openssl req -newkey rsa:2048 -keyout weizhimiao.cn.key -out weizhimiao.cn.csr

...
http {
 ...
 include /etc/nginx/conf.d/*.conf;

 server {
  ...
 }
}

server{
 listen 443 ssl;
 server_name weizhimiao.cn;

 ssl_certificate /data/secret/1_weizhimiao.cn_bundle.crt;
 ssl_certificate_key /data/secret/weizhimiao.cn.key;
 ssl_prefer_server_ciphers on;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

 ssl_ciphers 'kEECDH+ECDSA+AES128 kEECDH+ECDSA+AES256 kEECDH+AES128 kEECDH+AES256 kEDH+AES128 kEDH+AES256 DES-CBC3-SHA +SHA !aNULL !eNULL !LOW !MD5 !EXP !DSS !PSK !SRP !kECDH !CAMELLIA !RC4 !SEED';

 add_header Strict-Transport-Security 'max-age=31536000; preload';
 add_header X-Frame-Options DENY;
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 10m;
 keepalive_timeout 70;
 ssl_dhparam /data/secret/dhparam.pem;

 add_header X-Content-Type-Options nosniff;

 add_header X-Xss-Protection 1;

 root /data/www/weizhimiao.cn;
 index index.html;

 location / {

 }
}

cd /data/secret/
openssl dhparam 2048 -out dhparam.pem

server{
 listen 80;
 server_name weizhimiao.cn;
 return 301 https://weizhimiao.cn$request_uri;
}

nginx -t
Enter PEM pass phrase:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

nginx -s stop
Enter PEM pass phrase:
nginx
Enter PEM pass phrase:

cd /data/secret/
openssl rsa -in weizhimiao.cn.key -out weizhimiao.cn.key.unsecure

server {
 ...
 ssl_certificate /data/secret/1_weizhimiao.cn_bundle.crt;
 ssl_certificate_key /data/secret/weizhimiao.cn.key.unsecure;
 ...
}