Node.js反向代理HTTP正常但HTTPS异常问题排查

我正在部署一个vite-plugin-ssr应用，用CloudPanel管理DigitalOcean服务器。Node.js服务运行在服务器本地3000端口，通过npm run server命令启动。在安装certbot证书前以及移除证书后，服务都能正常运行；但安装证书后，网站就出现ERR_HTTP2_PROTOCOL_ERROR错误。我的Nginx配置如下：

server {
  listen 80;
  listen [::]:80;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  {{ssl_certificate_key}}
  {{ssl_certificate}}
  server_name example.nl;
  return 301 https://www.example.nl$request_uri;
}

server {
  listen 80;
  listen [::]:80;
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  {{ssl_certificate_key}}
  {{ssl_certificate}}
  server_name www.example.nl www1.example.nl;
  {{root}}

  {{nginx_access_log}}
  {{nginx_error_log}}

  if ($scheme != "https") {
    rewrite ^ https://$host$uri permanent;
  }

  location ~ /.well-known {
    auth_basic off;
    allow all;
  }

  {{settings}}

  index index.html;

  location / {
    proxy_pass http://localhost:{{app_port}}/;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_pass_request_headers on;
    proxy_max_temp_file_size 0;
    proxy_connect_timeout 900;
    proxy_send_timeout 900;
    proxy_read_timeout 900;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    proxy_temp_file_write_size 256k;
    proxy_redirect off;
  }
}

可能的原因及修复步骤： #

• HTTP/2与反向代理的兼容性冲突
  HTTP/2在反向代理HTTP/1.1后端服务时容易出现协议协商错误。先尝试关闭Nginx的HTTP/2支持，把所有listen 443 ssl http2;改成listen 443 ssl;，重启Nginx后测试访问。如果问题解决，说明是HTTP/2的适配问题，后续可针对性调试HTTP/2配置，或暂时用HTTP/1.1。

• SSL证书配置异常
  检查CloudPanel的{{ssl_certificate_key}}和{{ssl_certificate}}变量是否正确替换为实际证书路径（比如/etc/letsencrypt/live/example.nl/privkey.pem和/etc/letsencrypt/live/example.nl/fullchain.pem）。同时确保Nginx进程有读取证书文件的权限，证书文件权限建议设置为600，所属用户为root。

• Proxy头部与HTTP/2不兼容
  HTTP/2不使用Upgrade和Connection这类HTTP/1.1专属头部，当前配置里的这两行可能触发协议错误：

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
  

  把这两行注释掉，重启Nginx测试。如果应用不需要WebSocket，这两个头部完全多余；如果需要WebSocket，单独给WebSocket路径配置这些头部即可，不要全局设置。

• 查看Nginx错误日志定位细节
  执行tail -f /var/log/nginx/error.log（或通过CloudPanel后台日志面板），访问网站时观察日志输出，比如证书验证失败、协议握手报错等，能快速缩小问题范围。

修改后的参考配置： #

server {
  listen 80;
  listen [::]:80;
  server_name example.nl;
  return 301 https://www.example.nl$request_uri;
}

server {
  listen 80;
  listen [::]:80;
  listen 443 ssl;
  listen [::]:443 ssl;
  {{ssl_certificate_key}}
  {{ssl_certificate}}
  server_name www.example.nl www1.example.nl;
  {{root}}

  {{nginx_access_log}}
  {{nginx_error_log}}

  if ($scheme != "https") {
    rewrite ^ https://$host$uri permanent;
  }

  location ~ /.well-known {
    auth_basic off;
    allow all;
  }

  {{settings}}

  index index.html;

  location / {
    proxy_pass http://localhost:{{app_port}}/;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    # 注释HTTP/2不兼容的头部
    # proxy_set_header Upgrade $http_upgrade;
    # proxy_set_header Connection "Upgrade";
    proxy_pass_request_headers on;
    proxy_max_temp_file_size 0;
    proxy_connect_timeout 900;
    proxy_send_timeout 900;
    proxy_read_timeout 900;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    proxy_temp_file_write_size 256k;
    proxy_redirect off;
  }
}

内容的提问来源于stack exchange，提问作者Refilon