Docker容器中运行带SSL的NGinX遇443端口故障求助

Hey there! Let's work through your Nginx HTTPS issue in Docker—80 working but 443 failing is a common gotcha, so let's break down the most likely fixes step by step.

First off, the most frequent mistake here is forgetting to map the host's 443 port to the container's 443 port. When you run the container, you need to explicitly include -p 443:443 alongside your -p 80:80 flag.

Example run command:

docker run -d -p 80:80 -p 443:443 --name my-nginx your-nginx-image

If you're using Docker Compose, make sure your docker-compose.yml has both ports defined:

services:
  nginx:
    image: your-nginx-image
    ports:
      - "80:80"
      - "443:443"
    # other configs...

Your Nginx config points to /etc/nginx/ssl/nginx.crt and /etc/nginx/ssl/nginx.key, so we need to confirm those files exist inside the container and are readable by Nginx.

• Run this command to check the files:

  docker exec -it my-nginx ls /etc/nginx/ssl/
  

  If you don't see both .crt and .key files, you messed up the volume mount. Double-check your -v flag (or Compose volumes section) to ensure you're mounting your host's certificate directory to /etc/nginx/ssl correctly.

• Also, make sure the certificate files have proper permissions. On your host, run:

  chmod 644 /path/to/your/ssl/nginx.crt /path/to/your/ssl/nginx.key
  

  Nginx needs read access to these files to serve HTTPS.

Older Nginx versions used ssl on; alongside listen 443;, but modern versions (1.15.0+) prefer combining them into listen 443 ssl;. Using the old syntax can cause errors.

Update your default.conf to this:

server {
    listen 443 ssl;  # Combine listen and ssl directive
    server_name localhost;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    # Use only secure protocols (TLSv1.1 and older are deprecated)
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    # Add a basic location block to test
    location / {
        root /usr/share/nginx/html;
        index index.html index.htm;
    }
}

Then test the config and reload Nginx:

# Test config validity
docker exec my-nginx nginx -t
# Reload if test passes
docker exec my-nginx nginx -s reload

If the test fails, check the output—it'll tell you exactly where the syntax error is (e.g., missing semicolon, wrong path).

Even if Docker is mapped correctly, your host's firewall or cloud provider's security group might be blocking port 443.

• On Ubuntu/Debian:

  ufw allow 443/tcp
  ufw reload
  

• On CentOS/RHEL:

  firewall-cmd --add-port=443/tcp --permanent
  firewall-cmd --reload
  

• If you're on a cloud platform (AWS, GCP, Azure), make sure your security group allows inbound traffic on port 443.

Another possibility: something else on your host is using port 443. Check with:

# Using netstat
netstat -tulpn | grep 443
# Or ss (more modern)
ss -tulpn | grep 443

If you see another process (like Apache, another Nginx instance, or a VPN) using 443, either stop that process or map Docker's 443 to a different host port, e.g., -p 8443:443, then access https://localhost:8443.

Start with these steps—9 times out of 10, it's one of these issues. If you're still stuck, share the output of docker logs my-nginx and we can dig deeper!

内容的提问来源于stack exchange，提问作者user1792899