0%

CentOS 7 上编译 OpenSSL 与 Nginx

发表于 更新于 Disqus：
Compile latest version of Nginx and OpenSSL on CentOS 7

Download source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# install tool
sudo yum update -y
sudo yum install -y vim curl wget tree

# openssl
git clone https://github.com/openssl/openssl.git

# nginx
wget https://nginx.org/download/nginx-1.21.6.tar.gz && tar zxvf nginx-1.21.6.tar.gz

# PCRE version 8.45
wget https://sourceforge.net/projects/pcre/files/pcre/8.45/pcre-8.45.tar.gz/download -O pcre-8.45.tar.gz && tar xzvf pcre-8.45.tar.gz
#git clone https://github.com/PhilipHazel/pcre2.git

# zlib version 1.2.11
wget https://www.zlib.net/zlib-1.2.11.tar.gz && tar xzvf zlib-1.2.11.tar.gz

# module(optional)
git clone --recurse-submodules https://github.com/google/ngx_brotli
git clone git://github.com/arut/nginx-rtmp-module.git

Compile Install

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# tool
sudo yum install -y make gcc perl pcre-devel zlib-devel
sudo yum install perl-core zlib-devel -y
sudo yum group install 'Development Tools' -y

# openssl
cd openssl
git checkout -b openssl-3.0.1 openssl-3.0.1

./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib

# zlib = enable the compression using zlib library.

# compile openssl
make
make test
sudo make install

sudo vim /etc/ld.so.conf.d/openssl.conf

/usr/local/ssl/lib
/usr/local/ssl/lib64

# remove old libssl.so

sudo ldconfig -v
sudo ldconfig -v | grep ssl
mv /bin/openssl /bin/openssl.BEKUP
#mv /usr/bin/c_rehash /usr/bin/c_rehash.BEKUP
#mv /usr/bin/openssl /usr/bin/openssl.BEKUP
sudo vim /etc/profile.d/openssl.sh

# Set OPENSSL_PATH
OPENSSL_PATH="/usr/local/ssl/bin"
export OPENSSL_PATH
PATH=$PATH:$OPENSSL_PATH
export PATH

sudo chmod +x /etc/profile.d/openssl.sh
source /etc/profile.d/openssl.sh
which openssl
openssl version -a
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# nginx dependency
yum install -y perl perl-devel perl-ExtUtils-Embed libxslt libxslt-devel libxml2 libxml2-devel gd gd-devel GeoIP GeoIP-devel
#sudo apt-get install libxml2-dev libxslt-dev

sudo cp man/nginx.8 /usr/share/man/man8
sudo gzip /usr/share/man/man8/nginx.8
ls /usr/share/man/man8/ | grep nginx.8.gz
# Check that Man page for Nginx is working:
man nginx


# compile nginx
./configure --prefix=/etc/nginx \
--sbin-path=/usr/sbin/nginx \
--modules-path=/usr/lib64/nginx/modules \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--pid-path=/var/run/nginx.pid \
--lock-path=/var/run/nginx.lock \
--user=nginx \
--group=nginx \
--build=CentOS \
--builddir=nginx-1.24.0 \
--with-select_module \
--with-poll_module \
--with-threads \
--with-file-aio \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_xslt_module=dynamic \
--with-http_image_filter_module=dynamic \
--with-http_geoip_module=dynamic \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_auth_request_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_stub_status_module \
--with-http_perl_module=dynamic \
--with-perl_modules_path=/usr/lib64/perl5 \
--with-perl=/usr/bin/perl \
--http-log-path=/var/log/nginx/access.log \
--http-client-body-temp-path=/var/cache/nginx/client_temp \
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
--with-mail \
--with-mail_ssl_module \
--with-stream \
--with-stream_ssl_module \
--with-stream_realip_module \
--with-stream_geoip_module=dynamic \
--with-stream_ssl_preread_module \
--with-compat \
--with-pcre=../pcre-8.45 \
--with-pcre-jit \
--with-zlib=../zlib-1.2.11 \
--with-openssl=../openssl \
--with-openssl-opt=no-nextprotoneg \
--with-debug \
--add-module=../ngx_brotli



sudo make
sudo make install

sudo ln -s /usr/lib64/nginx/modules /etc/nginx/modules
sudo ln -s /usr/lib64/nginx/modules /etc/nginx/modules


# check
sudo nginx -t

sudo mkdir -p /var/cache/nginx/client_temp
sudo chmod 700 /var/cache/nginx/client_temp
sudo chown nginx:root /var/cache/nginx/client_temp
sudo useradd --system --home /var/cache/nginx --shell /sbin/nologin --comment "nginx user" --user-group nginx

nginx -V

add nginx service sudo vim /etc/systemd/system/nginx.service

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[Unit]
Description=nginx - high performance web server
Documentation=https://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -c /etc/nginx/nginx.conf
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID

[Install]
WantedBy=multi-user.target
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# 覆盖默认gzip设置
gzip on;
gzip_min_length 1k;
gzip_buffers 4 32k;
gzip_http_version 1.1;
gzip_comp_level 1;
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;
gzip_vary on;
gzip_proxied any;
gzip_disable "MSIE [1-6]\.";

# brotli 配置开始
brotli on;
brotli_comp_level 6;  #压缩等级，默认6，最高11，太高的压缩水平可能需要更多的CPU
brotli_buffers 16 8k;  #请求缓冲区的数量和大小
brotli_min_length 100; #指定压缩数据的最小长度，只有大于或等于最小长度才会对其压缩。这里指定100字节
brotli_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/json image/svg application/font-woff application/vnd.ms-fontobject application/vnd.apple.mpegurl image/x-icon image/jpeg image/gif image/png image/bmp;  #指定允许进行压缩类型
brotli_static always;   #是否允许查找预处理好的、以.br结尾的压缩文件，可选值为on、off、always
brotli_window 512k;  #窗口值，默认值为512k
proxy_set_header Accept-Encoding "";
# brotli 配置结束

Problem

Ubuntu

ERROR: cannot verify github.com's certificate, Unable to locally verify the issuer's authority.

1
sudo ln -s /usr/lib/ssl/certs /usr/local/ssl/certs

Reference