Nginx。我无法通过https访问我的NodeJs应用程序在端口3000上侦听。我可以通过http. https://www.modelistas.tk:3000/api/status完成。我尝试使用curl
详细输出:
root@ip-172-31-50-215:/opt/letsencrypt# curl -v -k https://modelistas.tk:3000/api/status
* Trying 72.44.61.151...
* TCP_NODELAY set
* Connected to modelistas.tk (72.44.61.151) port 3000 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
我的配置Nginx默认
server {
listen 80 default_server;
listen [::]:80 default_server;
# Añadimos que escuche en el puerto 443 SSL:
listen 443 ssl;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
# AGREGADO Carpeta raiz de este servidor :
root /var/www/www.modelistas.tk/public;
# Add index.php to the list if you are using PHP
index index.html index.htm;
# AGREGADO
server_name www.modelistas.tk modelistas.tk;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#agregado
location ~ /\.ht {
deny all;
}
location ~ /.well-known {
allow all;
}
location /api {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://localhost:3000/;
proxy_ssl_session_reuse off;
proxy_set_header Host $http_host;
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
}
# Configuracion del certificado SSL de letsencrypt
ssl_certificate /etc/letsencrypt/live/modelistas.tk/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/modelistas.tk/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# Cipher Suites disponibles:
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
# Uso de grupo Diffie-Hellman
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
}
server {
listen 80;
server_name modelistas.ml www.modelistas.tk;
return 301 https://$host$request_uri;
}
1条答案
按热度按时间rsaldnfx1#
根据错误消息,您的服务器上没有TLSv1.3。请更新nginx配置以支持TLSv1.3。
SSL_协议TLSv 1、TLSv1.1、TLSv1.2、TLSv1.3;
或者,您可以通过此选项指定curl降级并使用TLSv1.2(或服务器支持的任何内容)。
--tlsv1.2
还有:
您正在通过端口3000连接到ssl / tls。该端口上没有TLS。连接到443,因为这是配置的。检查您是否在代理后面