☰

大约一分钟后，nginx 在 SSL 上崩溃

tag-icon • tag-icon nginx ssl 504
大约一分钟后，nginx 在 SSL 上崩溃

这是我的配置文件

ssl.conf

# HTTPS server
#
server {
    listen       443 ssl;
    server_name  api.domain.com;
    error_log    /var/log/nginx/api.error.log;

    location / {
    root /var/www/api.domain.com;
    index index.html index.php index.php;
    try_files $uri $uri/ /index.php?$args;
    }

    ssl                  on;
    ssl_certificate      /etc/nginx/api.domain.com.crt;
    ssl_certificate_key  /etc/nginx/api.domain.com.key;

    ssl_session_timeout  5m;

    ssl_protocols  SSLv2 SSLv3 TLSv1;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    location ~ \.php$ {
        # root  html;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_split_path_info ^(.+\.php)(.*)$;
        fastcgi_param SCRIPT_FILENAME /var/www/api.domain.com$fastcgi_script_name;
        fastcgi_param HTTPS on;
        include fastcgi_params;
        }

    location ~ /\.ht {
        deny  all;
    }

}

nginx.conf

user              nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log;

pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    gzip  on;
    include /etc/nginx/conf.d/*.conf;
}

我有一个在端口 80 上运行的服务器，运行起来没有任何问题。当我打开这个在 SSL 上运行的 api 服务器时，它工作了大约一分钟，然后崩溃并出现 504 网关超时。

运行 nginx/1.2.3

答案1

NGiNX 中的网关超时通常是由 fastcgi 问题引起的（例如spawn_fcgi）php-fpm。

确保它正在运行并且正在监听。

如果您正在使用php-fpm，请尝试增加pm.max_children和pm.max_requests。

如果pm设置为dynamic，请尝试提高pm.start_servers、、pm.min_spare_servers和pm.max_spare_servers。

如果之后仍然遇到问题，请尝试添加共享 SSL 会话缓存并将工作进程增加到 NGiNX 中的 CPU 核心数量。

SSL 设置示例：

    ssl on;

    ##
    # For SSL caching
    ##
    ssl_session_cache shared:SSL:10m; 

    ##
    # For chained certs
    ##
    ssl_verify_depth 4; 

    ssl_certificate /etc/ssl/certs/cert.crt;
    ssl_certificate_key /etc/ssl/certs/privkey.pem;

    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_session_timeout 5m;
    keepalive_timeout 70;

相关内容