![安装自签名证书后无法从 nginx 服务器获取 https 响应](https://linux22.com/image/694994/%E5%AE%89%E8%A3%85%E8%87%AA%E7%AD%BE%E5%90%8D%E8%AF%81%E4%B9%A6%E5%90%8E%E6%97%A0%E6%B3%95%E4%BB%8E%20nginx%20%E6%9C%8D%E5%8A%A1%E5%99%A8%E8%8E%B7%E5%8F%96%20https%20%E5%93%8D%E5%BA%94.png)
连接 https:// 时没有收到服务器的响应。Http 运行正常。我已安装自签名证书并正确配置,没有错误。我正在使用 php-fpm 运行 nginx。我使用 nginx 检查它是否在端口 443 上监听。我尝试将其切换到 81,再次成功。
这是我第一次和你们这些天才们在一起,所以请饶恕我,让我知道如何改进我的问题
默认 nginx 配置
user nginx;
pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log;
worker_processes auto;
worker_rlimit_nofile 1024;
events {
use epoll;
worker_connections 2048;
multi_accept on;
}
http {
perl_modules perl/lib;
perl_set $uri_lc 'sub {
my $r = shift;
my $uri = $r->uri;
$uri = lc($uri);
return $uri;
}';
include /etc/nginx/mime.types;
default_type application/octet-stream;
...
upstream fpm_backend {
server 127.0.0.1:9000;
}
map $scheme $fastcgi_https {
default off;
https on;
}
server_tokens off;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
client_header_timeout 10m;
client_body_timeout 10m;
send_timeout 10m;
proxy_read_timeout 2m;
fastcgi_send_timeout 10m;
fastcgi_read_timeout 10m;
fastcgi_buffer_size 32k;
fastcgi_buffers 8 16k;
client_max_body_size 10M;
client_header_buffer_size 1k;
large_client_header_buffers 4 4k;
output_buffers 4 32k;
postpone_output 1460;
keepalive_timeout 65;
reset_timedout_connection on;
types_hash_max_size 2048;
gzip on;
gzip_disable 'msie6';
gzip_comp_level 5;
gzip_min_length 100;
gzip_buffers 16 8k;
gzip_types text/plain application/xml text/css text/js text/xml application/x-javascript text/javascript application/json application/xml+rss application/javascript image/png image/gif image/jpg;
gzip_vary on;
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 5;
open_file_cache_errors off;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
include /etc/nginx/conf.d/*.conf;
}
包括 conf 以及其他许多不相关的内容
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
include /etc/nginx/conf.d/custom-log.inc;
server {
listen 80;
listen 443 ssl;
server_name control.xxx.com;
access_log /var/log/nginx/control-performance-access1.log performance;
error_log /var/log/nginx/control-error.log;
set $mageCode "kw_en";
if ($request_uri ~ ^/ar/) {
set $mageCode 'kw_ar';
}
ssl_certificate /data/csr/customssl/control.xxx.com.crt;
ssl_certificate_key /data/csr/customssl/control.xxx.com.key;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
location ~* \.(?:png|gif|jpg|jpeg|css|js|swf|ico|txt|xml|bmp|pdf|doc|docx|ppt|pptx|zip)$ {
expires 30d;
add_header Cache-Control public;
fastcgi_hide_header Set-Cookie;
fastcgi_param HTTPS on;
#add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
}
gzip on;
gzip_types text/plain text/css text/javascript application/x-javascript application/javascript;
gzip_vary on;
#fastcgi_hide_header Set-Cookie;
include conf.d/control.xxx.com.options.inc;
# rewrites configuration
include conf.d/control.xxx.com.redirects.inc;
include conf.d/control-blockips.conf;
}
控制.xxx.com.options.inc
#listen 80;
#listen 81 ssl;
root /data/html/XXX/src;
index index.php index.html index.htm;
autoindex off;
expires off;
location @proxy {
fastcgi_pass fpm_backend;
}
location @arhandler {
rewrite / /ar/index.php;
}
location ~ (^/(app/|includes/|lib/|pkginfo/|var/|shell/|modules/|report/config.xml|\.|RELEASE_NOTES.txt|LICENSE.+|mage$)|\.(sample|sh)$) {
deny all;
return 404;
}
location ~ \.(png|gif|jpg|jpeg|css|js|swf|ico|txt|xml|bmp|pdf|doc|docx|ppt|pptx|zip)$ {
expires 1w;
try_files $uri $uri/ @proxy;
access_log off;
log_not_found on;
}
location ~ \.php$ {
try_files $uri =404;
include /etc/nginx/fastcgi_params;
fastcgi_read_timeout 900s;
fastcgi_connect_timeout 900s;
fastcgi_pass fpm_backend;
fastcgi_keep_conn on;
fastcgi_param HTTPS $fastcgi_https;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PHP_FLAG "session.auto_start=off \n suhosin.session.cryptua=off";
fastcgi_param PHP_VALUE "memory_limit=1024M \n max_execution_time=18000";
fastcgi_param MAGE_RUN_CODE $mageCode;
fastcgi_param MAGE_RUN_TYPE store;
}
location / {
try_files $uri $uri/ /index.php?$args;
}
location /ar/ {
try_files $uri $uri/ @arhandler;
}
答案1
谢谢大家的帮助。我的 IPTables 已经处于非活动状态。我尝试启动它以检查它是否有效,但仍然没有成功。但当我再次停止它时,SSL 开始工作。
奇怪,但我通过简单地重新启动 iptables 就解决了这个问题。
希望这对某人有帮助。
最好的,