本文共 2523 字，大约阅读时间需要 8 分钟。

一、简介

GMSSL提供一个国密版OpenSSL和国密版Nginx，支持单向/双向认证，支持标准SSL/国密SSL自适应。 其中国密版OpenSSL基于OpenSSL1.1.1d实现，且已经修正了CVE-2020-1967。

证书申请

二、运行环境

Centos7 x86_64

三、下载

yum install wget -y

国密OpenSSL与国密Nginx

四、编译部署（以nginx-1.8.0为例）

1) 下载gmssl_openssl_1.1_bxx.tar.gz到/roo/下 2) 解压 tar xzfm gmssl_openssl_1.1_bxx.tar.gz -C /usr/local 3) 下载到/roo/下 4) 解压 tar xzfm nginx-1.18.0.tar.gz 5) 进入目录 cd /root/nginx-1.18.0 6) 编辑auto/lib/openssl/conf，将全部$OPENSSL/.openssl/修改为$OPENSSL/并保存

./configure \--without-http_gzip_module \--with-http_ssl_module \--with-http_stub_status_module \--with-http_v2_module \--with-file-aio \--with-openssl="/usr/local/gmssl" \--with-cc-opt="-I/usr/local/gmssl/include" \--with-ld-opt="-lm"

8) 编译安装

make install 9) /usr/local/nginx即为生成的nginx目录 注：可能需要使用yum install pcre-devel需要安装pcre-devel

 

配置示例(国密单向)

server{  listen 0.0.0.0:443 ssl;  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;  ssl_verify_client off;  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;  location /  {    root html;    index index.html index.htm;  }}

配置示例(国密双向)

server{  listen 0.0.0.0:443 ssl;  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;  ssl_client_certificate /usr/local/nginx/conf/demo1.sm2.trust;  ssl_verify_client on;  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;  location /  {    root html;    index index.html index.htm;  }}

配置示例(国密/RSA单向自适应)

server{  listen 0.0.0.0:443 ssl;  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:AES128-SHA:DES-CBC3-SHA:ECC-SM4-SM3:ECDHE-SM4-SM3;  ssl_verify_client off;  ssl_certificate /usr/local/nginx/conf/demo1.rsa.crt.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.rsa.key.pem;  ssl_certificate /usr/local/nginx/conf/demo1.sm2.sig.crt.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.sig.key.pem;  ssl_certificate /usr/local/nginx/conf/demo1.sm2.enc.crt.pem;  ssl_certificate_key /usr/local/nginx/conf/demo1.sm2.enc.key.pem;  location /  {    root html;    index index.html index.htm;  }}