Nginx SSL透传代理无法正常显示GitHub服务器UI求助

云上老周

2026-6-28

问题

我有一台GitHub服务器，直接访问其UI完全正常。现在希望通过Nginx的SSL透传代理访问该实例，配置如下：

cat /etc/nginx/conf.d/proxy.conf 
server {
    listen 443 ssl;
    server_name github-proxy-test-int.web.company.com;
    
    ssl_certificate /etc/nginx/conf.d/github-proxy-test-int.web.company.com.cer;
    ssl_certificate_key /etc/nginx/conf.d/website.com.key;
    
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

    location / {
        proxy_pass https://github-dev.web-dev.company.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #proxy_set_header X-Forwarded-Proto $scheme;
    }
}

但通过github-proxy-test-int.web.company.com访问代理UI时显示异常，页面检查存在错误。希望通过代理正常访问UI及所有流程，请问遗漏了什么配置？

解决方案

UI显示异常主要是缺少关键代理头、WebSocket支持及协议适配配置，以下是需要补充/调整的内容：

启用X-Forwarded-Proto头：取消注释proxy_set_header X-Forwarded-Proto $scheme;，GitHub服务器需要识别客户端实际使用的HTTPS协议，否则会生成HTTP资源链接，触发混合内容错误。
添加Host与X-Forwarded-Host头：必须配置proxy_set_header Host $host;和proxy_set_header X-Forwarded-Host $host;，确保后端服务器收到正确的请求主机名，避免资源路径解析错误。

添加WebSocket支持：GitHub UI依赖WebSocket实现实时交互，需补充：

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

优化缓存策略：添加缓存绕过规则，避免WebSocket请求被缓存：
```
proxy_cache_bypass $http_upgrade;
proxy_no_cache $http_upgrade;
```
升级TLS协议版本：建议将ssl_protocols调整为TLSv1.2 TLSv1.3，提升安全性与兼容性。

修改后的完整配置：

server {
    listen 443 ssl;
    server_name github-proxy-test-int.web.company.com;
    
    ssl_certificate /etc/nginx/conf.d/github-proxy-test-int.web.company.com.cer;
    ssl_certificate_key /etc/nginx/conf.d/website.com.key;
    
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

    location / {
        proxy_pass https://github-dev.web-dev.company.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        
        # WebSocket支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # 缓存优化
        proxy_cache_bypass $http_upgrade;
        proxy_no_cache $http_upgrade;
    }
}

配置完成后重启Nginx生效：

systemctl restart nginx

内容的提问来源于stack exchange，提问作者Jason Stanley