Nginx 在一段时间后无法验证上游证书

2024-5-31 • tag-icon

我在 wildfly 应用服务器前面运行了一个 nginx 代理服务器。两者通过 https 进行通信。Nginx 配置为验证上游证书的签名：

listen 443 ssl http2;
server_name _;
ssl_certificate_key /etc/nginx/ssl/private/ssl.key.pem;
ssl_password_file   /etc/nginx/ssl/private/ssl.key.passphrase.txt;
proxy_ssl_verify on;
proxy_ssl_trusted_certificate /tmp/chain.crt;
proxy_ssl_verify_depth  10;

ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         HIGH:!aNULL:!MD5;
proxy_buffering off;
error_log /proc/self/fd/2;
access_log /proc/self/fd/1;

# some routes omitted

location /orbis-4u/ {
    proxy_pass  https://trrswv056.agfahealthcare.com:8843/orbis-4u/;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Port 443;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

几个小时/几天内一切正常。经过一段随机时间后，nginx 开始抛出验证错误：

proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:11 ev:0001 d:00007FEFC638EB60
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 8718
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: worker cycle
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13649
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0004 d:00007FEFC638EA71
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 2
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: worker cycle
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13647
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0005 d:00007FEFC638EA71
proxy                       | 2017/04/03 14:40:12 [error] 12#12: *2424 upstream SSL certificate verify error: (19:self signed certificate in certificate chain) while SSL handshaking to upstream, client: 172.25.33.10, server: _, request: "GET /orbis-4u/application.wadl HTTP/2.0", upstream: "https://172.25.32.6:8843/orbis-4u/application.wadl", host: "trrsuv042.agfahealthcare.com", referrer: "https://trrsuv042.agfahealthcare.com/auth/realms/orbis/protocol/openid-connect/auth?response_type=code&client_id=orbis-u-webclient&redirect_uri=https%3A%2F%2Ftrrsuv042.agfahealthcare.com%2Forbis-4u%2Fapplication.wadl&state=e6df5055-c90f-44c4-8422-2a108a6241cc&login=true&scope=openid"
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 4
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: posted event 00007FEFC57314A0
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: worker cycle
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13643
proxy                       | 172.25.33.10 - - [03/Apr/2017:14:40:12 +0200] "GET /orbis-4u/application.wadl HTTP/2.0" 502 640 "https://trrsuv042.agfahealthcare.com/auth/realms/orbis/protocol/openid-connect/auth?response_type=code&client_id=orbis-u-webclient&redirect_uri=https%3A%2F%2Ftrrsuv042.agfahealthcare.com%2Forbis-4u%2Fapplication.wadl&state=e6df5055-c90f-44c4-8422-2a108a6241cc&login=true&scope=openid" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36"
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:11 ev:0001 d:00007FEFC638EB60
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 61
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: worker cycle
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13582
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0004 d:00007FEFC638EA70
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 1
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: worker cycle
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13581
proxy                       | 172.25.33.10 - - [03/Apr/2017:14:40:12 +0200] "GET /favicon.ico HTTP/2.0" 502 640 "https://trrsuv042.agfahealthcare.com/orbis-4u/application.wadl" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36"
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0005 d:00007FEFC638EA70
proxy                       | 2017/04/03 14:40:12 [error] 12#12: *2424 upstream SSL certificate verify error: (19:self signed certificate in certificate chain) while SSL handshaking to upstream, client: 172.25.33.10, server: _, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.25.32.6:8843/favicon.ico", host: "trrsuv042.agfahealthcare.com", referrer: "https://trrsuv042.agfahealthcare.com/orbis-4u/application.wadl"
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 4
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: posted event 00007FEFC57314A0
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: worker cycle
proxy                       | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13577

当我重新启动时，它又可以正常工作了（至少在一段时间内）。该/tmp/chain.crt文件具有以下内容：

上游返回正确的证书链：

openssl s_client -connect trrswv056.agfahealthcare.com:8843
CONNECTED(00000003)
depth=2 CN = ORBIS-ROOT-CERTIFICATE
verify return:1
depth=1 CN = demo
verify return:1
depth=0 CN = trrswv056.agfahealthcare.com
verify return:1
---
Certificate chain
 0 s:/CN=trrswv056.agfahealthcare.com
   i:/CN=demo
 1 s:/CN=demo
   i:/CN=ORBIS-ROOT-CERTIFICATE
 2 s:/CN=ORBIS-ROOT-CERTIFICATE
   i:/CN=ORBIS-ROOT-CERTIFICATE
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIExDCCAqygAwIBAgICEAUwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEZGVt
bzAeFw0xNzAzMDcwODI1MTJaFw0yNzAzMDUwODI1MTJaMCcxJTAjBgNVBAMMHHRy
cnN3djA1Ni5hZ2ZhaGVhbHRoY2FyZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQCwdJ+Ab6yhhkVXNSuX6aI/mMkcPvDo6rslrRJxvCEvmBQOaTVt
Cn29xby3B4MEBEDGpLQ8ihbJKnoQUxE50yfbb+XAu1b5T8Zg5Fo3mxQd6lp6otAC
0Ff5pw9wH8TBLkF6iRKMVceremivC4yW9FwSUJIaci2yuld7YFebSOrOVVkbRG+4
+ch6yXV/VVlape0u8wris9+fOsOGYV//Kj4BHw5iDCFO9bIefESsWj0eNxD/SYNP
dnwFmk88ITCI3BXneG/Sz7g0RxWui+dzhhYtOIA/FMcLnkTJDmV988WqRSHVsBZS
1vGfNuyceDZc1hFQLZOghGvP6TySf9oZwqUxAgMBAAGjggEQMIIBDDAJBgNVHRME
AjAAMBEGCWCGSAGG+EIBAQQEAwIGQDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBH
ZW5lcmF0ZWQgU2VydmVyIENlcnRpZmljYXRlMB0GA1UdDgQWBBQ9Yxm91o8zsMY5
aasQpIL61zGPVTBKBgNVHSMEQzBBgBQDxGBBTFAr9ji0cw46imHmY3GLMaElpCMw
ITEfMB0GA1UEAwwWT1JCSVMtUk9PVC1DRVJUSUZJQ0FURYICEAUwDgYDVR0PAQH/
BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcGA1UdEQQgMB6CHHRycnN3djA1
Ni5hZ2ZhaGVhbHRoY2FyZS5jb20wDQYJKoZIhvcNAQELBQADggIBAMEVQ/3clniF
8J0KV51iEifmCruntHDudRaam3Mr7CqOo1+1kG6pH6ECMg1nMICrO/LJnscXbN4h
xDDWPEIEnWh0frQtmua4NABlAYQXY41JVBcajb0lvcGygop/kw4nxLSgySjd1jtZ
5MFCLo2BLg/Wqfn64gvoF4oF63eC1Cfi9PxqrDqdI6Dp/UqChhB1Q60cZC4rVjwM
o0uUW3X+g/Yy9ssA4X65d9KaJQSXBhTZO2yRKVZrjEEx3uSz49Touw/t6uRRl1o8
oAsO/RcN/uZvRdP/9lXRcnBERxldVzWFOxv6QUwNbHIUwQmX4kg65W5MteKikp+q
eX0YmB0HRKlNQHVoS/MqAufnMGX/ujIz+2WJFif0VsG1j5GoXJgPwMEwRLZNCjLG
0SWMTMO56WRp1Me2KBCsohmNPC81Fr/xSfW86SOh1XaxQJmiBh/jOjLMVcFIXjk2
yPvvjPjMqcC5NHyQ6NGStf4fYliBHTWrp3mLdStvElfMjrVzC5ykCEmrEFoGYPKo
SiGJ2JyczNVgc0P/gPhWgFcUCM4f6o3yM+/BEM3Fnb4ZzaepYmj2DolVnPGE1POq
al+kcmzru1eh3AHz+fqt+ZKdrvaXW0Tzv6SNwDqmAh2xgfUVROI3yq1KdtzkcuRE
mEccxp95Zuath6FrCf31xPUo5GXxwVQl
-----END CERTIFICATE-----
subject=/CN=trrswv056.agfahealthcare.com
issuer=/CN=demo
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4337 bytes and written 433 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 58E249C1A8D2311CDD1CE823EBD07E7E80855A7D40298581CFB0802503C868E3
    Session-ID-ctx: 
    Master-Key: 7A3D1E88CC714B23EE93830B69534E3AA70BDBD2FB4FA6AC38D18622DC569CCF3993934352DE509F21A77A8CD7775BAB
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1491225025
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

Nginx 的版本是 1.11.10，在 Docker 容器（Alpine linux）内运行。

我的问题是：

为什么 nginx 一段时间后无法验证我的证书？
有办法调试吗？如您所见，我已打开调试日志……但它并没有真正起到帮助作用。

相关内容