{"id":506534,"date":"2021-06-17T22:58:36","date_gmt":"2021-06-17T14:58:36","guid":{"rendered":"http:\/\/4563.org\/?p=506534"},"modified":"2021-06-17T22:58:36","modified_gmt":"2021-06-17T14:58:36","slug":"%e3%80%90%e5%b0%8f%e6%95%99%e7%a8%8b%e3%80%91nginx-%e9%bb%98%e8%ae%a4%e6%8b%92%e7%bb%9d%e5%8f%91%e9%80%81%e8%af%81%e4%b9%a6%e8%ae%be%e7%bd%ae%e6%95%99%e7%a8%8b","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=506534","title":{"rendered":"\u3010\u5c0f\u6559\u7a0b\u3011nginx \u9ed8\u8ba4\u62d2\u7edd\u53d1\u9001\u8bc1\u4e66\u8bbe\u7f6e\u6559\u7a0b"},"content":{"rendered":"\n

\t\t\t\t\tiks<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

\u3010\u5c0f\u6559\u7a0b\u3011nginx \u9ed8\u8ba4\u62d2\u7edd\u53d1\u9001\u8bc1\u4e66\u8bbe\u7f6e\u6559\u7a0b<\/h3>\n

\t\t \u672c\u5e16\u6700\u540e\u7531 iks \u4e8e 2021-6-17 22:52 \u7f16\u8f91 <\/p>\n

\u5728 nginx \u672a\u6307\u5b9a\u5176 SSL \u8fde\u63a5\u76d1\u542c\u7aef\u53e3\u7684 default_server \u65f6\uff0cnginx \u4f1a\u9ed8\u8ba4\u53d1\u9001\u7b2c\u4e00\u5f20 SSL \u8bc1\u4e66\u7ed9\u5ba2\u6237\u7aef\u2014\u2014\u5373\u4f7f\u5ba2\u6237\u7aef\u7ed9\u7684 SNI \u4e3a\u7a7a\u6216\u4e0d\u5c5e\u4e8e\u672c\u673a\u4efb\u4f55\u4e00\u4e2a\u914d\u7f6e\u4e86\u7684 server_name\uff0c\u8fd9\u4f1a\u5bfc\u81f4\u56e0\u8bc1\u4e66\u88ab\u626b\u63cf\u5668\u63a2\u77e5\u800c\u5bfc\u81f4\u67d0\u79cd\u610f\u4e49\u4e0a\u7684\u4fe1\u606f\u6cc4\u9732\u3002
\u5728 nginx 1.19.4 \u53ca OpenSSL 1.1.1i \u4e4b\u524d\u7684\u89e3\u51b3\u65b9\u6848\u4e00\u822c\u662f\u5728 default_server \u91cc\u6307\u5b9a\u4e00\u4e2a\u81ea\u7b7e\u7684\u8bc1\u4e66\uff0c\u4f46\u8fd9\u6837\u4e0d\u591f\u7f8e\u89c2\uff08\u4e2a\u4eba\u7684 OCD \u75c7\u72b6\uff09\u3002\u597d\u6d88\u606f\u662f\uff0c\u73b0\u5728 nginx \u53ef\u4ee5\u76f4\u63a5\u5728 server \u5757\u5185\u8bbe\u7f6e ssl_reject_handshake\uff0c\u5373\u7ec8\u6b62 SSL \u63e1\u624b\u9636\u6bb5\uff0c\u907f\u514d\u8bc1\u4e66\u7684\u53d1\u9001\u3002
\u4ee5\u4e0b\u662f nginx server \u533a\u5757\u7684\u8bbe\u7f6e\uff0c\u3010\u8981\u6c42 nginx \u7248\u672c 1.19.4 \u4ee5\u4e0a\u3001\uff08\u7f16\u8bd1\u8fdb nginx \u7684\uff09OpenSSL \u7248\u672c 1.1.1i \u4ee5\u4e0a\uff0c\u5177\u4f53\u8bf7\u6267\u884c nginx -V \u67e5\u770b nginx version \u548c built with OpenSSL \u7684\u503c\u3011<\/p>\n

server
{
        listen 443 ssl http2 default_server;
        server_name _;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_reject_handshake on; \/\/\u542f\u7528\u62d2\u7edd TLS \u63e1\u624b
        ssl_session_cache shared:SSL:10m; \/\/\u8fd9\u4e2a\u5fc5\u987b\u8bbe\u7f6e\uff0c\u4e0d\u6307\u5b9a ssl_session_cache \u7684\u8bdd\uff0c\u4f1a\u5bfc\u81f4 Session resumption (caching) \u9a8c\u8bc1\u5931\u8d25
        ssl_session_timeout 10m;<\/p>\n

        access_log\/www\/wwwlogs\/access.log;
}<\/p>\n

\u4e0d\u7528\u6307\u5b9a\u8bc1\u4e66\u3002\u6539\u5b8c\u4fdd\u5b58\u7136\u540e\u91cd\u542f nginx \u5373\u53ef\uff0c\u6548\u679c\u5982\u4e0b\uff1a<\/p>\n

root@debian:~# curl -v https:\/\/36.27.222.72
* Expire in 0 ms for 6 (transfer 0x5617b4965fb0)
*   Trying 36.27.222.72…
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x5617b4965fb0)
* Connected to 36.27.222.72 (36.27.222.72) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http\/1.1
* successfully set certificate verify locations:
*   CAfile: none
CApath: \/etc\/ssl\/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* error:14094458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name
* Closing connection 0
curl: (35) error:14094458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name<\/p>\n

\uff08ip \u4e8b\u5047\u7684\uff0c\u4e0d\u7528\u6d4b\uff09
\u53ef\u4ee5\u770b\u5230\uff0c\u5f53\u5ba2\u6237\u7aef\u8bd5\u56fe\u4f7f\u7528 https \u65b9\u5f0f\u8bbf\u95ee\u6b64\u673a\u5668\u4e0a\u4e0d\u5b58\u5728\u7684 host \u65f6\uff0cTLS \u63e1\u624b\u5931\u8d25\uff0c\u8fd4\u56de\u503c\u9ed8\u8ba4\u5df2\u7ecf\u6ca1\u6709\u8bc1\u4e66\u3002<\/p>\n

\u8fd9\u6837\u914d\u7f6e\u7701\u4e86\u70b9\u65f6\u95f4\uff08\u7b7e\u81ea\u7b7e\u8bc1\u4e66\u7684\u65f6\u95f4\uff09\uff0c\u8981\u8bf4\u66f4\u5927\u7684\u610f\u4e49\u7684\u8bdd\uff0c\u5c31\u662f\u5728\u4e0d\u8003\u8651 no SNI \u4e0b\u7684\u5408\u89c4\u5427\u3002<\/p>\n

\u9e23\u8c22
t.me\/lalalajihttps:\/\/cdn.jsdelivr.net\/gh\/hishis\/forum-master\/public\/images\/patch.gif\t\t\t\t<\/p>\n

\t\t\t\t\twalterclozet<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u770b\u4e0d\u61c2\t\t\t\t<\/p>\n

\t\t\t\t\tjqbaobao<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u81ea\u7b7e\u4e2a\u5047\u8bc1\u4e66\u5b8c\u4e8b\t\t\t\t<\/p>\n

\t\t\t\t\t\u71d5\u5341\u4e09\u4e36<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\tmark \u6280\u672f\u6559\u7a0b\u8981\u9876 :lol\t\t\t\t<\/p>\n

\t\t\t\t\toilbit<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u80fd\u89e3\u91ca\u4e0b\u8fd9\u4e2a\u7684\u6df1\u5c42\u6b21\u7684\u610f\u4e49\u5417
\u6211\u4eec\u5e73\u65f6\u4e0d\u662f\u9ed8\u8ba4\u76f4\u63a5http \u8d7080\u5417\t\t\t\t<\/p>\n

\t\t\t\t\thostloc8888<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\tjqbaobao \u5927\u4f6c\u6709\u8bdd\u8bf4 : 2021-6-17 22:49
\u81ea\u7b7e\u4e2a\u5047\u8bc1\u4e66\u5b8c\u4e8b<\/p>\n

\u6709\u6bd2\u5427\u4f60\uff0c\u697c\u4e3b\u53c8\u4e0d\u662f\u6ca1\u4ecb\u7ecd\u81ea\u7b7e\u8bc1\u4e66yc020t\t\t\t\t<\/p>\n

\t\t\t\t\tiks<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\toilbit \u5927\u4f6c\u6709\u8bdd\u8bf4 : 2021-6-17 22:53
\u80fd\u89e3\u91ca\u4e0b\u8fd9\u4e2a\u7684\u6df1\u5c42\u6b21\u7684\u610f\u4e49\u5417
\u6211\u4eec\u5e73\u65f6\u4e0d\u662f\u9ed8\u8ba4\u76f4\u63a5http \u8d7080\u5417<\/p>\n

\u4e3b\u9898\u5e16\u7b2c\u4e00\u884chttps:\/\/cdn.jsdelivr.net\/gh\/hishis\/forum-master\/public\/images\/patch.gif\t\t\t\t<\/p>\n

\t\t\t\t\t\u53ef\u4e50\u5440<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u8fd9\u4e2a\u4e0d\u9519\uff0c\u4e0d\u7528\u5728\u81ea\u7b7e\u4e2a\u8bc1\u4e66\u4e86\t\t\t\t<\/p>\n

\t\t\t\t\th20<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\t\u5eb8\u4eba\u81ea\u6270\u4e5f\t\t\t\t<\/p>\n

\t\t\t\t\ttiga<\/strong> \t\t\t\t\u5927\u4f6c\u6709\u8bdd\u8bf4 : \t<\/p>\n

<\/h3>\n

\t\tnginx-1.20.0 stable version \u53d1\u5e03\u5c31\u7528\u4e0a\u4e86\u3002\t\t\t <\/p>\n","protected":false},"excerpt":{"rendered":"

iks \u5927\u4f6c\u6709\u8bdd\u8bf4 : \u3010\u5c0f\u6559\u7a0b\u3011…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/506534"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=506534"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/506534\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=506534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=506534"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=506534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}