我的 nginx(1.20-alpine) 配置,以及文件位置:
/etc/nginx/conf.d/default.conf
access_log on;
server_tokens off;
server {
listen 80;
server_name _;
return 404;
}
/etc/nginx/conf.d/mysite.conf
server {
listen 80;
server_name a.domain.com;
...
}
server {
listen 443 ssl;
server_name a.domain.com;
ssl_certificate: xxx;
ssl_certificate_key: xxx;
...
}
server {
listen 80;
server_name b.domain.com;
...
}
server {
listen 80;
server_name c.domain.com;
...
}
只有 a.domain.com 配置了 SSL 证书,b 和 c 并没有证书,也不提供 https 服务。
这个配置下访问 http://a.domain.com ,https://a.domain.com ,http://b.domain.com ,http://c.domain.com 都很正常;
访问 https://b.domain.com 或 https://c.domain.com 时就不正常了(虽然浏览器提示风险但还是能点继续访问),会匹配到 a.domain.com 的 server ,也就是把 a.domain.com 的内容给代理出去。
添加一个配置处理 b 、a 的 https 请求,虽然有效但是感觉怪怪的;而且我不光只有 b 、c 还有很多 d 、e 、f...
#有效
server {
listen 443 ssl;
server_name b.domain.com c.domain.com;
return 404;
}
#无效
server {
listen 443 ssl;
server_name _;
return 404;
}
1
OceanBreeze 2023-10-27 11:12:11 +08:00
你 http 都知道配置 default server ,https 也一样
server { listen 443 ssl; server_name _; ssl_certificate /etc/nginx/ssl/nginx.crt; ssl_certificate_key /etc/nginx/ssl/nginx.key; return 404; } |
2
wu00 OP |
3
OceanBreeze 2023-10-27 11:28:22 +08:00 1
|
4
OceanBreeze 2023-10-27 11:29:46 +08:00
server {
server_name _; listen 80 default_server; listen 443 ssl default_server; ## To also support IPv6, uncomment this block # listen [::]:80 default_server; # listen [::]:443 ssl default_server; ssl_certificate <path to cert>; ssl_certificate_key <path to key>; return 404; # or whatever } |
5
wu00 OP @OceanBreeze https://superuser.com/questions/612560/why-a-listen-443-default-server-nginx-rule-override-already-configured-rule-ht
这个文档很有帮助,顺着找到我最想要的结果 https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake server { listen 443 ssl default_server; ssl_reject_handshake on; } |