nginx HTTPS反向代理

$ cat /etc/redhat-releas
CentOS Linux release 7.3.1611 (Core)

$ /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.9.9
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-file-aio --with-http_realip_module

https://letsencrypt.org/getting-started/

$ nvm ls
       v6.10.0
->       v7.9.0
default -> stable (-> v7.9.0)
node -> stable (-> v7.9.0) (default)
stable -> 7.9 (-> v7.9.0) (default)

# 添yum源
yum -y install yum-utils
yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
# 安装certbot
sudo yum install certbot
# 只求证书，不自动配置
certbot certonly

Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pemIMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
  /etc/letsencrypt/live/<mydomain>/fullchain.pem. Your cert will
  expire on 2017-07-17. To obtain a new or tweaked version of this
  certificate in the future, simply run certbot again. To
  non-interactively renew *all* of your certificates, run "certbot
  renew"
- Your account credentials have been saved in your Certbot
  configuration directory at /etc/letsencrypt. You should make a
  secure backup of this folder now. This configuration directory will
  also contain certificates and private keys obtained by Certbot so
  making regular backups of this folder is ideal.
- If you like Certbot, please consider supporting our work by:  Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
  Donating to EFF:                    https://eff.org/donate-le

$ ls /etc/letsencrypt/live/<mydomain>/
cert.pem  chain.pem  fullchain.pem  privkey.pem  README

# 更新测试
certbot renew --dry-run

crontab -e
# 每天1.11更新证书
11 1 * * * certbot renew >> ~/cron/cert.log
# 查看所有任务
crontab -l

$ /usr/local/nginx/sbin/nginx -V

# 备份
cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf_
# 编辑
vi /usr/local/nginx/conf/nginx.conf
# 修改HTTPS server下的内容为
server {
   listen       443 ssl;
   server_name  localhost;   ssl_certificate      /etc/letsencrypt/live/<mydomain>/fullchain.pem;
   ssl_certificate_key  /etc/letsencrypt/live/<mydomain>/privkey.pem;   ssl_session_timeout  5m;   location / {
       proxy_pass http://localhost:7777;
   }
}
# 测试配置语法
/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.conf
# 重启nginx
/usr/local/nginx/sbin/nginx -s reload

const http = require('http');const PORT = 7777;http.createServer((req, res) => {
   res.end('hoho, ' + PORT);
}).listen(PORT);
console.log('server is ready, listening ' + PORT);