记录一个nginx与undertow的ssl配置

upstream pp{
    	keepalive	32;
    	server 127.0.0.1:8159;
    }
    server {
    	listen       80;
    	server_name  www.miigua.cn miigua.cn;
    	#http请求301跳转到https
    	return 301 https://www.miigua.cn$request_uri;
    }
    server {
        listen 443 ssl;
        server_name www.miigua.cn miigua.cn;
        if ($host = 'miigua.cn'){
        	#不带www域名301跳转到带www的域名
    		return 301 https://www.miigua.cn$request_uri;
    	}
        location / {
    		proxy_pass   http://pp;
    		#jpress登录后redirect报400错误
    		proxy_redirect http:// https://;
    		proxy_set_header Host $host:$server_port;
    		proxy_set_header X-Real-IP $remote_addr;
    		proxy_set_header REMOTE-HOST $remote_addr;
    		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    		proxy_http_version 1.1;
    		proxy_set_header Upgrade $http_upgrade;
    		
    		proxy_read_timeout 1800s;
    		
    		client_max_body_size    2000m;
    		if ($request_filename ~* \.(js|css|jpg|jpeg|gif|bmp|png) ) {
    			add_header	Cache-Control	max-age=31536000;
    		}
    	}
      
        ssl_certificate /data/jpress/cert/www.miigua.cn.pem;
    	ssl_certificate_key /data/jpress/cert/www.miigua.cn.key; 
    	ssl_session_timeout 5m;
    	ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    	#表示使用的加密套件的类型。
    	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; #表示使用的TLS协议的类型。
    	ssl_prefer_server_ciphers on;
    }
    

以上配置主要解决了如下问题： 

1、http请求301到https，不带www域名301到带www的域名，所有请求进来最终都会到 www.miigua.com/xxx（避免了seo收录多域名情况）。

 2、增加“proxy_redirect http:// https://;”解决java内部登录成功后redirect时报错“400 Bad Request: The plain HTTP request was sent to HTTPS port” 

3、静态文件浏览器缓存，减小服务器压力加快页面打开速度。