Nginx反向代理，当后端为Https时的一些细节和原理

1
2
3
4
5
6
7

Syntax:	proxy_ssl_server_name on | off;
Default:	
proxy_ssl_server_name off;
Context:	http, server, location
This directive appeared in version 1.7.0.

Enables or disables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) when establishing a connection with the proxied HTTPS server.

1
2
3
4
5
6
7

    server {
        listen       80;
        server_name  www.dianduidian.com;
        location / {
          proxy_pass https://blog.dianduidian.com;
        }
    }

1
2
3
4
5
6
7

Syntax:	proxy_ssl_verify on | off;
Default:	
proxy_ssl_verify off;
Context:	http, server, location
This directive appeared in version 1.7.0.

Enables or disables verification of the proxied HTTPS server certificate.

1

 curl  https://curl.se/ca/cacert.pem  -o /etc/nginx/conf.d/cacert.pem

1
2
3
4
5
6
7
8
9

    server {
        listen       80;
        server_name  www.dianduidian.com;
        location / {
          proxy_pass https://blog.dianduidian.com;
          proxy_ssl_verify on;
          proxy_ssl_trusted_certificate /etc/nginx/conf.d/cacert.pem;          
        }
    }

1

2022/05/18 16:52:14 [error] 20325#1337445: *23 upstream SSL certificate verify error: (18:self signed certificate) while SSL handshaking to upstream, client: 127.0.0.1, server: sni.dianduidian.com, request: "GET / HTTP/1.1", upstream: "https://47.100.x.x:443/", host: "sni.dianduidian.com"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

static void
ngx_http_upstream_ssl_handshake(ngx_http_request_t *r, ngx_http_upstream_t *u,
    ngx_connection_t *c)
{
    long  rc;

    if (c->ssl->handshaked) {

        if (u->conf->ssl_verify) {
            rc = SSL_get_verify_result(c->ssl->connection);

            if (rc != X509_V_OK) {
                ngx_log_error(NGX_LOG_ERR, c->log, 0,
                              "upstream SSL certificate verify error: (%l:%s)",
                              rc, X509_verify_cert_error_string(rc));
                goto failed;
            }

            if (ngx_ssl_check_host(c, &u->ssl_name) != NGX_OK) {
                ngx_log_error(NGX_LOG_ERR, c->log, 0,
                              "upstream SSL certificate does not match \"%V\"",
                              &u->ssl_name);
                goto failed;
            }
        }

        c->write->handler = ngx_http_upstream_handler;
        c->read->handler = ngx_http_upstream_handler;

        ngx_http_upstream_send_request(r, u, 1);

        return;
    }

    if (c->write->timedout) {
        ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_TIMEOUT);
        return;
    }

failed:

    ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

    server {
        listen       80;
        server_name  www.dianduidian.com;
        location / {
          proxy_pass https://blog.dianduidian.com;
          proxy_ssl_verify on;
          proxy_ssl_trusted_certificate /etc/nginx/conf.d/cacert.pem;  
          proxy_ssl_server_name on;
        }
    }

1
2
3
4
5
6
7
8
9

Syntax:	proxy_ssl_name name;
Default:	
proxy_ssl_name $proxy_host;
Context:	http, server, location
This directive appeared in version 1.7.0.

Allows overriding the server name used to verify the certificate of the proxied HTTPS server and to be passed through SNI when establishing a connection with the proxied HTTPS server.

By default, the host part of the proxy_pass URL is used.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    server {
        listen       80;
        server_name  www.dianduidian.com;
        location / {
          proxy_pass https://blog.dianduidian.com;
          proxy_ssl_verify on;
          proxy_ssl_trusted_certificate /etc/nginx/conf.d/cacert.pem;  
          proxy_ssl_server_name on;
          proxy_ssl_name www.baidu.com;
        }
    }