Monit 5.31.0监控同服务器两WordPress站点HTTPS/443检查一失败求助

同一服务器运行两个基于Let's Encrypt证书的WordPress站点，其中example-b.com的Monit HTTPS/443检查持续失败，example-a.com完全正常。

现有配置与状态 #

Monit配置

check host example-a.com with address www.example-a.com
if failed icmp type echo count 5 with timeout 150 seconds then alert
if failed port 443 protocol https with timeout 150 seconds then alert
if failed (url https://example-a.com/ and content == '' and timeout 40 seconds) then alert

check host example-b.com with address www.example-b.com
if failed icmp type echo count 5 with timeout 150 seconds then alert
if failed port 443 protocol https with timeout 150 seconds then alert
if failed (url https://example-b.com/ and content == '' and timeout 40 seconds) then alert

Monit状态输出

Remote Host 'example-a.com'
  status                       OK
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  ping response time           0.020 ms
  port response time           193.949 ms to example-a.com:443/ type TCP/IP using TLS (certificate valid for 67 days) protocol HTTP
  port response time           5.823 ms to www.example-a.com:443 type TCP/IP using TLS (certificate valid for 67 days) protocol HTTP
  data collected               Fri, 13 Oct 2023 14:39:44

Remote Host 'example-b.com'
  status                       Connection failed
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  ping response time           0.016 ms
  port response time           FAILED to [example-b.com]:443/ type TCP/IP using TLS protocol HTTP
  port response time           935.562 ms to www.example-b.com:443 type TCP/IP using TLS (certificate valid for 57 days) protocol HTTP
  data collected               Fri, 13 Oct 2023 14:39:46

可能的原因及排查步骤 #

• 证书域名覆盖不全：example-b.com的Let's Encrypt证书可能仅包含www.example-b.com，未覆盖主域名。执行openssl s_client -connect example-b.com:443查看证书的Subject Alternative Name字段，确认是否包含example-b.com。若缺失，需重新申请包含双域名的SAN证书。
• SNI配置不匹配：Monit默认可能未正确发送SNI头，导致Web服务器无法识别example-b.com的虚拟主机。修改Monit配置，在HTTPS检查中明确指定主机名：

  if failed port 443 protocol https with host example-b.com timeout 150 seconds then alert
  

• 虚拟主机配置错误：检查Web服务器（Nginx/Apache）中example-b.com的虚拟主机配置，确认TLS证书、密钥路径正确，且域名绑定无误。对比www.example-b.com的配置，排查差异。
• TLS协议/套件兼容性：example-b.com的虚拟主机可能使用了Monit不支持的TLS版本或加密套件。查看Web服务器配置，尝试开启TLS 1.2等兼容版本，或添加Monit支持的加密套件后重新测试。
• 请求拦截或超时：检查Web服务器安全模块（如ModSecurity）或防火墙规则，确认未拦截Monit对example-b.com的请求。查看Monit日志（通常位于/var/log/monit.log），获取连接失败的具体错误信息（如证书验证失败、握手超时等）。
• 域名解析问题：执行nslookup example-b.com验证DNS解析结果，确认域名指向正确的服务器IP，且本地DNS缓存未过期。

内容的提问来源于stack exchange，提问作者Creative Arc