Nginx配置强制域名跳转www及HTTPS时的协议重定义问题排查

问题根源 #

你遇到的protocol options redefined for 0.0.0.0:443错误，核心原因是监听同一个IP:端口的所有server块，listen指令后的协议修饰符必须完全一致。你的配置中，部分server块用listen 443 ssl;，另一部分用listen 443 ssl http2;，这相当于给0.0.0.0:443端口同时定义了两种不同的协议规则，nginx会判定为配置冲突。

修复方案 #

方案1：统一所有443端口的listen参数 #

把所有listen 443 ssl;的行修改为listen 443 ssl http2;，确保所有监听443端口的server块使用完全一致的协议选项。修正后的完整配置如下：

server {
        listen 80;
        listen 443 ssl http2;
        server_name example.ie;

        # SSL相关配置
        ssl_certificate /etc/letsencrypt/live/example.ie/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.ie/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        return 301 https://www.$host$request_uri;
}

server {
        listen 80;
        listen 443 ssl http2;
        server_name www.example.ie;

        # 代理相关配置
        ........

        # SSL相关配置
        ssl_certificate /etc/letsencrypt/live/example.ie/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.ie/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

server {
        listen 80;
        listen 443 ssl http2;
        server_name example.co.uk;

        # SSL相关配置
        ssl_certificate /etc/letsencrypt/live/example.co.uk/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.co.uk/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        return 301 https://www.$host$request_uri;
}

server {
        listen 80;
        listen 443 ssl http2;
        server_name www.example.co.uk;

        # 代理相关配置
        ........

        # SSL相关配置
        ssl_certificate /etc/letsencrypt/live/example.co.uk/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.co.uk/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

方案2：简化配置（推荐） #

把所有80端口的跳转逻辑合并到一个server块，减少重复代码，同时统一443端口的listen参数：

# 统一处理所有HTTP请求，跳转到HTTPS的www版本
server {
    listen 80;
    server_name example.ie www.example.ie example.co.uk www.example.co.uk;
    return 301 https://www.$host$request_uri;
}

# 处理example.ie的HTTPS请求，跳转到www版本
server {
    listen 443 ssl http2;
    server_name example.ie;

    ssl_certificate /etc/letsencrypt/live/example.ie/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.ie/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    return 301 https://www.$host$request_uri;
}

# 处理www.example.ie的HTTPS业务请求
server {
    listen 443 ssl http2;
    server_name www.example.ie;

    # 代理相关配置
    ........

    ssl_certificate /etc/letsencrypt/live/example.ie/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.ie/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# 处理example.co.uk的HTTPS请求，跳转到www版本
server {
    listen 443 ssl http2;
    server_name example.co.uk;

    ssl_certificate /etc/letsencrypt/live/example.co.uk/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.co.uk/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    return 301 https://www.$host$request_uri;
}

# 处理www.example.co.uk的HTTPS业务请求
server {
    listen 443 ssl http2;
    server_name www.example.co.uk;

    # 代理相关配置
    ........

    ssl_certificate /etc/letsencrypt/live/example.co.uk/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.co.uk/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

验证修复 #

修改配置后，执行以下命令验证配置语法，确认无错误后重启nginx服务生效：

nginx -t
systemctl reload nginx

内容的提问来源于stack exchange，提问作者André Silva