请求协助解决Nginx反向代理后的ACME HTTP-01 Let's Encrypt证书挑战

架构说明 #

当前网络架构：WORLD ====> NGINX (反向代理) ============> K8S ingress(cert manager)

现有Nginx配置 #

upstream kube-ingress-https {
    # 最少活跃连接策略
    least_conn;
    server 172.22.16.3:443 max_fails=1 fail_timeout=300;
}

server {
    listen 443;

    proxy_protocol on;
    proxy_pass kube-ingress-https;
}

错误现象 #

cert-manager返回错误：Waiting for HTTP-01 challenge propagation: wrong status code '502', expected '200'

通过curl测试发现：访问域名根路径返回200状态码，但访问.well-known/acme-challenge路径返回502状态码，具体测试结果如下：

挑战路径测试 #

curl -I -k https://k8s-dash.domain.kz/.well-known/acme-challenge/pXy1kENDkrXpGNKLeyCc8huIfgUILzjErxiYhj80mxI
HTTP/2 502
date: Fri, 21 Oct 2022 06:55:51 GMT
content-type: text/html
content-length: 150
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-origin: *
access-control-allow-credentials: true

根路径测试 #

curl -I -k https://k8s-dash.mydomain.kz
HTTP/2 200
date: Fri, 21 Oct 2022 06:55:58 GMT
content-type: text/html; charset=utf-8
content-length: 1338
accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
last-modified: Fri, 15 Oct 2021 07:41:12 GMT
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-origin: *
access-control-allow-credentials: true

排查方向建议 #

• 检查K8s Ingress Controller的Proxy Protocol配置：Nginx反向代理启用了proxy_protocol on，需确认K8s ingress controller（如nginx-ingress）是否已开启Proxy Protocol支持，否则会导致请求解析失败返回502。
• 验证挑战路径的路由规则：查看cert-manager创建的临时Ingress资源是否正确匹配.well-known/acme-challenge路径，对应的挑战Pod是否正常运行。可通过kubectl get ingress和kubectl get pods -n cert-manager查看状态。
• 检查Nginx反向代理的请求转发细节：若环境允许，尝试关闭proxy_protocol on测试是否为该配置导致挑战路径转发异常；或添加针对.well-known/acme-challenge路径的单独转发规则，确保请求正确传递到K8s ingress。
• 查看K8s Ingress Controller日志：获取ingress controller的日志，查看挑战请求到达时的具体错误信息，比如是否存在404或其他转发失败记录。

内容的提问来源于stack exchange，提问作者user_1771