ssl - Nginx 使用 SSL 服务错误的根目录

Question

我有两个 nginx 虚拟主机，除了域和 SSL/root 位置之外，它们完全相同。它们看起来像这样:

/etc/nginx/sites-available/domain1.co.uk

server {
    listen 80;
    server_name domain1.co.uk;
    rewrite ^/(.*) https://domain1.co.uk/$1 permanent;
}

server {
    listen               80;
    listen               443 ssl;
    server_name          www.domain1.co.uk;
    ssl_certificate /etc/nginx/ssl/domain1.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/private/domain1.key;    
    return 301 $scheme://domain1.co.uk$request_uri;
}

server {
    listen 443 ssl;

    server_name domain1.co.uk;

    root        /var/www/domain1.co.uk/public_html;
    ssl_certificate /etc/nginx/ssl/domain1.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/private/domain1.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
        try_files $uri @prerender;
    }

    location /blog/ {
    index index.php;
    try_files $uri $uri/ /blog/index.php?$args;
    }

    # pass the PHP scripts to FastCGI server listening on the php-fpm socket
    location ~ \.php$ {
            try_files $uri =404;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;

    }

    location ~ ^/api {
        try_files $request_uri $request_uri/ /api/index.php?$query_string;
    }

    location @prerender {
        proxy_set_header X-Prerender-Token 4398455894u5ugjgfgfj;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;

        set $prerender 0;
        if ($http_user_agent ~* "googlebot|yahoo|bingbot|baiduspider|yandex|yeti|yodaobot|gigabot|ia_archiver|facebookexternalhit|twitterbot|developers\.google\.com") {
            set $prerender 1;
        }
        if ($args ~ "_escaped_fragment_|prerender=1") {
            set $prerender 1;
        }
        if ($http_user_agent ~ "Prerender") {
            set $prerender 0;
        }

        if ($prerender = 1) {
            rewrite .* /$scheme://$host$request_uri? break;
            #proxy_pass http://localhost:3000;
            proxy_pass http://service.prerender.io;
        }
        if ($prerender = 0) {
            proxy_pass http://127.0.0.1:3000;
        }
    }

}

/etc/nginx/sites-available/domain2.co.uk

server {
    listen 80;
    server_name domain2.co.uk;
    rewrite ^/(.*) https://domain2.co.uk/$1 permanent;
}

server {
    listen               80;
    listen               443 ssl;
    server_name          www.domain2.co.uk;
    ssl_certificate /etc/nginx/ssl/domain2.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/private/domain2.key;    
    return 301 $scheme://domain2.co.uk$request_uri;
}

server {
    listen 443 ssl;

    server_name domain2.co.uk;

    root        /var/www/domain2.co.uk/public_html;
    ssl_certificate /etc/nginx/ssl/domain2.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/private/domain2.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
        try_files $uri @prerender;
    }

    location /blog/ {
    index index.php;
    try_files $uri $uri/ /blog/index.php?$args;
    }

    # pass the PHP scripts to FastCGI server listening on the php-fpm socket
    location ~ \.php$ {
            try_files $uri =404;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;

    }

    location ~ ^/api {
        try_files $request_uri $request_uri/ /api/index.php?$query_string;
    }

    location @prerender {
        proxy_set_header X-Prerender-Token 4398455894u5ugjgfgfj;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;

        set $prerender 0;
        if ($http_user_agent ~* "googlebot|yahoo|bingbot|baiduspider|yandex|yeti|yodaobot|gigabot|ia_archiver|facebookexternalhit|twitterbot|developers\.google\.com") {
            set $prerender 1;
        }
        if ($args ~ "_escaped_fragment_|prerender=1") {
            set $prerender 1;
        }
        if ($http_user_agent ~ "Prerender") {
            set $prerender 0;
        }

        if ($prerender = 1) {
            rewrite .* /$scheme://$host$request_uri? break;
            #proxy_pass http://localhost:3000;
            proxy_pass http://service.prerender.io;
        }
        if ($prerender = 0) {
            proxy_pass http://127.0.0.1:3000;
        }
    }

}

当我访问 domain1.co.uk 时，它按预期工作，并重定向到非 www https URL。如果我访问 domain2.co.uk，它会提供正确的 SSL 证书，但会在 domain2 URL 上显示 domain1 站点。

我也有一个默认服务器 block :

server {
    listen 80 default_server;
    return 444;
}

server {
    listen 443 default_server;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
    return 444;
}

我如何配置它，以便 domain2.co.uk 实际上提供来自 /var/www/domain2.co.uk/public_html 而不是 domain1 的文件？

Answer 1

啊!对不起!我想，您没有 domain2.co.uk。希望您有“/var/www/domain2.co.uk/public_html”作为“domain2.co.uk”服务器的根目录。如果不包含，您是否让 nginx 读取/etc/nginx/sites-available/domain2.co.uk 文件。基本上，您需要检查/etc/nginx/nginx.conf 中的“include”指令，并创建一个符号链接(symbolic link)文件“/etc/nginx/sites-enabled/domain2.co.uk”并将其指向“/etc/nginx/sites-available/domain1.co.uk"启用它。