排查idx.stochie.com无法访问问题：DNS、浏览器或服务器配置故障？

我已成功部署主站www.stochie.com，现在需要创建子域名idx.stochie.com并指向新服务器IP 54.179.144.127。
经DNS检查工具确认，idx.stochie.com已正确解析至该IP，但直接访问IP正常，访问子域名时却提示“Hmmm… can't reach this page idx.stochie.com took too long to respond”。

我使用Nginx作为反向代理，配置如下：

server {
server_name idx.stochie.com
            ''
            54.179.144.127;

location = /favicon.ico { access_log off; log_not_found off; }
location /static {
    root /home/ubuntu/stochie/;
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
if ($host = 'stochie.com') {
    return 301 https://www.stochie.com$request_uri;
}
ssl_certificate /etc/letsencrypt/live/idx.stochie.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/idx.stochie.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
if ($host = idx.stochie.com) {
    return 301 https://$host$request_uri;
} # managed by Certbotlisten 80;

server_name idx.stochie.com
            ''
            54.179.144.127;
return 404; # managed by Certbot
}

Web服务器采用Django，已将idx.stochie.com添加至settings.py的ALLOWED_HOSTS中。

我不确定浏览器是否已从DNS服务商获取到正确IP，请问该从哪些方面开始排查？

一、确认本地DNS解析是否生效 #

• 在本地终端执行 nslookup idx.stochie.com 或 dig idx.stochie.com，查看返回IP是否为54.179.144.127。如果不是，说明本地DNS缓存未更新：
  • 浏览器端按Ctrl+Shift+Del清空缓存；
  • Windows终端执行ipconfig /flushdns，Linux执行sudo systemd-resolve --flush-caches，Mac执行sudo dscacheutil -flushcache强制刷新本地DNS。
• 用浏览器开发者工具（F12）查看网络请求：切换到「网络」标签页，重载页面后检查请求的「地址」列是否显示正确IP。

二、修复Nginx配置的语法错误 #

你的配置存在两处致命格式问题，这是导致服务异常的核心原因：

1. 第一个server块中，listen指令嵌套在location /static内部，listen属于server级指令，必须放在server块最外层；
2. 第二个server块中，# managed by Certbotlisten 80; 注释与指令连写，导致listen 80被当成注释，Nginx不会监听80端口。

修正后的配置示例：

server {
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot

    server_name idx.stochie.com 54.179.144.127;

    if ($host = 'stochie.com') {
        return 301 https://www.stochie.com$request_uri;
    }

    ssl_certificate /etc/letsencrypt/live/idx.stochie.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/idx.stochie.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location = /favicon.ico { 
        access_log off; 
        log_not_found off; 
    }

    location /static {
        root /home/ubuntu/stochie/;
    }

    # 添加反向代理到Django的核心配置（假设Django运行在8000端口）
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name idx.stochie.com 54.179.144.127;

    if ($host = idx.stochie.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    return 404; # managed by Certbot
}

• 执行sudo nginx -t验证配置语法，确认无误后执行sudo systemctl reload nginx加载新配置。

三、检查端口连通性 #

• 本地终端执行nc -zv 54.179.144.127 443（或telnet 54.179.144.127 443），测试HTTPS端口是否能连通。如果失败，检查服务器防火墙（UFW/iptables）或云服务商安全组，确保开放80（HTTP）和443（HTTPS）端口的入站流量。
• 同样测试80端口：nc -zv 54.179.144.127 80，确保HTTP跳转正常。

四、查看服务日志定位问题 #

• 实时查看Nginx错误日志：tail -f /var/log/nginx/error.log，访问子域名后观察是否有证书错误、反向代理失败等报错。
• 查看Django日志，确认请求是否到达后端服务。如果Nginx日志显示请求已转发，但Django无记录，说明反向代理配置仍有问题；如果Django有日志但返回错误，再针对性排查Django配置。

五、验证SSL证书有效性 #

执行openssl s_client -connect idx.stochie.com:443，查看证书是否正常返回，是否存在过期、域名不匹配等问题。证书异常会导致浏览器拒绝连接，引发超时或安全提示。

内容的提问来源于stack exchange，提问作者Adi Putra