用于Node.js服务器的Nginx反向代理SSL_ERROR_RX_RECORD_TOO_LONG

Question

我正在使用AWS Beanstalk配置多容器docker环境，以同时为运行在端口3000上的NodeJS Server和我的PHP Docker Application提供服务。

我有一个正在运行的Express Server，正在端口3000上监听。现在，我希望能够在https://my-domain.com:3000调用我的NodeJS服务器。 Nginx现在应该终止SSL连接，并将所有traffix转发到我的NodeJS Express服务器。

到目前为止，无论是否使用https，我都可以成功访问我的PHP应用程序。我也可以在http://my-domain.com:3000到达没有SSL的NodeJS应用程序。但是，只要我用https调用它，就会收到Broser错误SSL_ERROR_RX_RECORD_TOO_LONG。

Nginx配置文件看起来像这样：

log_format healthd '$msec"$uri"'
          '$status"$request_time"$upstream_response_time"'
          '$http_x_forwarded_for';

upstream nodejs {
    server 127.0.0.1:3000;
    keepalive 256;
}

server {
    listen 80;
    listen [::]:80;
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name localhost my-domain.com

    ssl_certificate /etc/nginx/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/nginx/certs/nginx-selfsigned.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_stapling on;
    ssl_stapling_verify on;

    if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {
        set $year $1;
        set $month $2;
        set $day $3;
        set $hour $4;
    }

    access_log /var/log/nginx/access.log main;
    access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://nodejs;
        proxy_redirect off;
    }
}

server {
    listen 80;
    listen [::]:80;
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;

    server_name localhost my-domain.com;
    root /var/www/public;

    ssl_certificate /etc/nginx/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/nginx/certs/nginx-selfsigned.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_stapling on;
    ssl_stapling_verify on;

    if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {
        set $year $1;
        set $month $2;
        set $day $3;
        set $hour $4;
    }

    access_log /var/log/nginx/access.log main;
    access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;

    index index.php index.html index.htm;

    if ($ssl_protocol = "") {
        rewrite ^ https://$host$request_uri? permanent;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ [^/]\.php(/|$) {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;

        fastcgi_pass php:9000;
        fastcgi_index index.php;
    }
}

Answer 1

请尝试将TLS1.2添加到支持的TLS协议列表中。

ssl_protocols TLSv1.2 TLSv1.3;

您可以使用openssl cli检查受支持的TLS版本。
openssl s_client -connect my-domain.com:443 -tls1_2

如果获得证书链，并且支持TLS版本的握手。