☰

在 Nginx 上安装商业通配符 SSL 证书

tag-icon • tag-icon ubuntu nginx amazon-web-services ssl-certificate godaddy
在 Nginx 上安装商业通配符 SSL 证书

我正在尝试在 AWS Lightsail (Ubuntu/Nginx) 上安装 Godaddy 通配符 SSL 证书。这nginx.conf主要是使用 nginx 安装的默认证书...

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
     worker_connections 768;
}

http {
     server {
             listen              80;
             listen              443 ssl;
             ssl                 on;
             server_name         sub.domain.com;
             ssl_certificate     /etc/ssl/ssl-bundle.crt;
             ssl_certificate_key /etc/ssl/privatekey.key;
             root                /var/www/html;

             ##
             # SSL Settings
             ##
             ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
             ssl_prefer_server_ciphers on;
     }

     ##
     # Basic Settings
     ##
     sendfile on;
     tcp_nopush on;
     tcp_nodelay on;
     keepalive_timeout 65;
     types_hash_max_size 2048;
     # server_tokens off;

     # server_names_hash_bucket_size 64;
     # server_name_in_redirect off;

      include /etc/nginx/mime.types;
      default_type application/octet-stream;

      ##
      # Logging Settings
      ##
      access_log /var/log/nginx/access.log;
      error_log /var/log/nginx/error.log debug;

      ##
      # Gzip Settings
      ##
      gzip on;
      # gzip_vary on;
      # gzip_proxied any;
      # gzip_comp_level 6;
      # gzip_buffers 16 8k;
      # gzip_http_version 1.1;
      # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

      ##
      # Virtual Host Configs
      ##
      include /etc/nginx/conf.d/*.conf;
      include /etc/nginx/sites-enabled/*;
}

我做了一个sudo nginx -t，一切看起来都很好，所以我重新启动了 nginx。在浏览器中，我收到“无法访问此站点”的提示。当我执行 curl 时，它挂起了。我已为 error.log 打开了调试，因此现在我收到这样的错误...

2019/03/30 22:08:13 [debug] 11579#11579: accept on 0.0.0.0:80, ready: 0
2019/03/30 22:08:13 [debug] 11579#11579: posix_memalign: 0000557BF61CDE90:512 @16
2019/03/30 22:08:13 [debug] 11579#11579: *2 accept: 212.105.165.121:55888 fd:3
2019/03/30 22:08:13 [debug] 11579#11579: *2 event timer add: 3: 60000:1079834032
2019/03/30 22:08:13 [debug] 11579#11579: *2 reusable connection: 1
2019/03/30 22:08:13 [debug] 11579#11579: *2 epoll add event: fd:3 op:1 ev:80002001
2019/03/30 22:08:26 [debug] 11579#11579: *2 http wait request handler
2019/03/30 22:08:26 [debug] 11579#11579: *2 malloc: 0000557BF61CE8A0:1024
2019/03/30 22:08:26 [debug] 11579#11579: *2 recv: eof:1, avail:1
2019/03/30 22:08:26 [debug] 11579#11579: *2 recv: fd:3 0 of 1024
2019/03/30 22:08:26 [info] 11579#11579: *2 client closed connection while waiting for request, client: 212.105.165.121, server: 0.0.0.0:80
2019/03/30 22:08:26 [debug] 11579#11579: *2 close http connection: 3
2019/03/30 22:08:26 [debug] 11579#11579: *2 event timer del: 3: 1079834032
2019/03/30 22:08:26 [debug] 11579#11579: *2 reusable connection: 0
2019/03/30 22:08:26 [debug] 11579#11579: *2 free: 0000557BF61CE8A0
2019/03/30 22:08:26 [debug] 11579#11579: *2 free: 0000557BF61CDE90, unused: 120

知道为什么这不起作用吗？

答案1

服务器块通常位于基本设置下方或通过以下方式出现：

包括/etc/nginx/conf.d/.conf；或包含 /etc/nginx/sites-enabled/；

并且之前没有对 nginx http 块进行基本设置，所以我会将其作为起点进行尝试。即。https://www.nginx.com/resources/wiki/start/topics/examples/full/

还：

监听 443 ssl；ssl 开启；

是多余的：ssl on; 是启用 ssl 的旧方法，我会删除它。listen 443 ssl; 是当前的做法。

相关内容