Nginx中HTTPS配置常见问题(证书过期/配置错误)的排查指南

# 查看证书有效期、签发者、主题、扩展信息（含 ocsp uri）
openssl x509 -in /etc/nginx/ssl/example.com/fullchain.pem -text -noout | \
  grep -e "(not before|not after|issuer:|subject:|x509v3 authority information access|x509v3 subject alternative name)"

# 模拟客户端获取 ocsp 响应（需确保 nginx ssl_stapling on）
echo | openssl s_client -connect example.com:443 -status 2>&1 | \
  sed -n '/ocsp response:/,/^$/p'

#!/bin/bash
# /usr/local/bin/renew-https.sh
domain="example.com"
cert_path="/etc/letsencrypt/live/$domain"
nginx_conf="/etc/nginx/sites-available/$domain"

# step 1: 尝试续期
if ! certbot renew --quiet --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"; then
  echo "[error] certbot renew failed" | logger -t renew-https
  exit 1
fi

# step 2: 验证证书链完整性（关键！）
if ! openssl verify -cafile <(cat "$cert_path"/fullchain.pem) "$cert_path"/cert.pem 2>/dev/null; then
  echo "[error] certificate chain verification failed" | logger -t renew-https
  exit 1
fi

# step 3: 检查 nginx 配置语法 & 重载
if nginx -t 2>/dev/null; then
  nginx -s reload
  echo "[info] https renewed and nginx reloaded for $domain" | logger -t renew-https
else
  echo "[error] nginx config test failed after renewal" | logger -t renew-https
  exit 1
fi

# ❌ 错误：路径拼写错误，或权限不足
ssl_certificate /etc/nginx/ssl/example.com/cert.pem;
ssl_certificate_key /etc/nginx/ssl/example.com/privkey.key; # 实际文件名为 private.key

# 检查文件是否存在、可读、非空
ls -lh /etc/nginx/ssl/example.com/{cert,privkey}.pem
stat /etc/nginx/ssl/example.com/cert.pem | grep "access\|uid"
test -r /etc/nginx/ssl/example.com/cert.pem && echo "readable" || echo "permission denied"

# ✅ 必须设置（指向系统 ca 证书包或 let's encrypt 根证书）
ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
# 或针对 let's encrypt（下载自 https://letsencrypt.org/certs/）
# ssl_trusted_certificate /etc/nginx/ssl/letsencrypt-root.pem;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 1.1.1.1 valid=300s;
resolver_timeout 5s;

# 成功响应应包含 "ocsp response status: successful (0x0)"
openssl s_client -connect example.com:443 -status -servername example.com 2>&1 | \
  grep -e "(ocsp|stapling)"

# ❌ 禁用 tlsv1.2+ → 导致现代浏览器握手失败
ssl_protocols tlsv1 tlsv1.1;

# ❌ 仅启用 tlsv1.3 → 排除所有旧客户端（如 android 7.0 以下、java 8u251 以下）
ssl_protocols tlsv1.3;

# ✅ 兼顾安全与兼容：tlsv1.2 + tlsv1.3（nginx 1.13.0+）
ssl_protocols tlsv1.2 tlsv1.3;

# 强制优先 tlsv1.3（若客户端支持）
ssl_prefer_server_ciphers off; # tlsv1.3 忽略此指令，但保留以兼容旧版

# ✅ mozilla intermediate（2024）—— 平衡安全与兼容
ssl_ciphers ecdhe-ecdsa-aes128-gcm-sha256:ecdhe-rsa-aes128-gcm-sha256:ecdhe-ecdsa-aes256-gcm-sha384:ecdhe-rsa-aes256-gcm-sha384:ecdhe-ecdsa-chacha20-poly1305:ecdhe-rsa-chacha20-poly1305:dhe-rsa-aes128-gcm-sha256:dhe-rsa-aes256-gcm-sha384;

ssl_ecdh_curve secp384r1;
ssl_dhparam /etc/nginx/ssl/dhparam.pem; # 生成命令：openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

# 列出 nginx 实际协商的套件（需启用 debug 日志）
nginx -t && nginx -s reload
# 在 error.log 中搜索：`ssl_do_handshake()`
# 或使用在线工具：https://www.ssllabs.com/ssltest/analyze.html?d=example.com

# 指定 sni 名称发起连接（模拟客户端行为）
openssl s_client -connect example.com:443 -servername api.example.com -showcerts 2>/dev/null | \
  head -20 | grep "subject="

# ❌ max-age=0 → 立即清除 hsts 策略（测试阶段可用，上线禁用）
add_header strict-transport-security "max-age=0; includesubdomains; preload" always;

# ❌ preload 但未提交至 chromium hsts preload list → 浏览器忽略 preload 指令
add_header strict-transport-security "max-age=31536000; includesubdomains; preload" always;

# 仅对 https 请求添加 hsts 头（避免 http 响应中误加）
if ($scheme = http) {
    return 301 https://$host$request_uri;
}
# https 块内添加
add_header strict-transport-security "max-age=31536000; includesubdomains; preload" always;

# ✅ 对 rest api 类服务：减小缓冲区，提升首字节时间（ttfb）
ssl_buffer_size 4k;

# ✅ 对大文件下载：增大缓冲区，减少系统调用
# ssl_buffer_size 32k;

# 对比 ttfb（使用 curl -w 模板）
curl -o /dev/null -s -w "ttfb: %{time_starttransfer}s\n" https://example.com/api/health

# ❌ 仅声明 http2，未启用 ssl，或 ssl_protocols 过低
listen 443 http2;
ssl_protocols tlsv1.1; # http/2 要求 tlsv1.2+

server {
    listen 443 ssl http2; # ✅ 关键：ssl 和 http2 同时声明
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    ssl_protocols tlsv1.2 tlsv1.3;
    # ... 其他 ssl 配置
}

# 在 http 块中
error_log /var/log/nginx/error.log debug;
# 重启后重现问题，然后关闭（避免磁盘爆满）
# error_log /var/log/nginx/error.log warn;

# ✅ 启用共享内存缓存（10mb ≈ 40,000 会话）
ssl_session_cache shared:ssl:10m;
ssl_session_timeout 4h;

# ✅ 启用 tlsv1.2+ session tickets（无状态恢复）
ssl_session_tickets on;
ssl_session_ticket_key /etc/nginx/ssl/session_ticket.key; # 20 字节随机密钥

# 生成 20 字节密钥（base64 编码）
openssl rand 20 | base64 > /etc/nginx/ssl/session_ticket.key
chmod 600 /etc/nginx/ssl/session_ticket.key

openssl s_client -connect example.com:443 -tls1_2 2>&1 | grep "protocol"
openssl s_client -connect example.com:443 -tls1_3 2>&1 | grep "protocol"

system.out.println("supported protocols: " + 
    arrays.tostring(sslcontext.getdefault().getsocketfactory().getsupportedsslparameters().getprotocols()));

// jdk 11+ 方式
system.setproperty("jdk.tls.client.protocols", "tlsv1.3");
// 或在 jvm 启动参数中添加
// -djdk.tls.client.protocols=tlsv1.3

sslsocketfactory factory = (sslsocketfactory) sslsocketfactory.getdefault();
try (sslsocket socket = (sslsocket) factory.createsocket("example.com", 443)) {
    socket.setenabledprotocols(new string[]{"tlsv1.2"});
    socket.setenabledciphersuites(new string[]{
        "tls_ecdhe_rsa_with_aes_256_gcm_sha384",
        "tls_ecdhe_rsa_with_aes_128_gcm_sha256"
    });
    socket.starthandshake();
}

import javax.net.ssl.*;
import java.security.cert.x509certificate;
import java.util.arrays;
public class sslchainvalidator {
    public static void main(string[] args) throws exception {
        string host = "example.com";
        int port = 443;
        sslcontext context = sslcontext.getinstance("tls");
        context.init(null, new trustmanager[]{new debugtrustmanager()}, null);
        sslsocketfactory factory = context.getsocketfactory();
        try (sslsocket socket = (sslsocket) factory.createsocket(host, port)) {
            socket.starthandshake();
            sslsession session = socket.getsession();
            system.out.println("peer host: " + session.getpeerhost());
            system.out.println("cipher: " + session.getciphersuite());
            system.out.println("protocol: " + session.getprotocol());
            // 打印完整证书链
            x509certificate[] chain = session.getpeercertificatechain();
            system.out.println("\n--- certificate chain ---");
            for (int i = 0; i < chain.length; i++) {
                x509certificate cert = chain[i];
                system.out.printf("[%d] subject: %s%n", i + 1, cert.getsubjectdn());
                system.out.printf("      issuer:  %s%n", cert.getissuerdn());
                system.out.printf("      serial:  %s%n", cert.getserialnumber().tostring(16));
            }
        }
    }
    // 自定义 trustmanager 用于调试（不校验，仅打印）
    static class debugtrustmanager implements x509trustmanager {
        @override
        public void checkclienttrusted(x509certificate[] chain, string authtype) {}
        @override
        public void checkservertrusted(x509certificate[] chain, string authtype) {}
        @override
        public x509certificate[] getacceptedissuers() { return new x509certificate[0]; }
    }
}

server:
  ssl:
    key-store: classpath:keystore.p12
    key-store-password: changeit
    key-store-type: pkcs12
    key-alias: tomcat
# 自定义 resttemplate bean（注入信任库）
@bean
public resttemplate resttemplate() throws exception {
    // 加载自定义 truststore（含中间 ca）
    keystore truststore = keystore.getinstance("pkcs12");
    try (inputstream is = new classpathresource("truststore.p12").getinputstream()) {
        truststore.load(is, "password".tochararray());
    }
    trustmanagerfactory tmf = trustmanagerfactory.getinstance(trustmanagerfactory.getdefaultalgorithm());
    tmf.init(truststore);
    sslcontext sslcontext = sslcontext.getinstance("tls");
    sslcontext.init(null, tmf.gettrustmanagers(), null);
    closeablehttpclient httpclient = httpclients.custom()
        .setsslcontext(sslcontext)
        .setsslhostnameverifier(noophostnameverifier.instance) // 生产勿用！
        .build();
    httpcomponentsclienthttprequestfactory factory = new httpcomponentsclienthttprequestfactory();
    factory.sethttpclient(httpclient);
    return new resttemplate(factory);
}

import okhttp3.*;
import javax.net.ssl.*;
import java.security.keystore;
import java.util.arrays;
public class okhttptlsclient {
    public static okhttpclient createsecureclient() throws exception {
        // 1. 构建信任库（推荐：使用系统默认 + 自定义中间 ca）
        trustmanagerfactory tmf = trustmanagerfactory.getinstance(
            trustmanagerfactory.getdefaultalgorithm());
        tmf.init((keystore) null); // 使用 jvm 默认 cacerts
        sslcontext sslcontext = sslcontext.getinstance("tls");
        sslcontext.init(null, tmf.gettrustmanagers(), null);
        // 2. 配置 connectionspec（显式声明支持的协议）
        connectionspec spec = new connectionspec.builder(connectionspec.modern_tls)
            .tlsversions(tlsversion.tls_1_2, tlsversion.tls_1_3)
            .ciphersuites(
                ciphersuite.tls_ecdhe_rsa_with_aes_256_gcm_sha384,
                ciphersuite.tls_ecdhe_rsa_with_aes_128_gcm_sha256)
            .build();
        return new okhttpclient.builder()
            .sslsocketfactory(sslcontext.getsocketfactory(), (x509trustmanager) tmf.gettrustmanagers()[0])
            .connectionspecs(arrays.aslist(spec))
            .hostnameverifier((hostname, session) -> {
                // 生产环境应使用 okhostnameverifier.default
                return hostname.equals("example.com") || hostname.endswith(".example.com");
            })
            .build();
    }
}

#!/bin/bash
# /usr/local/bin/nginx-https-diag.sh
domain=${1:-example.com}
echo "=== https diagnosis for $domain ==="
echo "1. tcp connect:"
timeout 3 bash -c "echo > /dev/tcp/$domain/443" 2>/dev/null && echo "✅ ok" || echo "❌ failed"

echo -e "\n2. certificate dates:"
echo | openssl s_client -connect "$domain:443" 2>/dev/null | openssl x509 -noout -dates 2>/dev/null || echo "❌ no cert"

echo -e "\n3. ocsp stapling:"
echo | openssl s_client -connect "$domain:443" -status 2>&1 | grep -i "response" | head -1 || echo "❌ not stapled"

echo -e "\n4. tls versions (via nmap):"
nmap --script ssl-enum-ciphers -p 443 "$domain" 2>/dev/null | grep -e "(tlsv1\.2|tlsv1\.3)" | head -2 | sed 's/^/   /' || echo "❌ nmap not found or blocked"