如图，很多应用场景下，我们都会选择nginx作为tomcat的前端，进行后端服务器的负载均衡以及一些流量处理工作，同时，HTTPS的配置也一般放在Nginx上完成，而Nginx和后端服务器采用HTTP通信。

在网上能搜到的版本里面，HTTPS+Nginx+Tomcat的配置大多是需要Tomcat配置HTTPS证书的，或者只提到了nginx侧的配置，采用这两种配置的话，第一种比较繁琐，需要在tomcat上面配置证书，如果后端Tomcat比较多的话，更新替换证书并不是什么有趣的工作，并且，nginx到tomcat之间采用https的话，效率也比较低下（在这里我们忽略内网的安全性问题）。另一种只配置nginx的方式在一些场景下，后端服务器需要获取到真实的协议类型时就会遇到问题，导致应用无法正确识别到访问请求是HTTP还是HTTPS。正确的配置方法应该如下：

Nginx配置

在nginx上面启用HTTPS，并设置location里面增加如下配置，主要是X-Forwarded-Proto需要配置

proxy_set_header  Host $host;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header  Host $host;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header  Host $host;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

完整的nginx配置如下

upstream www.zym88.cn {
  ip_hash;
  server 192.268.1.1:8080;
  server 192.268.1.2:8080;
  #其他upstream......
}
server {
  listen  80;
  if ($host = www.zym88.cn) {
          return 301 https://$host$request_uri;
  }
}
server {
  listen  443;
  server_name  www.zym88.cn;
  access_log /data/logs/www.zym88.cn_access.log  main;
  error_log  /data/logs/www.zym88.cn_error.log;
  ssl on;
  ssl_certificate /etc/nginx/ssl/www.zym88.cn/server.crt;
  ssl_certificate_key /etc/nginx/ssl/www.zym88.cn/server.key;
  ssl_session_timeout 5m;
  ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!NULL:!aNULL:!MD5:!ADH:!RC4;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://$server_name;
  }
}
upstream www.zym88.cn {
  ip_hash;
  server 192.268.1.1:8080;
  server 192.268.1.2:8080;
  #其他upstream......
}

server {
  listen  80;
  if ($host = www.zym88.cn) {
          return 301 https://$host$request_uri;
  }
}

server {
  listen  443;
  server_name  www.zym88.cn;
  access_log /data/logs/www.zym88.cn_access.log  main;
  error_log  /data/logs/www.zym88.cn_error.log;
  ssl on;
  ssl_certificate /etc/nginx/ssl/www.zym88.cn/server.crt;
  ssl_certificate_key /etc/nginx/ssl/www.zym88.cn/server.key;
  ssl_session_timeout 5m;
  ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!NULL:!aNULL:!MD5:!ADH:!RC4;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  location / {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://$server_name;
  }
}
upstream www.zym88.cn {
	ip_hash;
	server 192.268.1.1:8080;
	server 192.268.1.2:8080;
	#其他upstream......
}

server {
	listen	80;
	if ($host = www.zym88.cn) {
	        return 301 https://$host$request_uri;
	}
}

server {
	listen	443;
	server_name	www.zym88.cn;
	access_log /data/logs/www.zym88.cn_access.log  main;
	error_log  /data/logs/www.zym88.cn_error.log;
	ssl on;
	ssl_certificate /etc/nginx/ssl/www.zym88.cn/server.crt;
	ssl_certificate_key /etc/nginx/ssl/www.zym88.cn/server.key;
	ssl_session_timeout 5m;
	ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!NULL:!aNULL:!MD5:!ADH:!RC4;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;
	location / {
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Host $remote_addr;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_pass http://$server_name;
	}
}

Tomcat配置

在Tomcat配置文件server.xml中…节点中新增如下配置，其余配置不用修改

<Valve className="org.apache.catalina.valves.RemoteIpValve" remoteIpHeader="X-Forwarded-For" protocolHeader="X-Forwarded-Proto" />
<Valve className="org.apache.catalina.valves.RemoteIpValve" remoteIpHeader="X-Forwarded-For" protocolHeader="X-Forwarded-Proto" />
<Valve className="org.apache.catalina.valves.RemoteIpValve" remoteIpHeader="X-Forwarded-For" protocolHeader="X-Forwarded-Proto" />

之后需要重启Tomcat生效