如何配置 Nginx 以将 https 流量重定向到我的 Springboot 应用程序

【问题标题】：How to configure Nginx to redirect https traffic to my Springboot application如何配置 Nginx 以将 https 流量重定向到我的 Springboot 应用程序
【发布时间】：2019-07-26 09:01:52
【问题描述】：

我正在关注堆栈问题How can I set up a letsencrypt SSL certificate and use it in a Spring Boot application? 将我的 Springboot 应用程序配置为使用 https(certbot) 但我的 Nginx 没有正确重定向到我的应用程序。

更多上下文： 我正在使用 Cloudflare，将 www.example.com（我的域）请求重定向到我拥有 Nginx 和 Springboot 应用程序的机器。我希望 Nginx 将端口 80 上的这个 http 请求重定向到我在端口 8443 (https) 上运行的应用程序。我已经安装了 certbot (letsencrypt) 证书并使用这些证书设置了我的 nginx 配置。

生成证书后的配置如下：

Springboot 应用程序.properties

server.port=8443
security.require-ssl=true
server.ssl.key-store=/etc/letsencrypt/live/mydomain/keystore.p12
server.ssl.key-store-password=mydomain
server.ssl.keyStoreType=PKCS12
server.ssl.keyAlias=myAlias

更新 1 >> Nginx /etc/nginx/nginx.conf

pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {

    log_format formatWithUpstreamLogging '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request';

    access_log  /var/log/nginx/access.log formatWithUpstreamLogging;
    error_log   /var/log/nginx/error.log;

    server {

      listen 80;

      server_name www.example.com example.com;

      return 301 https://$server_name$request_uri;

    }

   # SSL configuration
    server {

       listen 443 ssl;
       server_name www.example.com example.com;

       ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; 
       ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

       location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass https://localhost:8443/;
       }
    }
}

nginx -T 命令的输出

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {

    log_format formatWithUpstreamLogging '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request';

    access_log  /var/log/nginx/access.log formatWithUpstreamLogging;
    error_log   /var/log/nginx/error.log;

    server {    

      listen 80;

      server_name www.example.com example.com;

      return 301 https://$server_name$request_uri;

    }

   # SSL configuration
    server {

       listen 443 ssl;
       server_name www.example.com example.com;

       ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
       ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        # managed by Certbot
       location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass https://localhost:8443/;
       }
   }
}

nginx -T 命令的输出

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {

    log_format formatWithUpstreamLogging '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request';

    access_log  /var/log/nginx/access.log formatWithUpstreamLogging;
    error_log   /var/log/nginx/error.log;

    server {    

      listen 80;

      server_name www.example.com example.com;

      return 301 https://$server_name$request_uri;

    }

   # SSL configuration
    server {

       listen 443 ssl;
       server_name www.example.com example.com;

       ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
       ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        # managed by Certbot
       location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass https://localhost:8443/;
       }
   }
}

更新 2 >>> Nginx /etc/nginx/nginx.conf

    pid /run/nginx.pid;

    events {
        worker_connections 768;
    }

    http {

        log_format formatWithUpstreamLogging '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request';

        access_log  /var/log/nginx/access.log formatWithUpstreamLogging;
        error_log   /var/log/nginx/error.log;

    server {

      listen 80;

      server_name www.codeonblue.com.br codeonblue.com.br;

       ssl_certificate /etc/letsencrypt/live/codeonblue.com.br/fullchain.pem; # managed by Certbot
       ssl_certificate_key /etc/letsencrypt/live/codeonblue.com.br/privkey.pem;

        # managed by Certbot
       location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass https://localhost:8443/;
       }


    }    
 }

当我启动 nginx 和我的 springboot 应用程序并尝试在 Chrome 中访问 www.example.com 时，我得到了这个页面（下图）

这是我尝试通过 Firefox 访问时得到的结果：

由于 /var/log/nginx/error.log 没有条目，我检查了访问日志，并且有几十个这样的请求（虽然我只做了一个请求）：

Nginx 访问日志（/var/log/nginx/access.log）

[06/Mar/2019:12:59:52 +0000] <same-IP-address> - - - www.example.com to: -: GET / HTTP/1.1

以下是卷曲结果：

curl -I https://www.example.com/

HTTP/1.1 301 Moved Permanently
Date: Wed, 06 Mar 2019 14:32:26 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: __cfduid=d330e880850b37d5a9870c1edb71ab8c01551882746; expires=Thu, 05-Mar-20 14:32:26 GMT; path=/; domain=.example.com; HttpOnly
Location: https://www.example.com/
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 4b3509fdb8e0c879-MIA

curl -I http://www.example.com/

HTTP/1.1 301 Moved Permanently
Date: Wed, 06 Mar 2019 14:32:56 GMT
Content-Type: text/html
Connection: keep-alive
Set-Cookie: __cfduid=d9e1f2908ee4037d46bffa6866549c3151551882776; expires=Thu, 05-Mar-20 14:32:56 GMT; path=/; domain=.example.com; HttpOnly
Location: https://www.example.com/
Server: cloudflare
CF-RAY: 4b350ab9d83fc895-MIA

有人可以帮我解决这个问题吗？我错过了什么？

更新 3 >>> nginx.conf 和清理 cloudflare 缓存的更多变化

Nginx /etc/nginx/nginx.conf 

pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {

    log_format formatWithUpstreamLogging '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request';

    #main log format
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                               '$status $body_bytes_sent "$http_referer" '
                               '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log main;
    error_log   /var/log/nginx/error.log;

    server {

      listen 80;

      server_name www.codeonblue.com.br codeonblue.com.br;

       ssl_certificate /etc/letsencrypt/live/codeonblue.com.br/fullchain.pem; # managed by Certbot
       ssl_certificate_key /etc/letsencrypt/live/codeonblue.com.br/privkey.pem;

        # managed by Certbot
       location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass https://localhost:8443/;
       }

    }
}

本次更新后部分问题得到解决：

卷曲测试

curl -I http://www.example.com
HTTP/1.1 200 
Date: Wed, 06 Mar 2019 22:19:11 GMT
Content-Type: text/html;charset=UTF-8
Connection: keep-alive
Set-Cookie: __cfduid=d3f91ee93c3657a851354dbb4f03741a31551910750; expires=Thu, 05-Mar-20 22:19:10 GMT; path=/; domain=.example.com; HttpOnly
Last-Modified: Wed, 06 Mar 2019 22:03:01 GMT
Accept-Ranges: bytes
Content-Language: en-US
Server: cloudflare
CF-RAY: 4b37b5b08cf05eb2-TPA

在浏览器 Firefox / Chrome 中，前端部分可见，如下图所示：

火狐

铬

新问题：

  • 使用的证书来自 cloudflare，而不是来自 certbot (letsencrypt)。 Chrome 认为它不够好，一直显示为“不安全”。
  • 我的应用程序的端点没有被调用我还不知道为什么。也许我打错了地址。我应该如何调用我的端点？

在我访问过的访问日志中：

  1. curl -I www.example.com.br
  2. 在 Firefox 中访问 http://www.example.com.br
  3. 在 Chrome 中访问 http://www.example.com.br
  4. 尝试在 Postman 中访问我的端点

Nginx 访问日志（/var/log/nginx/access.log）

172.68.78.24 - - [06/Mar/2019:22:19:11 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.47.0" "<ip-address-of-my-machine>"

172.68.78.24 - - [06/Mar/2019:22:19:46 +0000] "GET / HTTP/1.1" 200 578 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"
172.68.78.36 - - [06/Mar/2019:22:19:46 +0000] "GET /runtime.js HTTP/1.1" 200 6224 "https://www.example.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"
172.68.78.42 - - [06/Mar/2019:22:19:46 +0000] "GET /main.js HTTP/1.1" 200 19198 "https://www.example.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"
172.68.78.54 - - [06/Mar/2019:22:19:46 +0000] "GET /styles.js HTTP/1.1" 200 185363 "https://www.example.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"
172.68.78.96 - - [06/Mar/2019:22:19:46 +0000] "GET /polyfills.js HTTP/1.1" 200 228524 "https://www.example.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"
172.68.78.42 - - [06/Mar/2019:22:19:46 +0000] "GET /vendor.js HTTP/1.1" 200 6821593 "https://www.example.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"
172.68.78.18 - - [06/Mar/2019:22:19:48 +0000] "GET /favicon.ico HTTP/1.1" 200 5430 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0" "<ip-address-of-my-machine>"

172.68.78.60 - - [06/Mar/2019:22:20:36 +0000] "GET / HTTP/1.1" 200 578 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36" "<ip-address-of-my-machine>"
172.68.78.60 - - [06/Mar/2019:22:21:33 +0000] "GET / HTTP/1.1" 200 578 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36" "<ip-address-of-my-machine>"
172.68.78.60 - - [06/Mar/2019:22:22:06 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36" "<ip-address-of-my-machine>"
221.229.166.47 - - [06/Mar/2019:22:32:53 +0000] "GET / HTTP/1.1" 200 578 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1" "-"

172.68.78.60 - - [06/Mar/2019:22:44:06 +0000] "GET / HTTP/1.1" 200 578 "-" "PostmanRuntime/7.1.1" "<ip-address-of-my-machine>"

在邮递员中，当我尝试访问端点时：

https://www.example.com:8443/api/cars

我得到了一个很大的输出，我认为这部分更重要：

(...)
<title>www.example.com | 522: Connection timed out</title>
(...)
    <h2 class="cf-subheadline">Connection timed out</h2>
(...)
        <span class="cf-status-desc">www.example.com</span>
(...)
        <h2>What happened?</h2>
        <p>The initial connection between Cloudflare's network and the origin web server timed out. As a result, the web page can not be displayed.</p>
                <h5>If you're the owner of this website:</h5>
                   <span>Contact your hosting provider letting them know your web server is not completing requests. An Error 522 means that                         the request was able to connect to your web server, but that the request didn't finish. The most likely cause is that 
                         something on your server is hogging resources.
                   </span>
(...)

我认为超时是由于我访问服务/端点的方式错误。那么，我现在应该如何访问它？如何设置 nginx 以使用 certbot 证书而不是 cloudflare 的？

【问题讨论】：

  • 我删除了你说的那一行，重启 nginx 和我的应用程序。测试后 access.log 没有改变，error.log 有这个：2019/03/05 14:02:16 [warn] 26131#26131: server name "https://$server_name$request_uri" 有可疑符号在 /etc/nginx/nginx.conf:20 中。为什么说它可疑？虽然仍然发生同样的问题
  • 删除了大括号并更新了问题。重新启动 Nginx 和我的 spring 应用程序，但仍然会出现同样的问题。
  • 我在我的问题中添加了这个命令的输出。顺便说一句，感谢您到目前为止的帮助。
  • 在您上次发表评论后，情况发生了变化。现在似乎正在发生一些重定向问题，但我不确定。您可以通过更新看到
  • 是的，我正在使用 cloudflare。目标是当用户向我的域发出example.com（端口80）请求时，他或她将被重定向到我的应用程序正在运行的example.com（端口8443）。我正在用 curl 结果更新问题

标签： spring-boot ssl nginx certbot


【解决方案1】：

我的问题部分解决了。这是我的场景和我使用的配置：

  • Application：Springboot + Angular6（Springboot 应用在端口 8443 上使用 ssl 并配置为使用 certbot 证书）

  • 域解析：CloudFlare（配置为将 DNS 从我的域解析为我的云服务器的 IP）

  • 云服务器：Amazon Lightsail（云中运行 Nginx 和我的应用程序的 Linux 机器）

  • Web 服务器：Nginx（在亚马逊机器中用于将端口 80 上的 http 流量重定向到端口 8443 上的 https由我的springboot应用程序使用）

Springboot 应用程序.properties

server.port=8443
security.require-ssl=true
server.ssl.key-store=/etc/letsencrypt/live/www.example.com/keystore.p12
server.ssl.key-store-password=www.example.com
server.ssl.keyStoreType=PKCS12
server.ssl.keyAlias=myAlias

Angular 6 服务应如何使用 API

getAll(): Observable<any> {
   return this.http.get('/api/cars');  // production
}

Nginx /etc/nginx/nginx.conf 

pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {

    log_format formatWithUpstreamLogging '[$time_local] $remote_addr - $remote_user - $server_name to: $upstream_addr: $request';

    #main log format
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                               '$status $body_bytes_sent "$http_referer" '
                               '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log main;
    error_log   /var/log/nginx/error.log;

    server {

        listen 80;

        server_name www.example.com example.com;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        # managed by Certbot
        location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-NginX-Proxy true;
                proxy_pass https://localhost:8443/;
                proxy_redirect http://localhost:8443/ https://localhost:8443/;
       }

    }

}

其他设置：

http 流量仍然没有被 Nginx 重定向到 https

如果有人知道如何使这个重定向工作，请告诉我:)

Ps.：我要感谢 Richard Smith 在这个问题上花费的所有帮助和时间！

【讨论】：

    【解决方案2】：

    我知道这已经过时了，但我想将我的 Nginx 配置分享给可能最终出现在这篇文章中的其他人。

    我的整个配置比较大，但是重定向部分看起来如下：

    server {
    listen 80;

    location / {
        return 301 https://$host:8443$request_uri;
    }
}

    基本上，如果您使用 Spring 提供的在 HTTPS 上为应用程序提供服务，则不需要 Proxy pass、ssl_certificate 或 Nginx 上的任何其他内容。当 HTTP 请求到达端口 80 时，上面的配置将简单地向浏览器返回 301 重定向。

    【讨论】：

      【解决方案3】：

      您需要将此添加到您的 server 块中：

      # Redirect non-https traffic to https
if ($scheme != "https") {
    return 301 https://$host$request_uri;
}

      【讨论】：

        猜你喜欢
        • 1970-01-01
        • 2019-06-24
        • 2016-07-27
        • 1970-01-01
        • 2019-08-26
        • 1970-01-01
        • 2017-10-16
        • 1970-01-01
        • 1970-01-01
        相关资源
        最近更新 更多
        热门标签
        Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode