配置Nginx反向代理AWS S3出现SSL版本错误，如何解决？

需要设置反向代理，将内部用户向myserver:443/mybucket发起的请求转发至https://s3.us-east-1.amazonaws.com:443/mybucket，另外两个存储桶也需配置重定向。Nginx服务器部署在Amazon Linux 2023系统上。

初始配置的nginx.conf：

server {
 server_name myserver;
 listen      443;
 rewrite ^/(.*)$ https://s3.us-east-1.amazonaws.com/$1 permanent;
 location / {
 allow 10.0.0.0/8;
 deny all;
 }
 }

测试HTTPS请求时出现错误：

# curl -k -I https://myserver/mybucket
curl: (35) OpenSSL/3.0.8: error:0A00010B:SSL routines::wrong version number

HTTP请求测试正常：

# curl -I http://myserver/mybucket
HTTP/1.1 301 Moved Permanently
Server: nginx/1.24.0
Date: Wed, 16 Aug 2023 15:01:51 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://s3.us-east-1.amazonaws.com/mybucket

添加自签名证书后的配置：

server {
 server_name myserver;
 ssl_certificate /usr/cert/certificate.crt;
 ssl_certificate_key /usr/cert/private.key;
 listen      443;
 rewrite ^/(.*)$ https://s3.us-east-1.amazonaws.com/$1 permanent;
 location / {
 allow 10.0.0.0/8;
 deny all;
 }
 }

再次测试仍出现相同错误：

# curl -vv -k -I https://myserver/mybucket
*   Trying myserver...
* Connected to myserver port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL/3.0.8: error:0A00010B:SSL routines::wrong version number
* Closing connection 0
curl: (35) OpenSSL/3.0.8: error:0A00010B:SSL routines::wrong version number

配置是否有遗漏？

你的配置遗漏了启用SSL监听的关键参数，导致Nginx在443端口并未处理SSL请求，而是当作普通HTTP请求处理，从而触发SSL版本错误。

修复步骤： #

1. 修改listen指令，添加ssl标记，明确告知Nginx该端口处理HTTPS请求，同时适配多存储桶重定向：

server {
 server_name myserver;
 ssl_certificate /usr/cert/certificate.crt;
 ssl_certificate_key /usr/cert/private.key;
 # 添加ssl参数启用HTTPS监听
 listen      443 ssl;
 # 为三个存储桶分别配置重定向规则
 rewrite ^/mybucket/(.*)$ https://s3.us-east-1.amazonaws.com/mybucket/$1 permanent;
 rewrite ^/bucket2/(.*)$ https://s3.us-east-1.amazonaws.com/bucket2/$1 permanent;
 rewrite ^/bucket3/(.*)$ https://s3.us-east-1.amazonaws.com/bucket3/$1 permanent;
 # 限制仅内部IP访问
 location / {
 allow 10.0.0.0/8;
 deny all;
 }
}

2. 若实际需求是反向代理（用户请求不跳转，由Nginx中转），替换rewrite为proxy_pass，并配置必要请求头：

server {
 server_name myserver;
 ssl_certificate /usr/cert/certificate.crt;
 ssl_certificate_key /usr/cert/private.key;
 listen      443 ssl;

 # 第一个存储桶代理规则
 location /mybucket/ {
   allow 10.0.0.0/8;
   deny all;
   proxy_pass https://s3.us-east-1.amazonaws.com/mybucket/;
   proxy_set_header Host s3.us-east-1.amazonaws.com;
   proxy_set_header X-Real-IP $remote_addr;
 }

 # 第二个存储桶代理规则
 location /bucket2/ {
   allow 10.0.0.0/8;
   deny all;
   proxy_pass https://s3.us-east-1.amazonaws.com/bucket2/;
   proxy_set_header Host s3.us-east-1.amazonaws.com;
   proxy_set_header X-Real-IP $remote_addr;
 }

 # 第三个存储桶代理规则
 location /bucket3/ {
   allow 10.0.0.0/8;
   deny all;
   proxy_pass https://s3.us-east-1.amazonaws.com/bucket3/;
   proxy_set_header Host s3.us-east-1.amazonaws.com;
   proxy_set_header X-Real-IP $remote_addr;
 }

 # 拦截未匹配的请求
 location / {
   deny all;
 }
}

3. 重启Nginx使配置生效：

sudo systemctl restart nginx

错误原因说明： #

仅配置listen 443;时，Nginx默认在该端口监听HTTP请求，客户端发起HTTPS请求时发送的TLS握手数据会被Nginx以HTTP响应处理，导致SSL库解析失败，出现"wrong version number"错误。添加ssl参数后，Nginx才会在该端口启用TLS协议处理。

内容的提问来源于stack exchange，提问作者Zak25