Nginx HTTPS + 反向代理配置
安装 Nginx
通过 APT 安装 Nginx。
sudo apt install nginx安装 Certbot
Certbot 官方推荐通过 Snap 安装，安装好后给 certbot 命令增加软链接方便直接使用。
sudo apt install snapd
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot配置反向代理
预期域名的跳转关系如下：
example.com -> a.example.com
a.example.com -> example.com:1111
b.example.com -> example.com:2222先在 /etc/nginx/sites-available 目录下创建 Nginx 配置。
# /etc/nginx/sites-available/a.conf
upstream a {
server 127.0.0.1:1111;
}
server {
listen 80;
listen 443 ssl;
server_name example.com;
return 301 https://a.example.com$request_uri;
}
server {
listen 80;
server_name a.example.com;
return 301 https://a.example.com$request_uri;
}
server {
listen 443 ssl;
gzip on;
server_name a.example.com;
access_log /var/log/nginx/a_access.log combined;
error_log /var/log/nginx/a_error.log;
location / {
proxy_redirect off;
proxy_pass http://a;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
}
}# /etc/nginx/sites-available/b.conf
upstream b {
server 127.0.0.1:2222;
}
server {
listen 80;
server_name b.example.com;
return 301 https://b.example.com$request_uri;
}
server {
listen 443 ssl;
gzip on;
server_name b.example.com;
access_log /var/log/nginx/b_access.log combined;
error_log /var/log/nginx/b_error.log;
location / {
proxy_redirect off;
proxy_pass http://b;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
}
}然后把配置文件软链接到 /etc/nginx/sites-enabled 目录启用配置。
sudo ln -s /etc/nginx/sites-available/a.conf /etc/nginx/sites-enabled/a.conf
sudo ln -s /etc/nginx/sites-available/b.conf /etc/nginx/sites-enabled/b.conf申请 SSL 证书
申请证书时指定域名范围，如 example.com、a.example.com、b.example.com。
sudo certbot --nginx -d "example.com" -d "a.example.com" -d "b.example.com"配置过程中 Certbot 会修改 Nginx 配置，指定证书公钥和私钥的路径。
server {
# ...
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
# ...
}后续可通过指定 --cert-name 覆盖该证书的域名范围，如新增 c.example.com 并删除 b.example.com。
sudo certbot --nginx --cert-name example.com -d "example.com" -d "a.example.com" -d "c.example.com"查看已安装证书对应的域名、过期时间、保存路径。
sudo certbot certificates
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: example.com
Domains: example.com a.example.com b.example.com
Expiry Date: 2022-12-28 11:50:04+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -证书有效期为 90 天，Certbot 会在证书过期前自动续期，可手动测试自动续期流程，如果输出 Congratulations, all renewals succeeded. 说明可正常自动续期。
sudo certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/example.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for a.example.com
http-01 challenge for b.example.com
Waiting for verification...
Cleaning up challenges
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
new certificate deployed with reload of nginx server; fullchain is
/etc/letsencrypt/live/example.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)
Congratulations, all renewals succeeded. The following certs have been renewed:
/etc/letsencrypt/live/example.com/fullchain.pem (success)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -重载 Nginx
使用以下命令检查 Nginx 配置文件，并重载 Nginx 服务。
sudo nginx -t
sudo systemctl reload nginx