网上大部分国密教程都是基于国密SSL实验室（www.gmssl.cn）提供的国密版OpenSSL，可以与Nginx集成。
但是其声明了 https://gmssl.cn/gmssl/index.jsp 每年年底会自动退出，因此采用Tengine+BabaSSl（https://www.babassl.cn/2022/01/11/BabaSSL-plus-Tengine.html），阿里系来构建国密应用，均为开源，没有限制。（Tengine是阿里维护的nginx，完全兼容nginx语法）
debian 11.3
tengine:2.3.3
babassl8.3.1
arm64 架构
暴风之鸟
root@arm-64:~# docker pull debian:11.3
root@arm-64:~# docker run -itd --name tengine -p 81:80 -p 442:443 debian:11.3
# 利用腾讯的debian源，把准备好的list移入容器内替换
root@arm-64:~# docker cp /root/sources.list tengine:/etc/apt
deb http://mirrors.cloud.tencent.com/debian bullseye main contrib non-free
deb http://mirrors.cloud.tencent.com/debian bullseye-updates main contrib non-free
deb http://mirrors.cloud.tencent.com/debian-security bullseye-security main contrib non-free
deb http://mirrors.cloud.tencent.com/debian bullseye-backports main contrib non-free
deb http://mirrors.cloud.tencent.com/debian bullseye-proposed-updates main contrib non-free
最新版本可参考 https://github.com/alibaba/tengine/blob/master/modules/ngx_openssl_ntls/README.md
root@arm-64:~# docker exec -it tengine bash
root@5ad877a818c2:/# cd
root@5ad877a818c2:~# apt update
root@5ad877a818c2:~# apt upgrade -y
# vim 是为了方便
root@5ad877a818c2:~# apt -y install wget gcc make libpcre3 libpcre3-dev zlib1g-dev git vim
# 下载tengine
root@5ad877a818c2:~# git clone https://github.com/alibaba/tengine.git
# 下载babassl https://github.com/BabaSSL/BabaSSL/releases
root@5ad877a818c2:~# wget https://github.com/BabaSSL/BabaSSL/archive/refs/tags/8.3.1.tar.gz
root@5ad877a818c2:~# tar xf 8.3.1.tar.gz
编译Tengine
root@5ad877a818c2:~# cd tengine/
# 注意调整babassl位置，就是之前解压缩的地方
root@5ad877a818c2:~/tengine# ./configure --add-module=modules/ngx_openssl_ntls
--with-openssl=/root/BabaSSL-8.3.1
--with-openssl-opt="--strict-warnings enable-ntls"
--with-http_ssl_module --with-stream
--with-stream_ssl_module --with-stream_sni
root@5ad877a818c2:~/tengine# make
root@5ad877a818c2:~/tengine# make install
添加软连接
root@5ad877a818c2:~/tengine# ln -s /usr/local/nginx/sbin/nginx /usr/sbin/
root@5ad877a818c2:~/tengine cd /usr/local/nginx/conf/
root@5ad877a818c2:~/tengine vim nginx.conf
# include /usr/local/nginx/conf/conf.d/*.conf; #将此条添加到http里
root@5ad877a818c2:/usr/local/nginx/conf# mkdir cert #证书目录
root@5ad877a818c2:/usr/local/nginx/conf# mkdir conf.d #子配置文件目录
root@5ad877a818c2:/usr/local/nginx/conf# exit
#编译好的容器，打包成镜像
root@arm-64:~# docker commit tengine tengine_babassl:2.3.3_8.3.1
#sha256:53951802fa9de8e0c92721d84e1a7040d8504f439d65d12f36552db5e4cdc53c
#编写Dockerfile
root@arm-64:~# cd /opt
root@arm-64:/opt# mkdir tenginefile
root@arm-64:/opt# cd tenginefile/
root@arm-64:/opt/tenginefile# vim Dockerfile
FROM tengine_babassl:2.3.3_8.3.1
EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"]
#制作镜像
root@arm-64:/opt/tenginefile# docker build -t "tengine_babassl:2.3.3_8.3.1_v1" .
#随便启动一次，把数据卷的配置弄出来
root@arm-64:/opt/tenginefile# docker run --name temp -itd -v tengine:/usr/local/nginx tengine_babassl:2.3.3_8.3.1_v1
root@arm-64:/opt/tenginefile# docker rm -f temp
root@arm-64:/opt/tenginefile# cd /var/lib/docker/volumes/
root@arm-64:/var/lib/docker/volumes# cd tengine/_data/conf/cert/
#把以下文件拷入
rsa.dk.crt.pem rsa.dk.key.pem sm2.dk.enc.crt.pem sm2.dk.enc.key.pem sm2.dk.sig.crt.pem sm2.dk.sig.key.pem
root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/cert# cd ../conf.d/
root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/conf.d# vim default.conf
root@arm-64:/opt/tenginefile# cd /var/lib/docker/volumes/
root@arm-64:/var/lib/docker/volumes# cd tengine/_data/conf/cert/
#把以下文件拷入
rsa.dk.crt.pem rsa.dk.key.pem sm2.dk.enc.crt.pem sm2.dk.enc.key.pem sm2.dk.sig.crt.pem sm2.dk.sig.key.pem
root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/cert# cd ../conf.d/
root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/conf.d# vim default.conf
#按以下编辑
server
{
listen 443 ssl;
server_name localhost;
enable_ntls on;
ssl_certificate /usr/local/nginx/conf/cert/rsa.dk.crt.pem;
ssl_certificate_key /usr/local/nginx/conf/cert/rsa.dk.key.pem;
ssl_sign_certificate /usr/local/nginx/conf/cert/sm2.dk.sig.crt.pem;
ssl_sign_certificate_key /usr/local/nginx/conf/cert/sm2.dk.sig.key.pem;
ssl_enc_certificate /usr/local/nginx/conf/cert/sm2.dk.enc.crt.pem;
ssl_enc_certificate_key /usr/local/nginx/conf/cert/sm2.dk.enc.key.pem;
location / {
root html;
index index.html index.htm;
}
}
启动最终容器
root@arm-64:/var/lib/docker/volumes/tengine/_data/conf/conf.d# docker run --name tengine_sm --restart=always -itd -p 81:80 -p 442:443 -v tengine:/usr/local/nginx tengine_babassl:2.3.3_8.3.1_v1
此时，如果用支持国密的浏览器访问https，则显示国密支持
如果是使用chrome浏览器，则是rsa加密
资源地址
国密双证书生成：
https://www.gmssl.cn/gmssl/index.jsp?go=CA
奇安信国密浏览器下载：
https://www.gmssl.cn/gmssl/Tool_Down?File=qaxbrowser_1.1.32574.52_gmssl.exe