EC2+nginx+django+gunicorn+letsencrypt ssl->超时

EC2+nginx+django+gunicorn+letsencrypt ssl->超时

我已经苦苦思索了几个小时,并在 SE 上遇到了很多类似的问题。然而,我还是无法解决我的问题。

回答这些显而易见的问题:

  • 我的 ec2(ubuntu)实例上运行没有防火墙
  • 443 端口已开放供进出
  • 使用创建的 .ssl 文件sudo certbot certonly --standalone
  • 非加密请求工作正常
  • 我已将域的 A 记录设置为指向我的 EC2 实例的公共 DNS。但是没有命名空间记录选项。
  • 是的,我是个白痴

除了添加以下内容之外,我没有触碰过 nginx.conf 文件:

include /etc/nginx/sites-enabled/*;

我的 nginx-conf 在 /etc/nginx/sites-available/myapp.conf 中(在...../sites-enabled/myapp.conf 中有符号链接):

server {
        listen 80;
        listen 443 default ssl;   

        ssl_certificate /etc/letsencrypt/live/mydomain/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem;

        server_name mydomain;

        location /static/ {
                autoindex on;
                alias /home/ubuntu/MYAPP/static/;
        }

        location /data/ {
                autoindex off;
                alias /home/ubuntu/MYAPP/data/;
        }

        location / {
                include proxy_params;
                proxy_pass http://unix:/home/ubuntu/MYAPP/app.sock;
        }
}

在我的 APPS 的 settings.py 中我添加了:

ALLOWED_HOSTS = [
  'localhost',
  '127.0.0.1',
  'mywebsite.com']

目前,我已注释掉以下内容

#SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
#SECURE_SSL_REDIRECT = True
#SESSION_COOKIE_SECURE = True
#CSRF_COOKIE_SECURE = True

发行nc -vz localhost 443给予Connection to localhost 443 port [tcp/https] succeeded!

netstat -ntlp给出

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -   

然而,curl -v localhost:443结果

*   Trying 127.0.0.1:443...
* Connected to localhost (127.0.0.1) port 443 (#0)
> GET / HTTP/1.1
> Host: localhost:443
> User-Agent: curl/7.71.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 400 Bad Request
< Server: nginx/1.18.0 (Ubuntu)
< Date: Fri, 08 Jan 2021 15:14:04 GMT
< Content-Type: text/html
< Content-Length: 264
< Connection: close
< 
<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The plain HTTP request was sent to HTTPS port</center>
<hr><center>nginx/1.18.0 (Ubuntu)</center>
</body>
</html>
* Closing connection 0

尝试通过 https://... 访问我的域名导致超时。

编辑:正如 Steffen 指出的那样,我的 curl 命令是错误的。这是正确的命令

curl -v https://localhost:443

导致

*   Trying 127.0.0.1:443...
* Connected to localhost (127.0.0.1) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /home/ubuntu/anaconda3/ssl/cacert.pem
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=mydomain.com
*  start date: Jan  8 10:37:06 2021 GMT
*  expire date: Apr  8 10:37:06 2021 GMT
*  subjectAltName does not match localhost
* SSL: no alternative certificate subject name matches target host name 'localhost'
* Closing connection 0
* TLSv1.3 (OUT), TLS alert, close notify (256):
curl: (60) SSL: no alternative certificate subject name matches target host name 'localhost'
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

现在,/var/log/nginx/error.log 没有显示任何错误。

/var/log/nginx/access.log 

当我尝试在浏览器中通过 https 打开时,没有显示任何请求。仅使用 http,请求就会被记录下来。所以看起来请求甚至没有到达 nginx,对吗?

我以前从未使用过 nginx(或任何与服务器/后端相关的东西),而且我完全不知道。

EDIT2:我需要弹性 IP 才能工作吗?有什么建议吗?

相关内容