☰

为单个域下具有多个端口/服务的 nginx 服务器设置 Certbot 的正确方法是什么？

tag-icon • tag-icon nginx certbot
为单个域下具有多个端口/服务的 nginx 服务器设置 Certbot 的正确方法是什么？

最初，我在两个不同的端口上为两个服务（Radicale 和 LMS）配置了 NGINX。我在 中做了这个/etc/nginx/nginx.conf。对互联网的访问MYDOMAIN:8000和:8009来自3001互联网的访问分别被重定向到Radicale和LMS。

我在服务器上设置了证书以启用此功能，然后运行sudo certbot --nginx -d MYDOMAIN生成 LetsEncrypt 证书。之后我禁用了自己的证书（我只需设置它们以使配置文件没有错误）。

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;

    tcp_nopush on;
    types_hash_max_size 2048;
    keepalive_timeout 65;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    # reduce logging
    access_log off;

#   access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    gzip on;

#   include /etc/nginx/conf.d/*.conf;
#   include /etc/nginx/sites-enabled/*;

    auth_basic "NGINX";
    auth_basic_user_file /etc/nginx/.htpasswd;

#   old, before Certbot
#   ssl_certificate ssl/server.crt;
#   ssl_certificate_key ssl/server.key;
    
    server {
      server_name MYDOMAIN;
      listen 8000 ssl;
      location / {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Script-Name /;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Remote-User $remote_user;
        proxy_set_header Host $http_host;
        proxy_pass_header Authorization;
        auth_basic "Nginx-Radicale - Password required";
      }
    
    # generated with: sudo certbot --nginx -d MYDOMAIN
    ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
}
    server {
      server_name MYDOMAIN;
      listen 8009;
      return 301 https://MYDOMAIN:3001;
    }
    server {
      server_name MYDOMAIN;
      listen 3001;
      location / {
        proxy_pass http://localhost:3000/;
        auth_basic "NGINX";
      }
    }
}

现在我更改了设置，并希望将server配置部分拆分到nginx/conf.d子目录中以进行干净的设置。我想保留原来的文件nginx.conf，只调整我自己的两个文件：

pi@RPi64:/etc/nginx $ cat conf.d/radicale.conf 
server {
  server_name MYDOMAIN;
  listen 8000; 
# ssl;
  location / {
    proxy_pass http://localhost:5232;
    proxy_set_header X-Script-Name /;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Remote-User $remote_user;
    proxy_set_header Host $http_host;
    proxy_pass_header Authorization;
    auth_basic "Nginx-Radicale - Password required";
  }
}

第二个文件：

pi@RPi64:/etc/nginx $ cat conf.d/LMS.conf
server {
    server_name MYDOMAIN;
    listen 8009;
    return 301 https://MYDOMAIN:3001;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/MYDMOAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    server_name MYDOMAIN;
    listen 3001;
    location / {
        proxy_pass http://localhost:3000/;
        auth_basic "NGINX";
    }
}

正如您所看到的，我注释掉了ssl第一个文件中的部分。如果我让它进来，sudo nginx -t就会出现缺少证书的错误。我想避免必须设置自己的证书。

另外，您可以看到运行certbot在我的第二个文件中添加了五行：

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/MYDMOAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

我认为 certbot 在此文件中找到了https，然后决定在其中添加证书。

但是，我想为整个服务器添加证书 - 意味着两个站点/文件。

特别是由于更新证书的过程必须定期完成，我想确保不涉及手动复制。

我如何知道Certbot为两个文件插入证书？我是否必须先添加自己的证书才能让 certbot 识别需求？

或者将证书添加到主文件是否有意义nginx.conf？我做错了什么吗？

答案1

我的解决方案是将以下内容添加到nginx.conf：

server {
    server_name MYDOMAIN
    listen 443; 
}

编辑：当然也可以将此服务器添加为.confin conf.d。这使得处理更容易。

然后我运行了certbot --nginx -d MYDOMAIN以下几行：

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}


    server {
    if ($host = MYDOMAIN) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        server_name MYDOMAIN
        listen 443;
    listen 80;
    return 404; # managed by Certbot

然后我删除了这些行并将这部分放入我的每个文件中conf.d/

    ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

我认为续订过程只会考虑证书本身，/etc/letsencrypt因此手动修复conf.d应该没问题。

相关内容