我有一个 Django Web 应用程序与另一台服务器共享外部端口 80 和 443。localhost
在没有反向代理的情况下运行良好,但是当启用它时,我遇到各种错误。
如何使反向代理正常工作?
反向代理配置文件:
# SSL Certificate and other SSL configurations
SSLProxyEngine on
ProxyRequests on
SSLProxyVerify require
SSLProxyCheckPeerCN on
SSLProxyCheckPeerName on
SSLProxyCheckPeerExpire on
ProxyPreserveHost on
RequestHeader set X-Forwarded-Proto https
# Reverse Proxy Configuration
ProxyPass "/" "https://192.168.1.83/"
ProxyPassReverse "/" "https://192.168.1.83/"
# Additional SSL configurations if needed
我将所有重定向http
到https
并在我的 ssl-https conf 文件中包括上述代理。网站运行正常没有包含(即Include .../reverse-proxy.conf
注释掉)。 当包含反向代理时,我得到:
[Thu Jan 18 07:09:39.835368 2024] [ssl:error] [pid 46505:tid 133251102926528] [remote 192.168.1.83:443] AH02039: Certificate Verification: Error (20): unable to get local issuer certificate
[Thu Jan 18 07:09:39.835470 2024] [ssl:error] [pid 46505:tid 133251102926528] [remote 192.168.1.83:443] AH02040: Certificate Verification: Certificate Chain too long (chain has 2 certificates, but maximum allowed are only 1)
[Thu Jan 18 07:09:39.835773 2024] [proxy:error] [pid 46505:tid 133251102926528] (20014)Internal error (specific information not available): [client 119.74.38.81:51224] AH01084: pass request body failed to 192.168.1.83:443 (192.168.1.83), referer: https://acupunctureclassique.duckdns.org/
[Thu Jan 18 07:09:39.835832 2024] [proxy:error] [pid 46505:tid 133251102926528] [client 119.74.38.81:51224] AH00898: Error during SSL Handshake with remote server returned by /login/, referer: https://acupunctureclassique.duckdns.org/
[Thu Jan 18 07:09:39.835861 2024] [proxy_http:error] [pid 46505:tid 133251102926528] [client 119.74.38.81:51224] AH01097: pass request body failed to 192.168.1.83:443 (192.168.1.83) from 119.74.38.81 (), referer: https://acupunctureclassique.duckdns.org/
在前端:
Proxy Error
The proxy server could not handle the request
Reason: Error during SSL Handshake with remote server
Apache/2.4.58 (Ubuntu) Server at acupunctureclassique.duckdns.org Port 443
更新:
apachectl -S
VirtualHost configuration:
*:443 acupunctureclassique.duckdns.org (/etc/apache2/sites-enabled/acu-le-ssl.conf:2)
*:80 acupunctureclassique.duckdns.org (/etc/apache2/sites-enabled/acu.conf:1)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33 not_used
Group: name="www-data" id=33 not_used
答案1
经过聊天讨论后,这里的实际问题是,用户使用 nginx 将流量代理到同一个 nginx 实例,从而创建一个整齐的重定向循环,最终导致标头错误消息过大。
您将流量发送到https://192.168.1.83
。您声称这是 Let's encrypt 颁发的证书,但 LE 会绝不颁发证书192.168.1.83
,任何公共 CA 也不会颁发此类证书。请记住,有效的证书还不够,有以匹配预期名称 - 在本例中为192.168.1.83
。您的日志对此也非常明确。
您有以下几种选择:
- 使用 HTTP
- 使用自签名证书,并让 Apache 信任它
SSLProxyCACertificate
指示。 - 使用有效的域名并获取该域名的有效证书。域名可能解析为
192.168.1.83
,也可能添加到/etc/hosts
,但 Apache将要匹配证书中的主机名和通用名称(或 SAN)。 - 禁用使用姓名验证
SSLProxyCheckPeerName = off
使用以下方式禁用验证SSLProxyVerify = none
,有效地禁用验证。这或多或少相当于使用 http...
答案2
要进行反向代理,您需要在 /etc/apache2/sites-available 中创建一个虚拟主机。下面是此类 VirtualHost 配置的示例
<VirtualHost *:80>
ServerName yourdomain.com
ServerAlias www.yourdomain.com
DocumentRoot /path/to/your/django/static/files
Alias /static/ /path/to/your/django/static/files/
<Directory /path/to/your/django/static/files>
Require all granted
</Directory>
ProxyPass / http://localhost:8000/
ProxyPassReverse / http://localhost:8000/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
<VirtualHost *:443>
ServerName yourdomain.com
ServerAlias www.yourdomain.com
DocumentRoot /path/to/your/django/static/files
Alias /static/ /path/to/your/django/static/files/
<Directory /path/to/your/django/static/files>
Require all granted
</Directory>
SSLEngine on
SSLCertificateFile /path/to/your/ssl/certificate.crt
SSLCertificateKeyFile /path/to/your/ssl/private.key
SSLCertificateChainFile /path/to/your/ssl/chainfile.pem
ProxyPass / https://localhost:8000/
ProxyPassReverse / https://localhost:8000/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
https 部分是可选的,如果不需要 https,可以省略它