致远 OA HTTPS 配置避坑指南环境说明产品版本致远A6-V5 企业版 V5.6SP1部署环境Windows Server 2008 R2 Standard应用部署方式单机 Tomcat 部署Tomcat 端口8080HTTPS 方式Nginx 反向代理域名oa.xxxx.comHTTPS 端口4433本机443端口已被其他服务占用一、需求简述将致远A6-V5 企业版 V5.6SP1从原来的http://oa.xxxx.com:8080改为通过 Nginx 对外提供 HTTPS 访问https://oa.xxxx.com:4433并解决 HTTPS 场景下常见的报错页面可打开但提交报错浏览器提示混合内容页面中仍然生成http://地址400 The plain HTTP request was sent to HTTPS port二、致远OA实现HTTPS加密访问的逻辑图三、NGINX准备在Windows Server中安装NGINX参考文章Windows Server 部署 Nginx 反向代理指南本环境最终使用的思路80 端口跳转到 HTTPS4433 提供 HTTPS反向代理到本机 OA Tomcat 的8080使用sub_filter模块对页面中的http://oa.xxxx.com做内容替换修复老版本 A6V5 输出 HTTP 地址的问题1、配置NGINXnginx.conf推荐配置内容如下worker_processes auto; events { worker_connections 2048; } http { include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; keepalive_requests 1000; server_tokens off; client_max_body_size 60m; #文件上传大小限制 tcp_nopush on; tcp_nodelay on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 5; gzip_min_length 1k; gzip_buffers 16 8k; gzip_types text/plain text/css text/html text/xml application/javascript application/x-javascript text/javascript application/json application/xml application/xhtmlxml; server { listen 80; server_name oa.xxxx.com; return 301 https://$host:4433$request_uri; } server { listen 4433 ssl; server_name oa.xxxx.com; ssl_certificate E:/nginx-1.16.1/nginx-1.16.1/ssl/ssl.pem; ssl_certificate_key E:/nginx-1.16.1/nginx-1.16.1/ssl/ssl.key; ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$ { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_redirect http:// https://; proxy_set_header Accept-Encoding ; sub_filter_once off; sub_filter_types text/css application/javascript application/x-javascript text/javascript; sub_filter http://oa.xxxx.com https://oa.xxxx.com; expires 7d; add_header Cache-Control public; proxy_connect_timeout 300; proxy_read_timeout 300; proxy_send_timeout 300; } location / { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_redirect http:// https://; proxy_set_header Accept-Encoding ; sub_filter_once off; sub_filter_types text/html text/css text/xml text/plain application/javascript application/x-javascript text/javascript application/json; sub_filter http://oa.xxxx.com https://oa.xxxx.com; proxy_connect_timeout 300; proxy_read_timeout 300; proxy_send_timeout 300; } } }sub_filter是本次修复的关键它的核心作用是在响应内容返回给客户端之前对 HTML 等文本内容进行实时、轻量级的字符串替换而无需修改后端代码或源文件。2、放置 SSL 证书把SSL证书文件.pem和.key文件放入目录自定义E:\nginx-1.16.1\nginx-1.16.1\ssl\并确认配置中的路径一致ssl_certificate E:/nginx-1.16.1/nginx-1.16.1/ssl/ssl.pem; ssl_certificate_key E:/nginx-1.16.1/nginx-1.16.1/ssl/ssl.key;四、修改OA配置对于 A6V5不建议优先改 Tomcat HTTPS而是需要在服务器本地打开【协同系统配置】——【系统参数设置】——找到参数【internet.site.url】并将原来的http://oa.xxxx.com:8080改成https://oa.xxxx.com:44331、服务器本地打开【协同系统配置】2、修改参数五、效果检查完成以上配置后通过访问 【oa.xxxx.com】可自动跳转https://oa.xxxx.com:4433页面可正常提交表单不再报错浏览器不再提示混合内容拦截说明 HTTPS 配置可用。