1.场景：安全需要，将原微服务架构的http转为https，并且对已有用户无感；及客户在访问http://a.aa.com时自动转为：https://a.aa.com

2.实现：由于前后端完全分离，使用Nginx做代理，证书选择nginx的SSL证书；

3.nginx配置如下：Linux生产环境自动更改证书目录位置即可，以下实例为windows测试环境，亲测成功；

worker_processes  1;

events {
    worker_connections  2048;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  650;
gzip on;
# 不压缩临界值，大于1K的才压缩，一般不用改
gzip_min_length 1k;
# 压缩缓冲区
gzip_buffers 16 64K;
# 压缩版本（默认1.1，前端如果是squid2.5请使用1.0）
gzip_http_version 1.1;
# 压缩级别，1-10，数字越大压缩的越好，时间也越长
gzip_comp_level 5;
# 进行压缩的文件类型
gzip_types text/plain application/x-javascript text/css application/xml application/javascript;
# 跟Squid等缓存服务有关，on的话会在Header里增加"Vary: Accept-Encoding"
gzip_vary on;
# IE6对Gzip不怎么友好，不给它Gzip了
gzip_disable "MSIE [1-6]\.";
server_names_hash_bucket_size   128;
        client_header_buffer_size       32k;
        large_client_header_buffers     4 32k;
        client_max_body_size            300m;
        tcp_nopush                      on;
        tcp_nodelay                     on;
        client_body_buffer_size         512k;
        proxy_connect_timeout           180;
        proxy_read_timeout              3000;
        proxy_send_timeout              3000;
        proxy_buffer_size               256k;
        proxy_buffers                   4 256k;
        proxy_busy_buffers_size         256k;
        proxy_temp_file_write_size      256k;
        proxy_hide_header               X-Powered-By;
        server_name_in_redirect         off;
        map_hash_bucket_size            1024;
        map_hash_max_size               102400;
        charset                         utf-8;
##证书配置
    server {
        listen       443 ssl;
        server_name  testgdc.paiang.com;
		ssl_certificate      E://nginx-1.25.1//conf//cert//xxxx.xxx.com.pem;  
		ssl_certificate_key    E://nginx-1.25.1//conf//cert//xxxx.xxx.com.key;
		ssl_session_cache shared:SSL:1m;
		ssl_session_timeout 5m;
		#ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
		ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_prefer_server_ciphers off;
		charset utf-8;
##这里是前端资源地址
		location / {
            root   E:\dist;
			try_files $uri $uri/ /index.html;
            index  index.html index.htm;
			error_page 405 =200  $request_uri;
        }
		##这里是前端到后端网关的跳转处理逻辑
		location /prod-api/ {
			proxy_set_header Host $http_host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header REMOTE-HOST $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_pass http://localhost:8080/;
			error_page 405 =200  $request_uri;
		}

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
	server {
   listen 80;
  #填写证书绑定的域名，这几句作用是将http无感转为https;
    server_name ****.****.com;   ##这里替换为你得域名
   # #将所有HTTP请求通过rewrite指令重定向到HTTPS。
    rewrite ^(.*)$ https://$host$1;
    location / {
        index index.html index.htm;
    }
  }

}