Nginx子域名反向代理SSL配置异常求助

当前核心问题：

• HTTPS端口（443）的server块未关联对应应用的访问路径/反向代理规则
• 子域名未配置HTTPS的server块
• HTTP请求未强制跳转至HTTPS

1. 修正主域名cluego.nl的SSL配置 #

编辑ssl.conf，添加Laravel应用的根目录和PHP处理规则（Laravel需指向项目的public目录）：

server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;

    server_name cluego.nl www.cluego.nl; # 覆盖www域名，确保HTTPS访问生效
    ssl_certificate /etc/letsencrypt/live/cluego.nl/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/cluego.nl/privkey.pem; # managed by Certbot
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    # 保留原有SSL安全配置
    ssl_protocols TLSv1.3;# Requires nginx >= 1.13.0 else use TLSv1.2
    ssl_prefer_server_ciphers on;
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
    ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
    ssl_session_timeout  10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off; # Requires nginx >= 1.5.9
    ssl_stapling on; # Requires nginx >= 1.3.7
    ssl_stapling_verify on; # Requires nginx => 1.3.7
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # 新增：Laravel应用核心配置
    root /实际路径/cluego/public; # 替换为你的Laravel项目public目录路径
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP请求处理规则
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock; # 根据服务器PHP版本调整，比如php7.4-fpm.sock
    }
}

2. 为子域名qruzzle.cluego.nl添加HTTPS配置 #

编辑/etc/nginx/sites-available/qruzzle.cluego.nl，新增HTTPS server块并添加HTTP跳转规则：

# HTTP强制跳转至HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name qruzzle.cluego.nl www.qruzzle.cluego.nl;

    return 301 https://$server_name$request_uri;
}

# HTTPS配置
server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;
    server_name qruzzle.cluego.nl www.qruzzle.cluego.nl;
    access_log /var/log/nginx/qruzzle.cluego.nl.log;

    # SSL证书复用主域名的（确保证书包含子域名，否则需单独申请）
    ssl_certificate /etc/letsencrypt/live/cluego.nl/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cluego.nl/privkey.pem;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    # 复用SSL安全配置
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
    ssl_ecdh_curve secp384r1;
    ssl_session_timeout  10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # Node.js应用反向代理规则（保留原HTTP配置的逻辑）
    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://127.0.0.1:3000/;
        proxy_redirect off;
    }
}

3. 为子域名ijsbrekerz.cluego.nl添加HTTPS配置 #

创建配置文件/etc/nginx/sites-available/ijsbrekerz.cluego.nl，内容如下：

# HTTP强制跳转至HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name ijsbrekerz.cluego.nl www.ijsbrekerz.cluego.nl;

    return 301 https://$server_name$request_uri;
}

# HTTPS配置
server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;
    server_name ijsbrekerz.cluego.nl www.ijsbrekerz.cluego.nl;
    access_log /var/log/nginx/ijsbrekerz.cluego.nl.log;

    ssl_certificate /etc/letsencrypt/live/cluego.nl/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cluego.nl/privkey.pem;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    # 复用SSL安全配置
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
    ssl_ecdh_curve secp384r1;
    ssl_session_timeout  10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # Laravel应用核心配置
    root /实际路径/ijsbrekerz/public; # 替换为你的Laravel项目public目录路径
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP请求处理规则
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock; # 根据服务器PHP版本调整
    }
}

4. 配置生效步骤 #

1. 启用子域名配置文件（未启用的话执行）：

sudo ln -s /etc/nginx/sites-available/qruzzle.cluego.nl /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/ijsbrekerz.cluego.nl /etc/nginx/sites-enabled/

2. 检查Nginx配置语法：

sudo nginx -t

3. 重启Nginx服务：

sudo systemctl restart nginx

• 确保SSL证书包含所有子域名（通配符证书或多域名证书均可），否则需为每个子域名单独申请证书
• 替换配置中的/实际路径/xxx/public为服务器上的真实项目路径
• 根据服务器安装的PHP版本，调整fastcgi_pass后的socket路径
• 配置完成后验证所有HTTPS地址是否正常访问，HTTP是否自动跳转至HTTPS

内容的提问来源于stack exchange，提问作者M.Koops