ssl - 如何在 nginx 上使用 letsencrypt 配置多个域

Question

我在尝试为 2 个域配置 SSL 时遇到了一些问题(在 link 之后)。请帮我!

我的上下文是:

• 我的服务器上有 2 个域:example.com 和 test.com

我想为以上 2 个域配置 SSL。这是配置:文件 /etc/nginx/sites-available/example:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}


server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    root /home/user1/example-com;
    index index.php index.html index.htm;

    server_name example.com www.example.com;

    location ~ ^/index.php/.*$ {
            try_files $uri $uri/ /index.php?$args;
    }

    access_log /var/log/nginx/example-access.log;
    error_log /var/log/nginx/example-error.log;

    location ~ /.well-known {
        allow all;
    }   

    # other configurations
}

文件 /etc/nginx/sites-available/test:

server {
    listen 80;
    listen [::]:80;
    server_name test.com www.test.com;
    return 301 https://$server_name$request_uri;
}


server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

#    include snippets/ssl-test.com.conf;    # I tried with other file but it didn't work
#    include snippets/ssl-params.conf;

    root /home/user1/test-tk;
    index index.php index.html index.htm;

    server_name test.com www.test.com;

    # Make site accessible from http://localhost/
    # server_name test.com;
    location ~ ^/index.php/.*$ {
            try_files $uri $uri/ /index.php?$args;
    }

    access_log /var/log/nginx/test-access.log;
    error_log /var/log/nginx/test-error.log;

    location ~ /.well-known {
        allow all;
    }   

    # other configurations  
}

重启nginx后没有报错

我可以使用 https://example.com/ 访问，第一个站点一切正常。但是对于第二个站点，它不起作用。当访问链接 https://test.com/ 时，我收到警告“您的连接不是私密的”。

Answer 1

代替行:

include snippets/ssl-example.com.conf;

使用特定于站点的配置(或替换 ssl-example.com.conf 的内容):

   ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

和ssl-params.conf 应该包含如下内容:

   ssl on;
   ssl_session_timeout 5m;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
   ssl_prefer_server_ciphers on;
   ssl_session_cache shared:SSL:10m;

(不一定是完美的配置，但它应该可以完成工作)。特别是 ssl on; 行很重要。