我将 NGINX 设置为反向代理，以便仅使用一个 IP 地址托管多个网站。我在代理上有一个 Lets Encrypt 证书，在上游服务器上有一个不同的 Lets Encrypt 证书。基本上，我需要 NGINX 将流量转发到上游服务器并验证上游服务器是否具有有效的 TLS 证书。如果我禁用proxy_ssl_verify，它就会正常工作。如果我在我的内部网络上访问https://app.local.example.com，应用程序可以正常工作。
网络图：
https://app.example.com --> NGINX Reverse Proxy --> https://app.local.example.com (Local IP Address)
NGINX 反向代理配置文件：
server {
listen 80;
rewrite ^ https://$host$request_uri? permanent;
}
server {
server_name app.example.com;
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/app.example.com/cert.pem;
ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/app.example.com/chain.pem;
location / {
proxy_redirect off;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-HTTPS on;
proxy_ssl_session_reuse off;
proxy_ssl_name app.local.example.com
proxy_ssl_verify on;
proxy_ssl_verify_depth 2; # I've tried 1,2,3,4
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
proxy_pass https://app.local.example.com
}
}
这是我收到的错误消息。
[error] 1087#1087: *2 upstream SSL certificate verify error: (20:unable to get local issuer certificate) while SSL handshaking to upstream, client: [Client IP], server: app.example.com, request: "GET / HTTP/1.1", upstream: "https://192.168.1.5:443/", host: "app.local.example.com", referrer: "https://app.example.com/">
OpenSSL 版本：OpenSSL 1.1.1f 31 Mar 2020
nginx -v：nginx version: nginx/1.18.0 (Ubuntu)
猫/等/问题：Ubuntu 20.04.1 LTS \n \l
输出openssl s_client -connect app.local.example.com:443
CONNECTED(00000003)
depth=0 CN = app.local.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = app.local.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:CN = app.local.example.com
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFeDCCBGCgAwIBAgISA8NkbZ6wz2EnKcedXujKT9AmMA0GCSqGSIb3DQEBCwUA
...
-----END CERTIFICATE-----
...
SSL-Session:
Protocol : TLSv1.3
...
Verify return code: 21 (unable to verify the first certificate)
答案1
Certificate chain
0 s:CN = app.local.example.com
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
您的服务器配置不正确。它只发送叶证书，而不是发送叶证书（app.local.example.com）和中间证书。由于缺少中间证书，无法创建到本地信任锚的信任路径，这意味着证书验证失败，“无法获取本地发行者证书”。浏览器通常通过从其他地方获取丢失的中间证书来解决此类问题，但其他 TLS 堆栈通常不会采取这样的解决方法。
正确配置服务器后，您应该在 中看到以下内容openssl s_client。完成后，nginx 也应该可以正常工作。
Certificate chain
0 s:CN = app.local.example.com
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
答案2
我在上游服务器上将ssl_certificate值从更改cert.pem为。fullchain.pem
ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/app.example.com/chain.pem;