nginx 使用了错误的 ssl 证书

Posted 2023-02-25

技术标签:

【中文标题】nginx 使用了错误的 ssl 证书【英文标题】：nginx using wrong ssl certificate 【发布时间】：2014-12-18 11:32:02 【问题描述】：

我将 nginx 设置为使用子域为多个站点提供服务。我将第一个设置为使用 ssl 如下：

ssl on;
ssl_certificate        /etc/nginx/certs/subdomain1.domain.crt;
ssl_certificate_key    /etc/nginx/certs/subdomain1.domain.key;

每当连接到https://subdomain1.domain.tld 时，这都非常有效。但是，为另一个子域定义一个类似的规范以使用 ssl 使得 nginx 始终为用户提供 subdomain1.domain.crt，而不是提供足够的证书......

在 nginx 中启用了服务器名称指示 (SNI)，我仔细检查了证书路径.. 可能是什么问题？

作为参考，我查看了 [1] 中描述的教程，它确实符合我的设置。

[1]https://www.digitalocean.com/community/tutorials/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-nginx-on-ubuntu-12-04

完整的 nginx 配置文件如下：

server 
       listen         80;
       server_name    subdomain1.domain.tld;
       return         301 https://$server_name$request_uri;


server 

    listen subdomain1.domain.tld:443;
    server_name subdomain1.domain.tld;

    ssl on;
    ssl_certificate        /etc/nginx/certs/subdomain1.domain.tld.crt;
    ssl_certificate_key    /etc/nginx/certs/subdomain1.domain.tld.key;

    root /usr/share/nginx/www/subdomain1.domain.tld;
    index index.php index.html index.htm;

    location ~ \.php$ 

        fastcgi_pass unix:/etc/php5/fpm/socks/ssl_subdomain1.domain.tld.sock;
        include fastcgi_params;
        fastcgi_param HTTPS on;

    

    location ~ /\. 
        deny all;
    

    access_log /home/clients_ssl/subdomain1.domain.tld/logs/access.log;
    error_log /home/clients_ssl/subdomain1.domain.tld/logs/error.log;
    error_page 404 /404.html;

另外一个其实是为gitlab服务的：

upstream gitlab 
  server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;


server 
  listen 443;         
  server_name gitlab.domain.tld;     
  server_tokens off;     # don't show the version number, a security best practice
  root /home/git/gitlab/public;

  ssl on;
  ssl_certificate        /etc/nginx/certs/gitlab.domain.tld.crt;
  ssl_certificate_key    /etc/nginx/certs/gitlab.domain.tld.key;


  # individual nginx logs for this gitlab vhost
  access_log  /var/log/nginx/gitlab_access.log;
  error_log   /var/log/nginx/gitlab_error.log;

  location / 
    # serve static files from defined root folder;.
    # @gitlab is a named location for the upstream fallback, see below
    try_files $uri $uri/index.html $uri.html @gitlab;
  

  # if a file, which is not found in the root folder is requested,
  # then the proxy pass the request to the upsteam (gitlab unicorn)
  location @gitlab 
    proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
    proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694
    proxy_redirect     off;

    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_set_header   Host              $http_host;
    proxy_set_header   X-Real-IP         $remote_addr;

    proxy_pass http://gitlab;

此外，我的 nginx.conf 相当标准：

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events 
    worker_connections 768;
    # multi_accept on;


http  

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    gzip on;
    gzip_disable "msie6";

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

【问题讨论】：

【参考方案1】：

遵循#nginx @ freenode 上给出的建议，我只是改变了