NGINX多HTTPS端口配置SSL证书代理转发时8877端口无法访问问题咨询

配置存在的错误点 #

• 8877端口的server_name配置错误：你当前写的是<domain name> .com，存在多余的空格和.com后缀，需要和443端口的server_name保持完全一致
• 8877端口的server块缺少闭合的}符号，会导致配置加载失败
• IPv6的8877监听配置未统一加http2参数，可能导致HTTP/2请求适配异常
• 未确认云服务器/主机的安全组、防火墙是否开放了8877端口的入站访问权限
• 未确认本地8502端口的Streamlit服务是否正常运行，nginx配置修改后是否重载生效

修复后的参考配置 #

server {
    listen 443 ssl http2;
    server_name  <domain name> default_server;

    ssl_certificate /etc/nginx/ssl/self.crt;
    ssl_certificate_key /etc/nginx/ssl/self.key;
    # 禁用不安全的旧SSL协议
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    # 优化加密套件
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    # 启用DH参数
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

    # 启用HSTS
    add_header Strict-Transport-Security "max-age=31536000" always;

    # SSL会话配置
    ssl_session_cache shared:SSL:40m;
    ssl_session_timeout 4h;
    ssl_session_tickets on;

    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;

    # Streamlit专用配置
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_read_timeout 86400;

    location / {
        auth_basic "Access Restricted";
        auth_basic_user_file "/etc/nginx/.htpasswd";
        proxy_pass http://127.0.0.1:8501/;
    }
}

server {
    listen 8877 ssl http2;
    listen [::]:8877 ssl http2;
    # 和443端口的server_name保持完全一致
    server_name  <domain name>;

    ssl_certificate /etc/nginx/ssl/self.crt;
    ssl_certificate_key /etc/nginx/ssl/self.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

    add_header Strict-Transport-Security "max-age=31536000" always;

    ssl_session_cache shared:SSL:40m;
    ssl_session_timeout 4h;
    ssl_session_tickets on;

    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;

    # Streamlit专用配置
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_read_timeout 86400;

    location / {
        # 访问测试通过后再取消注释开启身份认证
        # auth_basic "Access Restricted";
        # auth_basic_user_file "/etc/nginx/seconduser/.htpasswd";
        proxy_pass http://127.0.0.1:8502/;
    }
}

后续排查步骤 #

1. 执行nginx -t校验配置是否有语法错误，确认返回test is successful后执行nginx -s reload重载配置
2. 本地验证8502服务可用性：执行curl http://127.0.0.1:8502确认可以正常拿到返回内容
3. 检查主机防火墙：如果是firewalld执行firewall-cmd --add-port=8877/tcp --permanent && firewall-cmd --reload，如果是ufw执行ufw allow 8877/tcp
4. 检查云服务控制台安全组规则，确认开放了8877端口的TCP入站权限

内容的提问来源于stack exchange，提问作者Mohit Saxena