8,"toc":190},"minimark",[9,14,18,35,38,41,51,55,66,74,77,83,87,94,97,103,110,113,118,128,132,135,149,153,160,164,178],[10,11,13],"h2",{"id":12},"下载-nginx-格式证书","下载 Nginx 格式证书",[15,16,17],"p",{},"证书签发后，在控制台「证书列表」页点击「更多 → 下载」，选择 Nginx 格式。解压得到两个文件：",[19,20,21,29],"ul",{},[22,23,24,28],"li",{},[25,26,27],"code",{},"example.com.pem"," — 证书文件（含完整证书链）",[22,30,31,34],{},[25,32,33],{},"example.com.key"," — 私钥文件",[10,36,37],{"id":37},"上传证书到服务器",[15,39,40],{},"建议放在 Nginx 配置目录下：",[42,43,49],"pre",{"className":44,"code":46,"language":47,"meta":48},[45],"language-bash","# 创建证书存放目录\nsudo mkdir -p \u002Fetc\u002Fnginx\u002Fcerts\u002F\n\n# 使用 scp 上传（在本地执行）\nscp example.com.pem example.com.key root@your-server:\u002Fetc\u002Fnginx\u002Fcerts\u002F\n","bash","",[25,50,46],{"__ignoreMap":48},[10,52,54],{"id":53},"配置-nginx","配置 Nginx",[15,56,57,58,61,62,65],{},"编辑 Nginx 配置文件（通常在 ",[25,59,60],{},"\u002Fetc\u002Fnginx\u002Fnginx.conf"," 或 ",[25,63,64],{},"\u002Fetc\u002Fnginx\u002Fconf.d\u002F"," 下）：",[42,67,72],{"className":68,"code":70,"language":71,"meta":48},[69],"language-nginx","server {\n    listen 443 ssl http2;\n    server_name example.com www.example.com;\n\n    ssl_certificate \u002Fetc\u002Fnginx\u002Fcerts\u002Fexample.com.pem;\n    ssl_certificate_key \u002Fetc\u002Fnginx\u002Fcerts\u002Fexample.com.key;\n\n    # 推荐的 SSL 安全配置\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers HIGH:!aNULL:!MD5;\n    ssl_prefer_server_ciphers on;\n    ssl_session_cache shared:SSL:10m;\n    ssl_session_timeout 10m;\n\n    location \u002F {\n        root \u002Fvar\u002Fwww\u002Fhtml;\n        index index.html;\n    }\n}\n\n# HTTP 自动跳转 HTTPS\nserver {\n    listen 80;\n    server_name example.com www.example.com;\n    return 301 https:\u002F\u002F$host$request_uri;\n}\n","nginx",[25,73,70],{"__ignoreMap":48},[10,75,76],{"id":76},"测试并重载",[42,78,81],{"className":79,"code":80,"language":47,"meta":48},[45],"# 测试配置是否正确\nsudo nginx -t\n\n# 配置正确则重载\nsudo nginx -s reload\n",[25,82,80],{"__ignoreMap":48},[10,84,86],{"id":85},"验证-https-是否生效","验证 HTTPS 是否生效",[15,88,89,90,93],{},"浏览器访问 ",[25,91,92],{},"https:\u002F\u002Fexample.com","，地址栏出现锁形图标即表示证书部署成功。",[15,95,96],{},"也可以使用命令行验证：",[42,98,101],{"className":99,"code":100,"language":47,"meta":48},[45],"curl -I https:\u002F\u002Fexample.com\n",[25,102,100],{"__ignoreMap":48},[15,104,105,106,109],{},"返回 ",[25,107,108],{},"HTTP\u002F2 200"," 且无证书错误即表示正常。",[10,111,112],{"id":112},"常见问题",[114,115,117],"h3",{"id":116},"浏览器提示证书不受信任","浏览器提示证书不受信任？",[15,119,120,121,124,125,127],{},"通常是证书链不完整。请确认使用的是包含完整证书链的 ",[25,122,123],{},".pem"," 文件，而非单独的证书文件。平台下载的 Nginx 格式 ",[25,126,123],{}," 已包含完整链（服务器证书 + 中间 CA 证书）。",[114,129,131],{"id":130},"nginx-t-报错-ssl_ctx_use_privatekey_file-failed","nginx -t 报错 \"SSL_CTX_use_PrivateKey_file failed\"？",[15,133,134],{},"私钥文件路径错误或文件权限不足。检查：",[19,136,137,143],{},[22,138,139,142],{},[25,140,141],{},"ssl_certificate_key"," 路径是否正确",[22,144,145,146],{},"文件权限：",[25,147,148],{},"sudo chmod 600 \u002Fetc\u002Fnginx\u002Fcerts\u002Fexample.com.key",[114,150,152],{"id":151},"部署后-http-无法自动跳转-https","部署后 HTTP 无法自动跳转 HTTPS？",[15,154,155,156,159],{},"确认 80 端口的 server 块配置了 ",[25,157,158],{},"return 301 https:\u002F\u002F$host$request_uri;","，且防火墙\u002F安全组放行了 80 和 443 端口。",[114,161,163],{"id":162},"证书到期后如何更新","证书到期后如何更新？",[15,165,166,167,169,170,173,174,177],{},"续签成功后重新下载新证书，替换服务器上的 ",[25,168,123],{}," 和 ",[25,171,172],{},".key"," 文件，然后执行 ",[25,175,176],{},"sudo nginx -s reload","。",[179,180,181],"blockquote",{},[15,182,183,184,189],{},"配置",[185,186,188],"a",{"href":187},"\u002Fdocs\u002Fdeploy-server","部署客户端","后，续签成功可自动替换证书并重载 Nginx，无需手动操作。",{"title":48,"searchDepth":191,"depth":192,"links":193},2,3,[194,195,196,197,198,199],{"id":12,"depth":191,"text":13},{"id":37,"depth":191,"text":37},{"id":53,"depth":191,"text":54},{"id":76,"depth":191,"text":76},{"id":85,"depth":191,"text":86},{"id":112,"depth":191,"text":112,"children":200},[201,202,203,204],{"id":116,"depth":192,"text":117},{"id":130,"depth":192,"text":131},{"id":151,"depth":192,"text":152},{"id":162,"depth":192,"text":163},"部署与续签","2026-09-09",false,"md",null,{},true,"\u002Fdocs\u002Fdeploy-nginx",{"title":5,"description":48},{"loc":212},"docs\u002Fdeploy-nginx","下载 Nginx 格式证书后，如何上传、配置 server 块、开启 TLS 与 HTTP 跳转 HTTPS，并验证证书是否生效。","9wlTHT_j1j3AsiaiMxyV23LpR7CHP9x_P8CK_vla4bg",[219,223,227,231,235,238,242,245,246,249,252,255,258,261],{"path":220,"title":221,"category":205,"order":222},"\u002Fdocs\u002Fauto-renew","SSL证书自动续签配置",5,{"path":224,"title":225,"category":205,"order":226},"\u002Fdocs\u002Fcert-download","证书下载与格式说明",1,{"path":228,"title":229,"category":230,"order":192},"\u002Fdocs\u002Fcert-types","证书类型选择：单域名\u002F多域名\u002F通配符\u002FIP","快速开始",{"path":232,"title":233,"category":205,"order":234},"\u002Fdocs\u002Fcloud-credential","云平台凭证配置指南",6,{"path":236,"title":237,"category":230,"order":191},"\u002Fdocs\u002Fcore-concepts","核心概念：SSL证书、DV\u002FOV\u002FEV 与 ACME",{"path":239,"title":240,"category":241,"order":222},"\u002Fdocs\u002Fcsr-management","CSR 管理：在线生成与自定义上传","申请与验证",{"path":243,"title":244,"category":205,"order":192},"\u002Fdocs\u002Fdeploy-cloud","一键部署到阿里云 CDN\u002FESA",{"path":212,"title":5,"category":205,"order":191},{"path":187,"title":247,"category":205,"order":248},"服务器部署客户端安装与使用",4,{"path":250,"title":251,"category":241,"order":226},"\u002Fdocs\u002Fdns-validation","DNS-01 验证详解",{"path":253,"title":254,"category":230,"order":226},"\u002Fdocs\u002Fgetting-started","5分钟申请你的第一张免费SSL证书",{"path":256,"title":257,"category":241,"order":191},"\u002Fdocs\u002Fhttp-validation","HTTP-01 文件验证详解",{"path":259,"title":260,"category":241,"order":248},"\u002Fdocs\u002Fip-certificate","IP 地址证书申请指南",{"path":262,"title":263,"category":241,"order":192},"\u002Fdocs\u002Fwildcard","通配符证书申请",1789011271295]