Nginx反向代理WSO2 API Manager门户认证失败及404问题求助

一、现有错误的修复步骤 #

1. javax.net.ssl.SSLHandshakeException 错误修复 #

这个错误的核心是WSO2后端与Nginx通信时，SSL证书验证不通过，具体原因及修复：

• 检查Nginx证书的SAN字段：用openssl x509 -in your-cert.pem -text -noout命令查看证书，确保主题备用名称（SAN）包含你的自定义域名****.****.com，如果缺失，重新生成包含该域名的SSL证书。
• 将Nginx证书导入WSO2信任库：
  1. 提取Nginx证书的PEM格式文件（p12格式可执行openssl pkcs12 -in your-cert.p12 -out cert.pem -nokeys）。
  2. 导入到WSO2默认信任库：

     keytool -importcert -alias nginx-proxy -file cert.pem -keystore <WSO2_HOME>/repository/resources/security/client-truststore.jks -storepass wso2carbon
     

• 修正WSO2内部服务URL配置：编辑<WSO2_HOME>/repository/conf/deployment.toml，确保所有对外服务指向Nginx域名：

  [server]
  hostname = "****.****.com"
  proxy_port = 443
  proxy_scheme = "https"
  
  [apim.publisher]
  url = "https://****.****.com/publisher"
  
  [apim.devportal]
  url = "https://****.****.com/devportal"
  
  [apim.gateway]
  service_url = "https://****.****.com/services/"
  

2. 登录后404错误修复 #

404通常是Nginx路由规则不完整或WSO2回调配置错误：

• 完善Nginx转发规则：确保覆盖所有WSO2核心路径，示例配置：

  server {
      listen 443 ssl;
      server_name ****.****.com;
  
      ssl_certificate /path/to/your/cert.pem;
      ssl_certificate_key /path/to/your/key.pem;
  
      location / {
          proxy_pass https://<WSO2_INTERNAL_IP>:9443;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_redirect off;
      }
  
      # 处理WebSocket路径（可选）
      location /websocket {
          proxy_pass https://<WSO2_INTERNAL_IP>:9443;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
      }
  }
  

• 修正WSO2认证回调URL：在deployment.toml中添加：

  [oauth.extensions]
  callback_url = "https://****.****.com/commonauth"
  

二、更优的WSO2反向代理配置方式 #

1. 路径拆分式代理（可维护性提升） #

将WSO2不同服务拆分到独立Nginx location，便于后续限流、权限控制：

server {
    listen 443 ssl;
    server_name apim.example.com;

    ssl_certificate /etc/nginx/ssl/apim.crt;
    ssl_certificate_key /etc/nginx/ssl/apim.key;

    # 认证核心端点
    location ~ ^/(oauth2|authenticationendpoint|commonauth|samlsso) {
        proxy_pass https://wso2-apim-internal:9443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Publisher控制台
    location /publisher {
        proxy_pass https://wso2-apim-internal:9443/publisher;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # DevPortal控制台
    location /devportal {
        proxy_pass https://wso2-apim-internal:9443/devportal;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Gateway服务
    location /services {
        proxy_pass https://wso2-apim-internal:9443/services;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

2. 静态资源缓存优化 #

针对WSO2前端静态资源配置Nginx缓存，降低后端负载：

http {
    # 定义缓存区
    proxy_cache_path /var/cache/nginx/apim_static levels=1:2 keys_zone=apim_static_cache:10m max_size=10g inactive=7d use_temp_path=off;

    server {
        # ... 其他配置 ...
        # 缓存静态资源
        location ~ ^/(publisher|devportal)/public {
            proxy_pass https://wso2-apim-internal:9443;
            proxy_cache apim_static_cache;
            proxy_cache_valid 200 1d;
            proxy_set_header Host $host;
        }
    }
}

3. WSO2端代理增强配置 #

在deployment.toml中启用反向代理模式，自动识别Nginx传递的头信息：

[server]
forwarded_hosts_header = "X-Forwarded-Host"
forwarded_proto_header = "X-Forwarded-Proto"
forwarded_port_header = "X-Forwarded-Port"
forwarded_for_header = "X-Forwarded-For"

内容的提问来源于stack exchange，提问作者Aravindhan M