关于 nginx 反向代理， HTTP 正常， HTTPS 访问报 403 错误

2020-10-12 15:11:27 +08:00
 guanyujia5444
反向代理转发的是一个 JSP 的网址，在 HTTP 访问正常，HTTPS 带证书访问就会报 403 错误，而且证书没有问题，HTTPS 转发其他页面可以正常转发，下面是配置文件，大神指导下是否需要调整参数，谢谢！


#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;


events {
worker_connections 1024;
}


http {
include mime.types;
default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;
tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

gzip on;

upstream ncc{
ip_hash;
server 10.0.3.21:9081 weight=10;
server 10.0.3.21:9082 weight=10;
server 10.0.3.21:9083 weight=10;
keepalive 300;
}


server {
listen 80;
server_name localhost;
index index.jsp;
location / {
allow all;
index index.jsp index.html;
proxy_pass http://ncc;
proxy_set_header Host $http_host;
proxy_set_header Cookie $http_cookie;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 100m;
client_body_buffer_size 256k;
proxy_buffering off;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 60;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_max_temp_file_size 128m;
}
}
server {
listen 443 ssl;
#error_page 497 301 =307 https://$host:443$request_uri;
server_name localhost;
ssl_certificate cert/piepchina.pem;
ssl_certificate_key cert/piepchina.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location / {
allow all;
index index.jsp index.html;
proxy_pass http://ncc;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Cookie $http_cookie;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Upgrade-Insecure-Requests 1;
}
}

}
5654 次点击
所在节点    NGINX
44 条回复
Lockeysama
2020-10-12 15:23:00 +08:00
还是看访问日志吧
engineercj
2020-10-12 15:25:55 +08:00
user root;
whorusq
2020-10-12 15:39:12 +08:00
ssl on;
bruce0
2020-10-12 15:41:38 +08:00
把错误 log 打开.看一下错误 log 这样最容易找到问题
zunceng
2020-10-12 16:05:00 +08:00
443 和 80 的 配置都不一样

Upgrade ？ websocket ？
simenet
2020-10-12 16:08:58 +08:00
目录 权限不够
guanyujia5444
2020-10-12 16:36:47 +08:00
@Lockeysama 访问日志无任何报错，也就是说 nginx 正常转发了，但使用证书方式转发时候，后端应用拒绝了，不知道是不是应该在 nginx 配置文件上添加参数
guanyujia5444
2020-10-12 16:38:13 +08:00
@engineercj 不是这个问题，如果是这个问题，影响是全局的，不会 80 端口正常，443 不正常
guanyujia5444
2020-10-12 16:39:41 +08:00
@whorusq ssl on 的方式，已经淘汰了，现在都是这么用
listen 443 ssl;
Citrus
2020-10-12 16:39:59 +08:00
proxy_set_header Host $http_host;

ssl 段没把 host 传过去啊
guanyujia5444
2020-10-12 16:40:44 +08:00
@zunceng 配置是有些不一样，我把 timeout 和 buffer 补上试试
guanyujia5444
2020-10-12 16:41:58 +08:00
@simenet 不是这个问题，这个是反向代理，不是作为本地 web 服务器
guanyujia5444
2020-10-12 16:44:34 +08:00
@Citrus 因为之前解决问题，有人说需要注释掉这条。。。我先补上

下面这两条意义一致吗？

# proxy_set_header Host $host:$server_port;
# proxy_set_header Host $proxy_host;
ctOS1H
2020-10-12 16:49:45 +08:00
日志
oliverchen
2020-10-12 16:51:16 +08:00
是上游根据 HOST “不合法”返回的 403 吧。试试在 ssl server 那块，也加上 `proxy_set_header Host $http_host;` 或者 `proxy_set_header Host $host;`
zunceng
2020-10-12 17:06:33 +08:00
@guanyujia5444 你把 websocket 的配置 删掉试试 就是 Upgrade 相关的
guanyujia5444
2020-10-12 17:09:05 +08:00
@zunceng 这块不太懂，是删掉如下几条吗？

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Upgrade-Insecure-Requests 1;
guanyujia5444
2020-10-12 17:11:11 +08:00
@zunceng 已经注释掉这三条，还是不行的
guanyujia5444
2020-10-12 17:13:54 +08:00
最新的配置如下，依然是 http 的 81 可以访问，https 的 8888 端口无法访问，两个转发的后端服务都是一样的。
转发的协议是 http 的。

#user nobody;
worker_processes 1;

error_log logs/error.log;
error_log logs/error.log notice;
error_log logs/error.log info;

#pid logs/nginx.pid;


events {
worker_connections 1024;
}


http {
include mime.types;
default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;
tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

gzip on;

upstream ncc{
ip_hash;
server 192.168.100.241:9081 weight=10;
server 192.168.100.241:9082 weight=10;
keepalive 300;
}



server {
listen 81;
server_name localhost;
index index.jsp;
location / {
allow all;
index index.jsp index.html;
proxy_pass http://ncc;
proxy_set_header Host $http_host;
proxy_set_header Cookie $http_cookie;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 100m;
client_body_buffer_size 256k;
proxy_buffering off;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 60;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_max_temp_file_size 128m;
}
}
server {
listen 8888 ssl;
#error_page 497 301 =307 https://$host:443$request_uri;
server_name localhost;
index index.jsp;
ssl_certificate cert/2.pem;
ssl_certificate_key cert/2.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location / {
allow all;
index index.jsp index.html;
proxy_pass http://ncc;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Cookie $http_cookie;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Upgrade-Insecure-Requests 1;
client_max_body_size 100m;
client_body_buffer_size 256k;
proxy_buffering off;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 60;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_max_temp_file_size 128m;
}
}
}
xuanbg
2020-10-12 17:14:36 +08:00
加这几句：
set $ssl off;
if ($scheme = https) {
set $ssl on;
}

这是一个专为移动设备优化的页面（即为了让你能够在 Google 搜索结果里秒开这个页面），如果你希望参与 V2EX 社区的讨论，你可以继续到 V2EX 上打开本讨论主题的完整版本。

https://www.v2ex.com/t/714187

V2EX 是创意工作者们的社区，是一个分享自己正在做的有趣事物、交流想法，可以遇见新朋友甚至新机会的地方。

V2EX is a community of developers, designers and creative people.

© 2021 V2EX