如何使用Nginx为同一域名下服务器的多个端口配置SSL证书

前置检查 #

• 确认Jenkins、Gitlab、Grafana服务均仅监听127.0.0.1，未占用公网端口，避免和Nginx的端口监听发生冲突
• 确保服务器防火墙、云服务商安全组已开放3000、8080、81三个端口的入站规则
• 你当前使用的Let's Encrypt证书为example.com域名签发，三个端口复用同一域名，证书可通用无需额外申请

Nginx配置修改 #

替换你现有的Nginx配置为以下内容，原有证书路径、日志路径、Certbot自动生成的规则均保留，新增三个SSL端口的转发规则：

# 80端口自动跳转HTTPS，保留原有Certbot生成的规则
server {
    if ($host = example.com) {
        return 301 https://$host$request_uri;
    }
    listen 80;
    server_name example.com;
    return 404;
}

# 原443端口访问转发到Grafana（不需要可以直接删除该server块）
server {
    listen 443 http2 ssl;
    server_name example.com;
    access_log /var/log/nginx/example.com.log;
    error_log /var/log/nginx/example.com.log;

    location /.well-known/acme-challenge/ {
        root /var/www/html/grafana;
        default_type text/plain;
    }

    location / {
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:3000;
        proxy_read_timeout 90;
        proxy_redirect http://127.0.0.1:3000 http://example.com/;
        proxy_http_version 1.1;
        proxy_request_buffering off;
    }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# HTTPS 3000端口转发到本地Grafana
server {
    listen 3000 http2 ssl;
    server_name example.com;
    access_log /var/log/nginx/example.com.3000.log;
    error_log /var/log/nginx/example.com.3000.log;

    location /.well-known/acme-challenge/ {
        root /var/www/html/grafana;
        default_type text/plain;
    }

    location / {
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:3000;
        proxy_read_timeout 90;
        proxy_http_version 1.1;
        proxy_request_buffering off;
    }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# HTTPS 8080端口转发到本地Jenkins
server {
    listen 8080 http2 ssl;
    server_name example.com;
    access_log /var/log/nginx/example.com.8080.log;
    error_log /var/log/nginx/example.com.8080.log;

    location /.well-known/acme-challenge/ {
        root /var/www/html/grafana;
        default_type text/plain;
    }

    location / {
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:8080;
        proxy_read_timeout 90;
        proxy_http_version 1.1;
        proxy_request_buffering off;
    }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

# HTTPS 81端口转发到本地Gitlab
server {
    listen 81 http2 ssl;
    server_name example.com;
    access_log /var/log/nginx/example.com.81.log;
    error_log /var/log/nginx/example.com.81.log;

    location /.well-known/acme-challenge/ {
        root /var/www/html/grafana;
        default_type text/plain;
    }

    location / {
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:81;
        proxy_read_timeout 90;
        proxy_http_version 1.1;
        proxy_request_buffering off;
    }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

生效步骤 #

1. 编辑完成后先测试配置合法性：nginx -t，返回success代表配置无语法错误
2. 重载Nginx使配置生效：systemctl reload nginx

补充说明 #

• 如果你用到的Jenkins、Gitlab有特殊的反向代理头要求，可以在对应端口的location /块中添加官方指定的配置参数即可
• 配置中保留了.well-known/acme-challenge的路由规则，不会影响Certbot自动续期证书

内容的提问来源于stack exchange，提问作者Susheel Bhatt