Nginx多HTTPS站点仅一个正常 另一站点连接被拒求助

Ubuntu 22.04 LTS系统（nginx/1.18.0）中配置两个HTTPS子域名站点：

• subdomain1.base.edu 可正常响应
• subdomain2.base.edu 提示 connection refused

已完成基础检查：

• 使用默认nginx.conf，已移除默认站点链接
• 两个子域名各有独立SSL证书（学校IT部门生成，subdomain1正常故证书有效性概率高）
• sites-enabled中存在有效符号链接，nginx重启无错误、systemctl状态正常
• 服务器监听0.0.0.0:https
• 后端服务http://127.0.0.1:10123可通过curl及subdomain1代理访问验证正常
• 访问日志和错误日志中未发现subdomain2的连接尝试记录及拒连原因

相关配置文件 #

/etc/nginx/sites-available/subdomain1 #

server {
    listen 443 ssl;
    server_name subdomain1.base.edu;

    ssl_certificate /path/server.crt;
    ssl_certificate_key /path/server.key;

    client_max_body_size 0;
    add_header Strict-Transport-Security max-age=15768000;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Scheme $scheme;

        proxy_buffering off;
    }
}

/etc/nginx/sites-available/subdomain2 #

server {
    listen 443 ssl;
    server_name subdomain2.base.edu;

    ssl_certificate /path/server.crt;
    ssl_certificate_key /path/server.key;

    location / {
        proxy_pass http://127.0.0.1:10123;
    }
}

nginx -T 输出 #

user@host:/etc/nginx/sites-available$ sudo nginx -T
[sudo] password: 
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
.....
# configuration file /etc/nginx/sites-enabled/subdomain1.base.edu:
# top-level http config for websocket headers
# If Upgrade is defined, Connection = upgrade
# If Upgrade is empty, Connection = close
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    server_name subdomain1.base.edu;

    return 302 https://$host$request_uri;
}

server {
    listen 443 ssl;

    server_name subdomain1.base.edu;

    ssl_certificate /path/.ssl/server.crt;
    ssl_certificate_key /path/.ssl/server.key;

    client_max_body_size 0;

    add_header Strict-Transport-Security max-age=15768000;

    include /etc/nginx/sites-available/shinyapps;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # websocket headers
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Scheme $scheme;

        proxy_buffering off;
    }
}


# configuration file /etc/nginx/sites-available/shinyapps:
location /5627 {
    proxy_pass http://localhost:5627/;
    proxy_redirect / $scheme://$http_host/;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_read_timeout 20d;
    proxy_buffering off;
}

# configuration file /etc/nginx/sites-enabled/subdomain2.base.edu:

#
# bustalab1 domain to proxy localhost shiny apps

server {
    listen 80;
    server_name subdomain2.base.edu;

    # Tell all requests to port 80 to be 302 redirected to HTTPS
    return 302 https://$host$request_uri;
}
server {
    listen          443 ssl;
    server_name     subdomain2.base.edu;
    ssl_certificate     /path/.ssl/subdomain2.crt;
    ssl_certificate_key /path/.ssl/subdomain2.key;

    error_log       /var/log/nginx/subdomain2_err.log debug;
    access_log      /var/log/nginx/subdomain2_acc.log;

    location / {
        proxy_pass http://127.0.0.1:10123;
    }
}

1. 网络层面验证 #

• DNS解析检查：
  执行dig subdomain2.base.edu或nslookup subdomain2.base.edu，确认解析结果与subdomain1一致，指向正确的服务器IP。若解析错误，联系学校IT修正域名解析记录。
• 边缘防火墙/端口放行：
  由于subdomain1正常，大概率是学校网络的边缘防火墙未对subdomain2开放443端口，联系IT确认域名端口规则配置。
• 本地防火墙确认：
  执行sudo ufw status，确认443端口处于允许状态（虽然subdomain1正常，但可再次验证）。

2. Nginx配置细节排查 #

• SSL证书权限检查：
  确保nginx进程用户（默认www-data）能读取subdomain2的证书文件：

  ls -l /path/.ssl/subdomain2.crt /path/.ssl/subdomain2.key
  

  权限需至少为644，目录权限为755，若权限不足执行：

  sudo chown www-data:www-data /path/.ssl/subdomain2.*
  sudo chmod 644 /path/.ssl/subdomain2.*
  

• 配置加载验证：
  重启nginx后查看错误日志，确认subdomain2配置加载成功：

  sudo systemctl restart nginx
  grep -i subdomain2 /var/log/nginx/error.log
  

• 临时禁用SSL测试：
  修改subdomain2的443 server块为80端口，注释SSL相关配置：

  server {
      listen 80;
      server_name subdomain2.base.edu;
  
      location / {
          proxy_pass http://127.0.0.1:10123;
      }
  }
  

  重启nginx后访问http://subdomain2.base.edu，若能正常响应，说明问题出在SSL配置或端口放行。

3. 代理与请求头验证 #

• 本地模拟外部请求：
  在服务器上模拟带正确Host头的请求，验证nginx是否匹配subdomain2的server块：

  curl -H "Host: subdomain2.base.edu" https://127.0.0.1 -k
  

  若能得到后端服务响应，说明nginx配置正常，问题在外部网络层面；若无响应，检查nginx日志是否有记录。
• 实时监控日志：
  开启日志实时监控，同时发起外部请求，确认是否有日志输出：

  tail -f /var/log/nginx/subdomain2_err.log /var/log/nginx/subdomain2_acc.log
  

4. 其他可能性排查 #

• 端口占用检查：
  确认443端口仅被nginx监听：

  sudo ss -tulpn | grep :443
  

• 本地DNS缓存清除：
  测试时清除本地DNS缓存，避免旧解析记录干扰：
  • Windows: ipconfig /flushdns
  • macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
  • Linux: sudo systemd-resolve --flush-caches

内容的提问来源于stack exchange，提问作者Jeeshe