Ubuntu16.04更换Let's Encrypt SSL后证书验证失败求助

错误详情 #

访问https://x.com/layers/geonode:test时出现SSL验证失败错误：

SSLError at /layers/geonode:test
("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)")
Request Method: GET
Request URL:    https://x.com/layers/geonode:test
Django Version: 1.8.7
Exception Type: SSLError
Exception Value:    
("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)")
Exception Location: /usr/local/lib/python2.7/dist-packages/requests/adapters.py in send, line 497
Python Executable:  /usr/bin/uwsgi-core
Python Version: 2.7.12
Python Path:    
['.',
 '',
 '/usr/lib/python2.7',
 '/usr/lib/python2.7/plat-x86_64-linux-gnu',
 '/usr/lib/python2.7/lib-tk',
 '/usr/lib/python2.7/lib-old',
 '/usr/lib/python2.7/lib-dynload',
 '/root/.local/lib/python2.7/site-packages',
 '/usr/local/lib/python2.7/dist-packages',
 '/usr/lib/python2.7/dist-packages',
 '/var/www/x/x']
Server time:    Fri, 4 Aug 2023 19:30:56 +0600

已尝试操作 #

执行sudo apt install ca-certificates更新根证书，系统提示：

ca-certificates is already the newest version (20210119~16.04.1).
0 upgraded, 0 newly installed, 0 to remove and 392 not upgraded.

当前Nginx配置 #

server {
    server_name x.com;
    return 301 $scheme://x.com$request_uri;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/x.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/x.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}

server {
    if ($host = x.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


       listen         80;
       server_name    x.com;
       return         301 https://$server_name$request_uri;


}

server {
    listen 443 ssl;
    server_name x.com;


#    include snippets/x-signed.conf;
#    include snippets/ssl-params.conf;
    ssl_certificate /etc/letsencrypt/live/x.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/x.com/privkey.pem; # managed by Certbot
    

    charset     utf-8;
    access_log /var/log/nginx/x.access.log;
    error_log /var/log/nginx/x.error.log info;


    # sit2605
    client_max_body_size 1600M;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
        # With php5-cgi alone:
        # fastcgi_pass 127.0.0.1:9000;
        # With php5-fpm 
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME /var/www$fastcgi_script_name;
        include fastcgi_params;
        # Increasing timeout
        fastcgi_read_timeout 600;
    }

    location / {
        root /var/www/uploads;
        try_files $uri @wsgiapp;

    }
 

    location @wsgiapp {
        uwsgi_read_timeout 10800;
        uwsgi_pass  unix:///var/lib/uwsgisock/x.sock;
        include     /etc/nginx/uwsgi_params;

    }


    location /geoserver/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://x.x.x.x:8080/geoserver/;
    }

}


server {
    if ($host = x.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name x.com;
    listen 80;
    return 404; # managed by Certbot
}

解决步骤 #

• 清理冗余Nginx配置
  当前配置中有两个监听443的server块，且server_name均为x.com，会导致请求处理冲突。删除第一个仅返回301的443 server块，保留包含业务逻辑的那个443 server块。

• 手动安装Let's Encrypt根证书
  Ubuntu 16.04默认的ca-certificates版本缺少ISRG Root X1根证书，手动添加：

  1. 获取ISRG Root X1证书文件，保存到/usr/local/share/ca-certificates/isrgrootx1.pem
  2. 执行更新命令：

     sudo update-ca-certificates
     

• 指定Python requests的证书路径
  Python 2.7的requests库可能无法正确读取系统根证书，可通过以下方式解决：

  1. 在Django的请求代码中添加verify='/etc/ssl/certs/ca-certificates.crt'参数
  2. 或者设置环境变量，将其添加到uwsgi配置文件中：

     export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
     

• 验证证书链完整性
  使用openssl检查证书链是否完整：

  openssl s_client -connect x.com:443 -servername x.com
  

  确认输出中包含完整的证书链（域名证书→中间证书→根证书）。

• 重启服务
  调整配置后重启Nginx和uwsgi：

  sudo systemctl restart nginx
  sudo systemctl restart uwsgi
  

内容的提问来源于stack exchange，提问作者Rezwan