Laravel WebSocket子域名SSL部署失败：连接建立前关闭

在AWS Ubuntu主机部署带SSL的Laravel WebSocket服务，访问laravel-websockets页面点击连接后，控制台报错：

WebSocket connection to 'wss://socket.mydomain.com:6001/app/workspace?protocol=7&client=js&version=4.3.1&flash=false' failed: WebSocket is closed before the connection is established

本地无HTTPS环境运行正常，服务器端无法工作。以下是相关配置：

.env 配置 #

BROADCAST_DRIVER=pusher
PUSHER_APP_ID=workspace
PUSHER_APP_KEY=workspace
PUSHER_APP_SECRET=workspace
PUSHER_APP_CLUSTER=mt1
LARAVEL_WEBSOCKETS_HOST=socket.mydomain.com
LARAVEL_WEBSOCKETS_PORT=6001 // 试过443和6001
LARAVEL_WEBSOCKETS_HTTPS=1
LARAVEL_WEBSOCKETS_ENABLE_STATISTICS=false
LARAVEL_WEBSOCKETS_SSL_LOCAL_CERT=/etc/letsencrypt/live/socket.mydomain.com/fullchain.pem
LARAVEL_WEBSOCKETS_SSL_LOCAL_PK=/etc/letsencrypt/live/socket.mydomain.com/privkey.pem

config/websockets.php 配置 #

'dashboard' => [
    'host' => env('LARAVEL_WEBSOCKETS_HOST'),
    'port' => env('LARAVEL_WEBSOCKETS_PORT', 6001)
],
'apps' => [
    [
        'host' => env('LARAVEL_WEBSOCKETS_HOST'),
        'port' => env('LARAVEL_WEBSOCKETS_PORT'),
        'id' => env('PUSHER_APP_ID'),
        'name' => env('APP_NAME'),
        'key' => env('PUSHER_APP_KEY'),
        'secret' => env('PUSHER_APP_SECRET'),
        'path' => env('PUSHER_APP_PATH'),
        'capacity' => null,
        'enable_client_messages' => false,
        'enable_statistics' => env('LARAVEL_WEBSOCKETS_ENABLE_STATISTICS', true),
        'encrypted' => true
    ],
],
'ssl' => [
    'local_cert' => env('LARAVEL_WEBSOCKETS_SSL_LOCAL_CERT', null),
    'local_pk' => env('LARAVEL_WEBSOCKETS_SSL_LOCAL_PK', null),
    'passphrase' => env('LARAVEL_WEBSOCKETS_SSL_PASSPHRASE', null),
    'verify_peer' => false,
    'verify_peer_name' => false
],

config/broadcasting.php 配置 #

'pusher' => [
    'driver' => 'pusher',
    'key' => env('PUSHER_APP_KEY'),
    'secret' => env('PUSHER_APP_SECRET'),
    'app_id' => env('PUSHER_APP_ID'),
    'options' => [
        'cluster' => env('PUSHER_APP_CLUSTER'),
        'host' => env('LARAVEL_WEBSOCKETS_HOST'),
        'port' => env('LARAVEL_WEBSOCKETS_PORT'),
        'useTLS' => true,
        'encrypted' => true,
        'scheme' => 'https', // env('LARAVEL_WEBSOCKETS_HTTPS') ? 'https' : 'http',
        'curl_options' => [
            CURLOPT_SSL_VERIFYHOST => 0,
            CURLOPT_SSL_VERIFYPEER => 0
        ]
    ],
],

Nginx子域名配置 #

server {
  server_name socket.mydomain.com;

  location / {
    proxy_pass             http://127.0.0.1:6001;
    #proxy_pass https://dev-api.alsoworkspace.com;
    proxy_read_timeout     60;
    proxy_connect_timeout  60;
    proxy_redirect         off;

    # Allow the use of websockets
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/socket.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/socket.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
    if ($host = socket.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

  listen 80;

  server_name socket.mydomain.com;
    return 404; # managed by Certbot
}

Supervisor配置 #

[program:websockets]
command=/usr/bin/php /var/www/backend/artisan websockets:serve
numprocs=1
autostart=true
autorestart=true
user=ubuntu
redirect_stderr=true

排查与解决步骤 #

1. 端口访问逻辑修正

   • 当前前端直接请求wss://socket.mydomain.com:6001，但Nginx已在443端口代理WebSocket服务。修改前端请求地址为wss://socket.mydomain.com/app/...（不带端口），让Nginx处理SSL和转发；若要保留6001端口访问，需在AWS安全组开放6001端口的入站规则。

2. 取消双重SSL配置

   • 你同时开启了Laravel WebSocket自身SSL和Nginx代理SSL，会导致握手冲突。关闭Laravel端SSL：
     • 修改.env中LARAVEL_WEBSOCKETS_HTTPS=0
     • 注释掉.env中的LARAVEL_WEBSOCKETS_SSL_LOCAL_CERT和LARAVEL_WEBSOCKETS_SSL_LOCAL_PK
   • 让Nginx统一处理SSL，后端WebSocket服务仅监听本地HTTP即可。

3. 配置一致性调整

   • 修改config/broadcasting.php中options的port为443，保持scheme为https、useTLS为true，匹配Nginx代理端口。
   • 前端初始化Pusher时，不要手动指定wsPort或wssPort，使用默认443端口。

4. 服务状态与权限检查

   • 执行supervisorctl status websockets确认服务正常运行；本地执行curl http://127.0.0.1:6001验证服务响应。
   • 检查storage/logs/laravel.log是否有证书权限错误，确保ubuntu用户能读取Let's Encrypt证书文件（可执行sudo chown -R ubuntu:ubuntu /etc/letsencrypt/live/socket.mydomain.com/调整权限）。

5. Nginx配置优化

   • 在location /块添加：

     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     

   • 调整proxy_read_timeout为3600，避免长连接超时断开。

内容的提问来源于stack exchange，提问作者Stanislau Karaliou