Nginx如何配置多个域名不同SSL证书？单服务器多证书实战指南

/etc/nginx/
├── ssl/                     # 所有证书根目录（禁止直接放 .pem！）
│   ├── example.com/         # 每域名独立子目录
│   │   ├── fullchain.pem    # 证书链（含根+中间ca）
│   │   ├── privkey.pem      # 私钥（必须 600 权限！）
│   │   └── readme.md        # 记录签发时间、ca、到期日、负责人
│   ├── api.example.com/
│   │   ├── fullchain.pem
│   │   ├── privkey.pem
│   │   └── readme.md
│   └── client-b.com/
│       ├── fullchain.pem    # 第三方提供证书
│       ├── privkey.pem
│       └── readme.md
├── conf.d/
│   ├── ssl-mapping.conf     # map 证书路径的核心配置
│   ├── sites-enabled/
│   │   ├── example.com.conf
│   │   ├── api.example.com.conf
│   │   └── client-b.com.conf
└── nginx.conf               # 主配置，include ssl-mapping.conf

#!/bin/bash
# secure-certs.sh - 运行于 certbot/acme.sh hook 中
cert_dir="/etc/nginx/ssl"
nginx_user="www-data"  # ubuntu/debian 默认用户

find "$cert_dir" -name "privkey.pem" -exec chmod 600 {} \;
find "$cert_dir" -name "fullchain.pem" -exec chmod 644 {} \;
chown -r "$nginx_user":"$nginx_user" "$cert_dir"

# === ssl certificate mapping by sni ===
# 使用 map 指令将域名映射到证书路径
# 注意：map 必须在 http{} 块顶层定义，不可在 server{} 内

map $ssl_server_name $upstream_cert {
    # 默认兜底证书（可选，用于未匹配域名的友好提示）
    default                          "/etc/nginx/ssl/_default/fullchain.pem";

    # 主站
    example.com                        "/etc/nginx/ssl/example.com/fullchain.pem";
    www.example.com                    "/etc/nginx/ssl/example.com/fullchain.pem";

    # api 服务
    api.example.com                    "/etc/nginx/ssl/api.example.com/fullchain.pem";
    staging-api.example.com            "/etc/nginx/ssl/api.example.com/fullchain.pem";

    # 运营后台
    admin.example.com                  "/etc/nginx/ssl/admin.example.com/fullchain.pem";

    # 白标客户
    client-a.brandpartner.net          "/etc/nginx/ssl/client-a.brandpartner.net/fullchain.pem";
    client-b.brandpartner.net          "/etc/nginx/ssl/client-b.brandpartner.net/fullchain.pem";

    # 国密证书（sm2）站点 —— 需 nginx with openssl 3.0+ & gmssl
    sm2.example.com                    "/etc/nginx/ssl/sm2.example.com/fullchain_sm2.pem";
}

map $ssl_server_name $upstream_key {
    default                          "/etc/nginx/ssl/_default/privkey.pem";
    example.com                        "/etc/nginx/ssl/example.com/privkey.pem";
    www.example.com                    "/etc/nginx/ssl/example.com/privkey.pem";
    api.example.com                    "/etc/nginx/ssl/api.example.com/privkey.pem";
    staging-api.example.com            "/etc/nginx/ssl/api.example.com/privkey.pem";
    admin.example.com                  "/etc/nginx/ssl/admin.example.com/privkey.pem";
    client-a.brandpartner.net          "/etc/nginx/ssl/client-a.brandpartner.net/privkey.pem";
    client-b.brandpartner.net          "/etc/nginx/ssl/client-b.brandpartner.net/privkey.pem";
    sm2.example.com                    "/etc/nginx/ssl/sm2.example.com/privkey_sm2.pem";
}

# 可选：根据域名启用不同 tls 版本（如国密站强制 tlsv1.3）
map $ssl_server_name $tls_protocols {
    default                          "tlsv1.2 tlsv1.3";
    sm2.example.com                    "tlsv1.3";
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # 关键：动态证书路径
    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;
    ssl_protocols       $tls_protocols;

    # 域名匹配（sni 已由上层 map 解析，此处仅做路由）
    server_name api.example.com staging-api.example.com;

    # 强制 hsts（生产环境必开）
    add_header strict-transport-security "max-age=31536000; includesubdomains; preload" always;

    # ocsp stapling 加速证书状态验证
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;
    resolver_timeout 5s;

    # 安全头
    add_header x-frame-options "deny" always;
    add_header x-content-type-options "nosniff" always;
    add_header x-xss-protection "1; mode=block" always;
    add_header referrer-policy "no-referrer-when-downgrade" always;

    # java 后端代理（示例：spring boot 微服务）
    location / {
        proxy_pass https://backend-java-cluster;
        proxy_http_version 1.1;
        proxy_set_header upgrade $http_upgrade;
        proxy_set_header connection "upgrade";
        proxy_set_header host $host;
        proxy_set_header x-real-ip $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header x-forwarded-proto $scheme;

        # 传递客户端证书（如需双向认证）
        proxy_ssl_verify off; # 生产请开启并配置 ca.crt
    }

    # 健康检查端点（不走 java 逻辑，nginx 直答）
    location /healthz {
        return 200 'ok';
        add_header content-type text/plain;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;

    # 客户提供证书，可能为 ov 或 ev，需特殊 header
    server_name client-b.brandpartner.net;

    # 客户要求：暴露证书信息至响应头（合规审计用）
    ssl_certificate_info on; # nginx 1.19.7+
    add_header x-cert-issuer $ssl_client_i_dn_o;
    add_header x-cert-subject $ssl_client_s_dn_cn;

    location / {
        # 代理至客户指定后端（可能是 java tomcat 集群）
        proxy_pass http://client-b-tomcat;
        proxy_set_header host $host;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header x-forwarded-proto $scheme;
    }
}

# 检查语法
sudo nginx -t

# 查看当前加载的证书映射（调试用）
sudo nginx -t 2>/dev/null | grep -a5 "map \$ssl_server_name"

# 测试特定域名证书是否匹配
openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer

server:
  forward-headers-strategy: framework  # 启用 spring 对 x-forwarded-* 的解析

# 若使用 tomcat（默认）
server:
  tomcat:
    remote-ip-header: x-forwarded-for
    protocol-header: x-forwarded-proto
    internal-proxies: 127\.0\.0\.1|::1|10\.0\.0\.0/8|172\.16\.0\.0/12|192\.168\.0\.0/16

@configuration
public class webconfig implements webmvcconfigurer {

    @bean
    public servletwebserverfactory servletcontainer() {
        tomcatservletwebserverfactory tomcat = new tomcatservletwebserverfactory();
        // 开启 http 重定向到 https（仅当 nginx 未做时启用）
        tomcat.addadditionaltomcatconnectors(redirectconnector());
        return tomcat;
    }

    private connector redirectconnector() {
        connector connector = new connector("org.apache.coyote.http11.http11nioprotocol");
        connector.setscheme("http");
        connector.setport(8080); // nginx 将 80→443，此端口仅内部访问
        connector.setsecure(false);
        connector.setredirectport(8443); // 此端口实际由 nginx 终结
        connector.setproperty("proxyport", "443");
        connector.setproperty("proxyname", "api.example.com");
        return connector;
    }

    // ✅ 关键：覆盖默认 forwardedheaderfilter，添加 x-forwarded-host 支持
    @bean
    public filter forwardedheaderfilter() {
        forwardedheaderfilter filter = new forwardedheaderfilter();
        filter.settrustedproxies(pattern.compile("127\\.0\\.0\\.1|10\\.\\d+\\.\\d+\\.\\d+|172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d+\\.\\d+|192\\.168\\.\\d+\\.\\d+"));
        return filter;
    }
}

@restcontroller
public class urlcontroller {

    @getmapping("/debug/url")
    public map<string, string> debugurl(httpservletrequest request) {
        map<string, string> info = new hashmap<>();
        info.put("scheme", request.getscheme());                    // ✅ 返回 "https"
        info.put("servername", request.getservername());            // ✅ 返回 "api.example.com"
        info.put("requesturl", request.getrequesturl().tostring()); // ✅ 返回 "https://api.example.com/debug/url"
        info.put("forwardedproto", request.getheader("x-forwarded-proto")); // "https"
        info.put("forwardedhost", request.getheader("x-forwarded-host"));     // "api.example.com"
        return info;
    }

    // ✅ 安全重定向：自动使用 https 协议
    @getmapping("/secure-redirect")
    public responseentity<void> secureredirect() {
        return responseentity.status(httpstatus.moved_permanently)
                .header(httpheaders.location, "/dashboard") // spring 自动补全 scheme+host
                .build();
    }
}

@component
public class clientipresolver {

    public string getclientip(httpservletrequest request) {
        string ip = request.getheader("x-forwarded-for");
        if (ip == null || ip.isempty() || "unknown".equalsignorecase(ip)) {
            ip = request.getheader("x-real-ip");
        }
        if (ip == null || ip.isempty() || "unknown".equalsignorecase(ip)) {
            ip = request.getremoteaddr();
        }
        // 取第一个 ip（xff 可能为 "a,b,c"）
        if (ip != null && ip.contains(",")) {
            ip = ip.split(",")[0].trim();
        }
        return ip;
    }
}

curl https://get.acme.sh | sh
source ~/.acme.sh/acme.sh.env
acme.sh --set-default-ca --server letsencrypt

# 假设使用阿里云 dns
export ali_key="your_access_key"
export ali_secret="your_access_secret"

acme.sh --issue \
  -d api.example.com \
  -d staging-api.example.com \
  --dns dns_ali \
  --keylength ec-256 \
  --pre-hook "/usr/local/bin/secure-certs.sh" \
  --deploy-hook "/usr/local/bin/reload-nginx.sh"

#!/bin/bash
# /usr/local/bin/reload-nginx.sh

domain=$1  # acme.sh 传入的域名
cert_dir="/etc/nginx/ssl/$domain"
nginx_conf="/etc/nginx/conf.d/ssl-mapping.conf"

# 创建域名目录
mkdir -p "$cert_dir"

# 复制证书（acme.sh 输出路径固定）
cp "$home/.acme.sh/$domain/fullchain.cer" "$cert_dir/fullchain.pem"
cp "$home/.acme.sh/$domain/$domain.key" "$cert_dir/privkey.pem"

# 权限加固
chmod 600 "$cert_dir/privkey.pem"
chmod 644 "$cert_dir/fullchain.pem"
chown www-data:www-data "$cert_dir" "$cert_dir/*"

# ✅ 关键：自动更新 ssl-mapping.conf 中的 map 条目
# 使用 sed 在 map 块中追加或替换（生产环境建议用更健壮的 awk/python 脚本）
if ! grep -q "$domain" "$nginx_conf"; then
    sed -i "/default.*;/a \    $domain                        \"\/etc\/nginx\/ssl\/$domain\/fullchain.pem\";" "$nginx_conf"
    sed -i "/default.*;/a \    $domain                        \"\/etc\/nginx\/ssl\/$domain\/privkey.pem\";" "$nginx_conf"
fi

# 语法检查 + 重载
if nginx -t 2>/dev/null; then
    systemctl reload nginx
    echo "✅ nginx reloaded for $domain"
else
    echo "❌ nginx config error for $domain"
    exit 1
fi

# crontab -e
0 3 * * * "/root/.acme.sh/acme.sh" --cron --home "/root/.acme.sh" > /var/log/acme.sh.log 2>&1

# /etc/nginx/conf.d/sm2.example.com.conf
server {
    listen 443 ssl http2;
    listen 4433 ssl http2;  # 国密专用端口

    # 匹配国密证书
    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;

    # 强制国密套件
    ssl_ciphers ecdhe-sm2-with-sms4-sm3:ecdhe-sm2-with-sms4-gcm-sm3;
    ssl_prefer_server_ciphers off;

    # alpn 声明（国密客户端识别）
    ssl_alpn_protocols "sm2";

    server_name sm2.example.com;

    location / {
        proxy_pass https://sm2-java-backend;
        proxy_ssl_protocols tlsv1.3;
        proxy_ssl_ciphers ecdhe-sm2-with-sms4-gcm-sm3;
        proxy_ssl_verify off;
    }
}

<!-- pom.xml -->
<dependency>
    <groupid>org.bouncycastle</groupid>
    <artifactid>bcprov-jdk15on</artifactid>
    <version>1.70</version>
</dependency>
<dependency>
    <groupid>org.bouncycastle</groupid>
    <artifactid>bcpkix-jdk15on</artifactid>
    <version>1.70</version>
</dependency>

@configuration
public class sm2config {

    @bean
    public sslcontext sm2sslcontext() throws exception {
        security.addprovider(new bouncycastleprovider());
        keystore keystore = keystore.getinstance("pkcs12");
        try (inputstream is = getclass().getresourceasstream("/sm2/keystore.p12")) {
            keystore.load(is, "password".tochararray());
        }

        keymanagerfactory kmf = keymanagerfactory.getinstance("sunx509");
        kmf.init(keystore, "password".tochararray());

        sslcontext context = sslcontext.getinstance("tlsv1.3");
        context.init(kmf.getkeymanagers(), null, new securerandom());
        return context;
    }
}

# 在 http{} 块中定义 log_format
log_format cert_info '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'cert="$ssl_server_name" '
                     'not_after="$ssl_certificate_not_after"';

access_log /var/log/nginx/access.log cert_info;

# alert.rules
groups:
- name: ssl-certificate-alerts
  rules:
  - alert: sslcertificateexpiringsoon
    expr: (time() - nginx_ssl_certificate_not_after{job="nginx"}) / 3600 < 168
    for: 1h
    labels:
      severity: warning
    annotations:
      summary: "ssl certificate for {{ $labels.cert }} expires in less than 7 days"
      description: "certificate for {{ $labels.cert }} expires at {{ $value }}"

  - alert: sslcertificateexpired
    expr: time() > nginx_ssl_certificate_not_after{job="nginx"}
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "ssl certificate for {{ $labels.cert }} has expired"

@component
public class certificatehealthindicator implements healthindicator {

    private final string cert_path = "/etc/nginx/ssl/example.com/fullchain.pem";

    @override
    public health health() {
        try {
            certificatefactory cf = certificatefactory.getinstance("x.509");
            try (inputstream is = files.newinputstream(paths.get(cert_path))) {
                x509certificate cert = (x509certificate) cf.generatecertificate(is);
                date notafter = cert.getnotafter();
                long daysleft = timeunit.milliseconds.todays(notafter.gettime() - system.currenttimemillis());
                if (daysleft < 7) {
                    return health.down()
                            .withdetail("certificate", cert_path)
                            .withdetail("expiresindays", daysleft)
                            .withdetail("notafter", notafter.tostring())
                            .build();
                }
            }
            return health.up().build();
        } catch (exception e) {
            return health.down().withexception(e).build();
        }
    }
}