Laravel Reverb部署Nginx后广播事件遇SSL内部错误求助

错误信息 #

Pusher error: cURL error 35: OpenSSL/3.0.13: error:0A000438:SSL routines::tlsv1 alert internal error for https://ws.{domain_name}.app/apps/app_123/events?auth_key=key_123&auth_timestamp=1720515425&auth_version=1.0&body_md5=bea8622c84688147d1e7823170cee4fe&auth_signature=4f8b1ab60ac7f3e73a1746fc32ad4dedb2a50e9e625c84525d2d7f1c9099bc67.

当前配置 #

Reverb环境变量 #

REVERB_APP_ID={app_id}
REVERB_APP_KEY={app_key}
REVERB_APP_SECRET={app_secret]
REVERB_HOST="ws.{domain_name}.app"
REVERB_SCHEME=https
REVERB_SERVER_PORT=8080
REVERB_PORT=443

Nginx配置 #

# Define the server for {domain_name}.app and www.{domain_name}.app
server {
    listen 80;
    server_name {domain_name}.app www.{domain_name}.app;

    # Define the root directory for the site
    root /home/digitalocean/{domain_name}.app/current/public;

    # Enable Gzip compression
    gzip on;
    gzip_types text/plain application/json text/css application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

    # Enable Zstd compression (requires Nginx to be compiled with Zstd support)
    # Uncomment the lines below if Zstd is supported
    # zstd on;
    # zstd_types text/plain application/json text/css application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

    location ~ ^/(app|apps)/ {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        proxy_pass http://0.0.0.0:8080;
    }

    # PHP-FPM configuration
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param SCRIPT_NAME $fastcgi_script_name;
    }
}

# Define the server for client.{domain_name}.app
server {
    listen 80;
    server_name client.{domain_name}.app;

    # Enable Gzip compression
    gzip on;
    gzip_types text/plain application/json text/css application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

    # Reverse proxy to backend server
    location / {
        proxy_pass http://0.0.0.0:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Define the server for customer.{domain_name}.app
server {
    listen 80;
    server_name customer.{domain_name}.app;

    # Enable Gzip compression
    gzip on;
    gzip_types text/plain application/json text/css application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;

    # Reverse proxy to backend server
    location / {
        proxy_pass http://0.0.0.0:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

已尝试操作 #

• 将REVERB_SCHEME设置为HTTP
• 将REVERB_PORT设置为80
  错误仍未解决。

解决方案建议 #

1. 补全ws子域名的SSL配置 #

当前Nginx所有server块仅监听80端口（HTTP），但Reverb配置指定了HTTPS和443端口，导致请求HTTPS地址时无对应SSL配置，触发握手错误。需为ws.{domain_name}.app添加SSL配置：

server {
    listen 443 ssl;
    server_name ws.{domain_name}.app;

    # 替换为实际SSL证书路径
    ssl_certificate /path/to/your/cert.pem;
    ssl_certificate_key /path/to/your/privkey.pem;

    # 配置安全的SSL协议和加密套件
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location ~ ^/(app|apps)/ {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        proxy_pass http://0.0.0.0:8080;
    }
}

# 添加HTTP跳转HTTPS规则
server {
    listen 80;
    server_name ws.{domain_name}.app;
    return 301 https://$host$request_uri;
}

2. 修正环境变量语法错误 #

REVERB_APP_SECRET结尾使用了]而非}，会导致签名验证失败，修正为：

REVERB_APP_SECRET={app_secret}

3. 验证Reverb服务与防火墙 #

确认Reverb服务监听0.0.0.0:8080，服务器防火墙已放行8080端口（或仅允许本地Nginx访问该端口）。

4. 测试SSL连接有效性 #

在服务器执行以下命令，测试ws.{domain_name}.app的SSL连接是否正常：

curl -v https://ws.{domain_name}.app/apps/app_123/events

若仍有SSL错误，检查证书是否有效、域名解析是否正确、证书是否包含ws.{domain_name}.app的SAN（备用主题名称）。

内容的提问来源于stack exchange，提问作者ThatGuy24