docker - nginx 错误 SSL : error:0906D06C:PEM routines:PEM_read_bio:no start

Question

没关系的伙计们。这是一个简单的配置问题，混淆了 key 和证书

我正在尝试在 docker 容器中设置 nginx。
它抛出错误:

nginx: [emerg] PEM_read_bio_X509_AUX("/ssl/nginx.key") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE)

我很清楚这通常是由语法错误引起的，但是:

openssl rsa -noout -text -in /ssl/nginx.key

似乎工作正常，因为现在抛出了错误消息。

有人知道这个问题并且能够帮助我或复制错误吗？

周末愉快 :)

环境(当然在容器中运行):

nginx -v
nginx version: nginx/1.13.7

docker --version
Docker version 17.12.0-ce, build c97c6d6

cat nginx.conf
user       www-data;  ## Default: nobody
worker_processes  auto;
pid        /run/nginx.pid;
worker_rlimit_nofile 8192;

events {
  worker_connections  4096;  ## Default: 1024
}

http {
  include    mime.types;
  default_type application/octet-stream;
  sendfile     on;
  tcp_nopush   on;
  server {
          listen 80;
          listen 443 ssl;
          ssl_certificate     /ssl/nginx.key;
          ssl_certificate_key /ssl/nginx.crt;

          root /web/phabricator/webroot;
          index index.html index.htm index.php;

          server_name _;

          location / {
            index index.php;
            rewrite ^/(.*)$ /index.php?__path__=/$1 last;
          }

          location ~ \.php$ {
            fastcgi_pass   php:9000;
            fastcgi_index   index.php;

            #required if PHP was built with --enable-force-cgi-redirect
            fastcgi_param  REDIRECT_STATUS    200;

            #variables to make the $_SERVER populate in PHP
            fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
            fastcgi_param  QUERY_STRING       $query_string;
            fastcgi_param  REQUEST_METHOD     $request_method;
            fastcgi_param  CONTENT_TYPE       $content_type;
            fastcgi_param  CONTENT_LENGTH     $content_length;

            fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;

            fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
            fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

            fastcgi_param  REMOTE_ADDR        $remote_addr;
    }
  }
}

Answer 1

正如您所指出的，错误在于混淆了 .key和 .crt文件。
这很容易完成。

ssl_certificate     /ssl/nginx.key;
ssl_certificate_key /ssl/nginx.crt;

这些文件只需要交换:

ssl_certificate     /ssl/nginx.crt;
ssl_certificate_key /ssl/nginx.key;