Nginx 转发 SSL 的坑

昨天遇到一个问题,主机服务还没有转成https,但要转发给一个https地址,一直在报一个错

upstream server temporarily disabled while SSL handshaking to upstream, client: xxx.xxx.xxx.xxx, server: localhost

SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: xxx.xxx.xxx.xxx, server: localhost, request: "POST /a-path/ HTTP/1.1"

从log看应该是协议的问题,就开始找解决办法,最终解决问题,我把方法贴出来
 

location /a-path/ {
    proxy_pass https://a-address/;
    proxy_set_header Host $proxy_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_ssl_session_reuse off;
    proxy_ssl_server_name on;
    proxy_ssl_name $proxy_host;
    proxy_ssl_protocols TLSv1.2;
}

关键是 proxy_ssl_protocols 和 proxy_ssl_session_reuse

记录一下,如果有问题,欢迎大牛指出,谢谢

  • 4
    点赞
  • 7
    收藏
    觉得还不错? 一键收藏
  • 5
    评论
要配置NginxSSL,可以按照以下步骤进行操作: 1. 首先,在服务器上创建一个目录,并赋予相应的权限。可以使用以下命令创建目录并给予权限: ``` mkdir /home/ssl-nginx/conf mkdir /home/ssl-nginx/logs chmod -R 755 /home/ssl-nginx ``` 2. 接下来,执行启动命令来运行SSL Nginx容器: ``` docker run -d --privileged=true --name ssl-nginx -p 80:80 -p 443:443 -v /home/ssl-nginx/conf/nginx.conf:/etc/nginx/nginx.conf -v /home/ssl-nginx/logs:/var/log/nginx -d nanlist/nginx1.23.1:v1.0 ``` 3. 然后,可以使用以下命令查看Nginx的日志: ``` docker logs --tail=1000 ssl-nginx ``` 4. 进行NginxSSL模块安装,可以使用以下命令加载配置文件并重启Nginx容器: ``` docker exec -i ssl-nginx nginx -s reload ``` 5. 最后,打开配置文件nginx.conf,并将以下配置内容添加到文件中: ``` http { server { listen 443 ssl; server_name test.com; ssl_certificate /usr/local/nginx/cert/ssl.crt; ssl_certificate_key /usr/local/nginx/cert/ssl.key; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!***5:!RC4:!DHE; ssl_prefer_server_ciphers on; location / { root /usr/local/service/ROOT; index index.html; } } server { listen 80; server_name test.com; rewrite ^/(.*)$ https://test.com:443/$1 permanent; } } ``` 以上就是配置NginxSSL的步骤。<span class="em">1</span><span class="em">2</span><span class="em">3</span> #### 引用[.reference_title] - *1* *2* [Nginx配置ssl证书(https证书)](https://blog.csdn.net/u010797364/article/details/127413419)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_2"}}] [.reference_item style="max-width: 50%"] - *3* [Nginx配置ssl证书(https)](https://blog.csdn.net/ydZ157/article/details/121515518)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v93^chatsearchT3_2"}}] [.reference_item style="max-width: 50%"] [ .reference_list ]
评论 5
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值