Laravel Reverb在Nginx SSL环境下的连接异常问题求助

错误日志 #

Nginx错误日志出现：

SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while processing HTTP/2 connection

异常现象 #

访问https://example.com:8080显示404页面后，Laravel的实时通知功能恢复正常，但无法要求终端用户执行此操作，需修复根本问题。

相关配置信息 #

.env文件 #

BROADCAST_DRIVER=reverb
REVERB_PORT=8080
REVERB_SCHEME=https
REVERB_HOST=example.com
VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
VITE_REVERB_HOST="${REVERB_HOST}"
VITE_REVERB_PORT="${REVERB_PORT}"
VITE_REVERB_SCHEME="${REVERB_SCHEME}"

REVERB_TLS_CERT_PATH=/etc/letsencrypt/live/example.com/fullchain.pem
REVERB_TLS_KEY_PATH=/etc/letsencrypt/live/example.com/privkey.pem
REVERB_TLS_CA_PATH=/etc/letsencrypt/live/example.com/chain.pem

reverb.php配置 #

'host' => env('REVERB_SERVER_HOST', '0.0.0.0'),
'port' => env('REVERB_SERVER_PORT', 8080),
'hostname' => env('REVERB_HOST'),
'options' => [
    'tls' => [
        'local_cert' => env('REVERB_TLS_CERT_PATH'),
        'local_pk' => env('REVERB_TLS_KEY_PATH'),
        'cafile' => env('REVERB_TLS_CA_PATH'),
    ],
],

Nginx站点配置（/etc/nginx/sites-available/example.com.conf） #

server {
    ...
    location /app {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-Proto   $scheme;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
        proxy_pass http://0.0.0.0:8080/;
    }
    location /apps {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-Proto   $scheme;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
        proxy_pass http://0.0.0.0:8080/;
    }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

环境与运行状态 #

• 已通过Supervisor管理Laravel Queue和Reverb服务，服务正常运行
• Nginx版本：1.20.1
• OpenSSL版本：3.2.2 4 Jun 2024

修复方案 #

1. 统一SSL处理逻辑（核心修复） #

当前Reverb自身启用TLS，但Nginx代理时使用http://0.0.0.0:8080连接，协议不匹配引发SSL错误，二选一即可：

方案A：Reverb关闭TLS，由Nginx统一处理SSL

• 修改.env文件：

  REVERB_SCHEME=http
  # 注释或删除TLS相关配置
  # REVERB_TLS_CERT_PATH=...
  # REVERB_TLS_KEY_PATH=...
  # REVERB_TLS_CA_PATH=...
  

• 修改reverb.php配置，移除tls选项：

  'options' => [],
  

• 重启Reverb服务，确保其以HTTP模式运行在8080端口。

方案B：Nginx代理使用HTTPS连接Reverb

若必须保留Reverb自身TLS，修改Nginx的proxy_pass为HTTPS：

proxy_pass https://0.0.0.0:8080/;

同时添加本地SSL验证配置（可选，跳过自签/本地证书验证）：

proxy_ssl_verify off;
proxy_ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

2. 修正WebSocket路由匹配 #

Reverb默认WebSocket路由为/ws，当前Nginx配置的/app//apps未匹配正确路由，需添加对应location：

location /ws {
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 300s;
    proxy_pass http://0.0.0.0:8080/ws;
}

同时确保前端Vite配置的Reverb连接路径对应/ws。

3. 解决HTTP/2与WebSocket兼容问题 #

Nginx HTTP/2与WebSocket升级可能存在冲突，可在WebSocket路由下禁用HTTP/2：

location /ws {
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 300s;
    proxy_http2 off; # 强制使用HTTP/1.1处理WebSocket
    proxy_pass http://0.0.0.0:8080/ws;
}

4. 调整OpenSSL兼容配置 #

OpenSSL 3.2.2与Nginx 1.20.1可能存在兼容性问题，修改options-ssl-nginx.conf：

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

验证步骤 #

1. 重启Nginx：sudo systemctl restart nginx
2. 重启Reverb服务：sudo supervisorctl restart reverb
3. 清除前端缓存并重新构建：npm run build
4. 测试实时通知功能，检查Nginx错误日志是否不再出现SSL_read错误

内容的提问来源于stack exchange，提问作者Matthew Hirons