nginx C 根据同一vhost中访问的主机名自动选择SSL证书

发布时间：2023-12-19 11:51:59 所属栏目：Nginx 来源：DaWei

导读： 我正在使用nginx通过SSL本地连接为我的Nextcloud实例提供服务(在这种情况下,域称为nextclowd.raspi.local,它使用的是自签名证书).
现在我想让它通过DDNS域访问,我想用SSL加密(我已经为该域

我正在使用nginx通过SSL本地连接为我的Nextcloud实例提供服务(在这种情况下,域称为nextclowd.raspi.local,它使用的是自签名证书).
现在我想让它通过DDNS域访问,我想用SSL加密(我已经为该域生成了Let的加密证书).
但现在我遇到了使用这两个证书的问题.我也可以将DDNS证书用于我的本地连接,但这总是会引发警告,因为证书与域不匹配.
我还想避免定义两个vhost条目(因为配置冗余).我也读过关于SNI的事情,但从我能够理解的是,这不是我想要的东西.

是否有可能使nginx根据在同一个vhost上访问的域选择正确的SSL证书？

这是我当前的vhost文件供参考：

server { listen 80; server_name nextclowd.raspi.local mydomain.ddns.net; # enforce https return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name nextclowd.raspi.local mydomain.ddns.net; # My self-signed SSL certificate #ssl_certificate /etc/nginx/ssl/server.crt; #ssl_certificate_key /etc/nginx/ssl/server.key; # My Let's Encrypt SSL certificate ssl_certificate /etc/letsencrypt/live/mydomain.ddns.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/mydomain.ddns.net/privkey.pem; # Add headers to serve security related headers # Before enabling Strict-Transport-Security headers please read into this # topic first. # add_header Strict-Transport-Security "max-age=15768000; # includeSubDomains; preload;"; # # WARNING: Only add the preload option once you read about # the consequences in https://hstspreload.org/. This option # will add the domain to a hardcoded list that is shipped # in all major browsers and getting removed from this list # could take several months. add_header X-Content-Type-Options nosniff; #add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; # Path to the root of your installation root /var/www/nextcloud/; location = /robots.txt { allow all; log_not_found off; access_log off; } # The following 2 rules are only needed for the user_webfinger app. # Uncomment it if you're planning to use this app. #rewrite ^/.well-known/host-meta /public.php?service=host-meta last; #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json # last; location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; } location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; } # set max upload size client_max_body_size 512M; fastcgi_buffers 64 4K; # Disable gzip to avoid the removal of the ETag header gzip off; # Uncomment if your server is build with the ngx_pagespeed module # This module is currently not supported. #pagespeed off; location / { rewrite ^ /index.php$uri; } location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { deny all; } location ~ ^/(?:.|autotest|occ|issue|indie|db_|console) { deny all; } location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34]).php(?:$|/) { fastcgi_split_path_info ^(.+.php)(/.*)$; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS on; #Avoid sending the security headers twice fastcgi_param modHeadersAvailable true; fastcgi_param front_controller_active true; fastcgi_pass unix:/run/php/php7.0-fpm.sock; fastcgi_intercept_errors on; fastcgi_request_buffering off; } location ~ ^/(?:updater|ocs-provider)(?:$|/) { try_files $uri/ =404; index index.php; } # Adding the cache control header for js and css files # Make sure it is BELOW the PHP block location ~* .(?:css|js|woff|svg|gif)${ try_files $uri /index.php$uri$is_args$args; add_header Cache-Control "public,max-age=7200"; # Add headers to serve security related headers (It is intended to # have those duplicated to the ones above) # Before enabling Strict-Transport-Security headers please read into # this topic first. # add_header Strict-Transport-Security "max-age=15768000; # includeSubDomains; preload;"; # # WARNING: Only add the preload option once you read about # the consequences in https://hstspreload.org/. This option # will add the domain to a hardcoded list that is shipped # in all major browsers and getting removed from this list # could take several months. add_header X-Content-Type-Options nosniff; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; # Optional: Don't log access to assets access_log off; } location ~* .(?:png|html|ttf|ico|jpg|jpeg)${ try_files $uri /index.php$uri$is_args$args; # Optional: Don't log access to other assets access_log off; } } 最佳答案使用两个服务器块,但将公共指令移动到单独的文件中.使用include指令将新文件拉入每个服务器块.有关更多信息,请参见this document

例如：

server { listen 443 ssl; server_name nextclowd.raspi.local; # My self-signed SSL certificate ssl_certificate /etc/nginx/ssl/server.crt; ssl_certificate_key /etc/nginx/ssl/server.key; include /path/to/common/config; } server { listen 443 ssl; server_name mydomain.ddns.net; # My Let's Encrypt SSL certificate ssl_certificate /etc/letsencrypt/live/mydomain.ddns.net/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/mydomain.ddns.net/privkey.pem; include /path/to/common/config; }

不要将公共文件放入nginx已用于包含通配符的目录中,例如conf.d,sites-enabled和sites-available.

（编辑：鄂州站长网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!