Nginx 反向代理适用于 Safari 和 Firefox，但不适用于 Chrome

Question

我使用 Nginx 作为反向代理将我的 Https 请求转发到后端服务器（它在同一台服务器上以 Http 协议运行，端口为 7654）。在 Safari 和 Firefox 中一切正常，但 Chrome 会抛出错误。

Chrome Error: net::ERR_CERT_AUTHORITY_INVALID

下面是我的 nginx.conf 文件。顺便说一句，当我在 Chrome 中使用 IP 地址而不是域名时，它也能正常工作。我该如何解决这个问题？

    server {
        listen       443 ssl http2 default_server;
        listen       [::]:443 ssl http2 default_server;
        server_name  mydomain.name.lan;
        root         /usr/share/nginx/html;

        ssl_certificate "/etc/pki/tls/certs/crt.crt";
        ssl_certificate_key "/etc/pki/tls/private/key.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
                try_files $uri $uri/ /index.html;
        }

        location /app/v1/ {
                proxy_pass http://localhost:7654;
                proxy_set_header Host  $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto https;
        }

    }

Answer 1

我可以给你一个工作配置的例子，它适用于我们在公司使用的所有浏览器（当前最新版本）。 TLDR 背后的故事，我们有 docker 群部署，但我们有在主机上运行的入口点 Nginx，并且在容器内有另一个 Nginx，然后将流量重定向到特定的 API 网关等等..

我们将专注于第一级 Nginx（在主机上），它实际上执行所有 SSL 检查等等。我们在 docker 中使用 http（在 pods 和容器之间)..

Working example for linux:
server_tokens off;

    server {

        listen 443 http2 ssl;

        server_name development.docker.company.si;


        add_header Strict-Transport-Security "max-age=31536000" always;

        proxy_buffering off;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;

        set $upstream_local_docker_proxy 10.10.0.2; #static location of inner nginx

        ssl_certificate /etc/tls/si.company.docker.development-chain.crt;
        ssl_certificate_key /etc/tls/si.company.docker.development-unencrypted.key;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;
        ssl_protocols TLSv1.2 TLSv1.3;

        #here we just have /url-location-level-routing/ , in case you want to know
        location /my-application-demo/ {
                proxy_pass http://$upstream_local_docker_proxy;
                proxy_set_header Host local.docker.company-my-application-demo;
                rewrite ^/my-application-demo/(.*) / break;
        }
    }

对于您遇到的特定情况，我有一个 windows 配置，您需要做的就是将证书的 windows 路径更改为 linux 它应该可以工作：

   worker_processes  1;
  
   events {
       worker_connections  1024;
   }

   http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;

    upstream local-company1-api {
            server localhost:5000;
    }

    server {

            listen 443 http2 ssl;

            server_name company1.company.si;


            add_header Strict-Transport-Security "max-age=31536000" always;

            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;

            ssl_certificate C:\tls\si.company.company1-chain.pem;
            ssl_certificate_key C:\tls\si.company.company1-unencrypted.pem;
            ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
            ssl_prefer_server_ciphers off;
            ssl_protocols TLSv1.2 TLSv1.3;

            # ----------------------------------------------------------------------------------------------------

            location / {

                    proxy_pass http://local-company1-api/;
                    proxy_redirect off;
            }
       }
   }

希望以上内容对您有所帮助。

Nginx 反向代理适用于 Safari 和 Firefox，但不适用于 Chrome

Nginx reverse proxy works fine with Safari and Firefox but doesn't work with Chrome

ssl

https

google-chrome

nginx

nginx-reverse-proxy