![Chrome err_spdy_protocol_error 和 Firefox 使用 spdy 而没有相应的标头](https://linux22.com/image/738191/Chrome%20err_spdy_protocol_error%20%E5%92%8C%20Firefox%20%E4%BD%BF%E7%94%A8%20spdy%20%E8%80%8C%E6%B2%A1%E6%9C%89%E7%9B%B8%E5%BA%94%E7%9A%84%E6%A0%87%E5%A4%B4.png)
在 Chrome 上,当我调用我的网页时,我得到了一个 err_spdy_protocol_error 页面。此外,还抛出了 nginx ssl 握手错误。这让我开始思考,为什么 Chrome 使用 SPDY 来调用我的页面,为什么会失败?此外,我注意到,虽然页面在 Firefox 上运行完全正常,但它会发送一个X-Firefox-Spdy
带有值为 的响应的h2
。我不知道为什么它使用 SPDY 协议,而且,为什么它会在 Chrome 和 Safari 上导致错误。
这是我当前的 nginx 配置,它充当 docker 容器中 nginx 实例的代理:
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name MYDOMAIN;
ssl on;
ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_dhparam /etc/letsencrypt/live/MYDOMAIN/dh.pem;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=86400;" always;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/MYDOMAIN/chain.pem;
add_header X-Frame-Options "SAMEORIGIN";
add_header x-xss-protection "1; mode=block" always;
location / {
proxy_pass http://laradock;
}
}
我使用的 SSL 证书和配置在其他几个子域上运行正常,没有任何问题。
我使用以下代理上游:
proxy_http_version 1.1;
proxy_ssl_server_name on;
proxy_ssl_session_reuse off;
proxy_pass_header Server;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
proxy_set_header X-Scheme $scheme;
proxy_set_header Proxy "";
proxy_ssl_trusted_certificate /etc/letsencrypt/live/MYDOMAIN/cert.pem;
proxy_redirect http:// https://;
add_header Front-End-Https on;
upstream laradock {
server 127.0.0.1:8089 fail_timeout=0;
}
proxy_read_timeout 1800;
proxy_ignore_client_abort on;
proxy_busy_buffers_size 16k;
proxy_headers_hash_max_size 512;
proxy_buffering on;
proxy_cache_bypass $http_pragma $http_authorization $cookie_nocache;
open_file_cache max=10000 inactive=30s;
open_file_cache_valid 60s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
client_max_body_size 500M;
client_body_buffer_size 128;
types_hash_max_size 4096;
此代理配置存储在 /etc/nginx/snippets/proxy.conf 中,我已手动将其包含在 /etc/nginx/nginx.conf 中。我的 laradock nginx 配置(主系统上的 nginx 代理所有请求的 nginx 实例)用于在该子域上提供我的 php 文件,其配置如下:
server {
listen 80;
listen [::]:80;
server_name MYDOMAIN;
root /var/www/MYDOMAIN/public;
index index.php;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
try_files $uri $uri/ =404;
fastcgi_pass php-upstream;
fastcgi_index index.php;
fastcgi_buffers 16 16k;
fastcgi_buffer_size 32k;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#fixes timeouts
fastcgi_read_timeout 600;
include fastcgi_params;
}
location ~ /\.ht {
deny all;
}
location /.well-known/acme-challenge/ {
root /var/www/letsencrypt/;
log_not_found off;
}
error_log /var/log/nginx/laravel_error.log;
access_log /var/log/nginx/laravel_access.log;
}
注意,我提供的不是 laravel,而是常规的 php 文件。通过 chrome 调用页面时,我的第一个 nginx 配置(用作代理的配置)记录了以下错误:
[crit] 15700#15700: *41339 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: X, server: X
其次是:
[crit] 15700#15700: *41437 SSL_do_handshake() failed (SSL: error:1417D102:SSL routines:tls_process_client_hello:unsupported protocol) while SSL handshaking, client: X, server: X
在我的 php 文件中,我向响应添加了以下标头:
header_remove();
header("Cache-Control: max-age=0,no-cache,must-revalidate");
header('Access-Control-Allow-Origin: https://MYOTHERDOMAIN');
header("Connection: keep-alive");
header('Content-Type: application/json');
header('charset=UTF-8');
我如何才能消除 Chrome 中的 SSL 握手错误和 SPDY 协议错误(或者完全禁用 SPDY?)。
我知道已经有很多问题在讨论可能的 SPDY 错误原因,但它们都对我没用。