Instantly share code, notes, and snippets.

Embed
What would you like to do?
RPM build Nginx 1.11.x with ALPN on CentOS 6/7 using static OpenSSL 1.1 (v 1.02+ required for http/2 support in Chrome)
# Based on CentOS7 fork of @smartmadsoft: https://gist.github.com/moneytoo/ab3f34e4fddc2110675952f8280f49c5
# "6" for CentOS6 or Amazon Linux, "7" for CentOS7
CENTVER="6"
OPENSSL_VERSION=1.0.2h
NGINX_VERSION=1.11.1-1
# epel repo required for GeoIP-devel
yum -y groupinstall 'Development Tools'
yum -y install wget openssl-devel libxml2-devel libxslt-devel gd-devel perl-ExtUtils-Embed GeoIP-devel pcre-devel
useradd builder
mkdir -p /opt/lib
# Untar, but don't compile openssl to /opt/lib
wget https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz -O /opt/lib/openssl-$OPENSSL_VERSION.tar.gz
tar -zxvf /opt/lib/open* -C /opt/lib
# Build source nginx (no auto-updates), statically link to /opt/lib/openssl* (no OS effects)
rpm -ivh http://nginx.org/packages/mainline/centos/$CENTVER/SRPMS/nginx-$NGINX_VERSION.el$CENTVER.ngx.src.rpm
sed -i "s|--with-http_ssl_module|--with-http_ssl_module --with-openssl=/opt/lib/openssl-$OPENSSL_VERSION|g" /root/rpmbuild/SPECS/nginx.spec
# Compile it
rpmbuild -ba /root/rpmbuild/SPECS/nginx.spec
# Install it
rpm -ivh /root/rpmbuild/RPMS/x86_64/nginx-$NGINX_VERSION.el$CENTVER.ngx.x86_64.rpm
mkdir -p /etc/nginx/ssl
# You can just accept defaults, but make sure to use a "real" local dev Common Name, eg: localdev
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt
# *** Add /etc/hosts on OSX for localhost (eg, 127.0.0.1 localdev )
cp -p /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf-orig
cat <<'EOT' > /etc/nginx/conf.d/default.conf
server {
listen 80 default_server;
listen 443 ssl http2;
root /usr/share/nginx/html;
index index.html index.htm;
# LOCALDEV-COMMON-NAME is whatever you gave in the certificate setup for Common Name
server_name LOCALDEV-COMMON-NAME;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
location / {
try_files $uri $uri/ =404;
}
}
EOT
/opt/lib/openssl*/apps/openssl version -a
nginx -V # 2>&1 | sed -r -e 's/\s+--/\n/g' | grep -E 'version|v2' --color=never
# service iptables stop # <-- only for VirtualBox setups
service nginx start
# Other useful queries:
# /opt/lib/openssl*/apps/openssl ciphers | tr ':' '\n' | sort | less
# /opt/lib/openssl*/apps/openssl ecparam -list_curves | less
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment