我正在使用 nginx 通过 SSL 的本地连接为我的 Nextcloud 实例提供服务(在这种情况下,该域被称为域nextclowd.raspi.local
,它使用自签名证书)。
现在我想通过 DDNS 域使其可访问,我也想使用 SSL 对其进行加密(我已经为该域生成了 Let's Encrypt 证书)。
但现在我无法让它使用这两个证书。我也可以将 DDNS 证书用于我的本地连接,但这总是会引发警告,因为证书与域不匹配。
我还想避免定义两个 vhost 条目(因为配置冗余)。我也阅读了有关 SNI 的内容,但从我所能理解的内容来看,这不是我想要的。
是否可以让 nginx 根据在同一个虚拟主机上访问的域选择正确的 SSL 证书?
以下是我当前的 vhost 文件,供参考:
server {
listen 80;
server_name nextclowd.raspi.local mydomain.ddns.net;
# enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
server_name nextclowd.raspi.local mydomain.ddns.net;
# My self-signed SSL certificate
#ssl_certificate /etc/nginx/ssl/server.crt;
#ssl_certificate_key /etc/nginx/ssl/server.key;
# My Let's Encrypt SSL certificate
ssl_certificate /etc/letsencrypt/live/mydomain.ddns.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.ddns.net/privkey.pem;
# Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this
# topic first.
# add_header Strict-Transport-Security "max-age=15768000;
# includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header X-Content-Type-Options nosniff;
#add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Path to the root of your installation
root /var/www/nextcloud/;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
# last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
# set max upload size
client_max_body_size 512M;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~* \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=7200";
# Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into
# this topic first.
# add_header Strict-Transport-Security "max-age=15768000;
# includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
# Optional: Don't log access to other assets
access_log off;
}
}
答案1
使用两个server
块,但将通用指令移到单独的文件中。使用指令将新文件拉入每个server
块include
。请参阅这个文件了解更多信息。
例如:
server {
listen 443 ssl;
server_name nextclowd.raspi.local;
# My self-signed SSL certificate
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
include /path/to/common/config;
}
server {
listen 443 ssl;
server_name mydomain.ddns.net;
# My Let's Encrypt SSL certificate
ssl_certificate /etc/letsencrypt/live/mydomain.ddns.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.ddns.net/privkey.pem;
include /path/to/common/config;
}
不要将公共文件放入已经用于nginx
通配符包含的目录中,例如conf.d
、sites-enabled
和sites-available
。