Nginx配置Let’s Encrypt证书时出现“no "ssl_certificate" is defined in server”错误求助

嘿，我看了你的配置，问题根源很明确——你的default.conf里的默认server块同时监听了443端口，但完全没有配置SSL证书，而Nginx在处理HTTPS请求时，会优先匹配到这个标记了default_server的443监听块，这就导致了SSL握手时找不到证书的错误。

下面是具体的修复步骤和优化建议：

第一步：修复default.conf的监听配置 #

把default.conf里的443监听行全部删掉，让它只负责处理未匹配到特定域名的HTTP请求就行，修改后的内容如下：

server {
    listen       80 default_server;
    listen       [::]:80 default_server;
    server_name  _;
    root          /var/www/;
    index index.html index.htm index.nginx-debian.html;

    include /etc/nginx/default.d/*.conf;

    location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
        add_header Access-Control-Allow-Origin "*";
        expires 7d;
        access_log off;
    }

    location / {
        try_files $uri $uri/ =404;
    }

    error_page 404 /404.html;
    location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
    }

    #return 301 http://$host$request_uri;
}

第二步：优化mywebsite.conf的冗余配置 #

你现在的配置里有不少重复的server块，很容易出问题。可以合并成更清晰的结构，避免规则冲突：

# 处理www域名的HTTP/HTTPS请求，全部跳转到主域名的HTTPS
server {
    listen 80;
    listen 443 ssl;
    server_name www.mywebsite.com;

    # 这里必须配置证书，否则访问www的HTTPS会报错
    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    return 301 https://mywebsite.com$request_uri;
}

# 主域名的HTTP请求跳转到HTTPS
server {
    listen 80;
    server_name mywebsite.com;
    return 301 https://$host$request_uri;
}

# 主域名的HTTPS服务，反向代理到你的Node应用
server {
    listen 443 ssl;
    server_name mywebsite.com;

    location / {
        proxy_set_header        Host $host;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_pass              "http://127.0.0.1:3100";
        proxy_redirect http:// https://;
    }

    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

第三步：验证配置并重启Nginx #

修改完之后，先执行命令验证配置是否合法：

nginx -t

如果输出nginx: configuration file /etc/nginx/nginx.conf test is successful，就可以重新加载Nginx配置了：

systemctl reload nginx

额外检查点 #

• 确认证书文件的权限：执行ls -l /etc/letsencrypt/live/mywebsite.com/，确保fullchain.pem和privkey.pem的权限是-rw-r--r--（644），保证Nginx用户能读取这些文件。
• 再次确认防火墙的443端口是开放的：firewall-cmd --list-all，检查是否包含https服务。

这样应该就能解决你遇到的SSL证书错误了，试试访问你的域名看看吧！

备注：内容来源于stack exchange，提问作者Shan Robertson