google-chrome - Nginx 反向代理适用于 Safari 和 Firefox，但不适用于 Chrome

Question

我使用 Nginx 作为反向代理将我的 Https 请求转发到后端服务器(在 Http 协议(protocol)中运行，端口 7654 在同一服务器中)。在 Safari 和 Firefox 中一切正常，但 Chrome 会抛出错误。

Chrome Error: net::ERR_CERT_AUTHORITY_INVALID

下面是我的 nginx.conf 文件。顺便说一句，当我在 Chrome 中使用 IP 地址而不是域名时，它也可以正常工作。我该如何解决这个问题？

    server {
        listen       443 ssl http2 default_server;
        listen       [::]:443 ssl http2 default_server;
        server_name  mydomain.name.lan;
        root         /usr/share/nginx/html;

        ssl_certificate "/etc/pki/tls/certs/crt.crt";
        ssl_certificate_key "/etc/pki/tls/private/key.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
                try_files $uri $uri/ /index.html;
        }

        location /app/v1/ {
                proxy_pass http://localhost:7654;
                proxy_set_header Host  $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto https;
        }

    }

Answer 1

我可以给你一个工作配置的例子，它适用于我们在公司使用的所有浏览器(当前最新版本)。 TLDR 背后的故事，我们有 docker swarm 部署，但我们有在主机上运行的入口点 Nginx，并且在容器内有另一个 Nginx，然后将流量重定向到特定的 API 网关等等。
我们将专注于第一级 Nginx(在主机上)，它实际上执行所有 SSL 检查等等.. 我们在 docker 内部使用 http(在 pod 和容器之间)..

Working example for linux:
server_tokens off;

    server {

        listen 443 http2 ssl;

        server_name development.docker.company.si;


        add_header Strict-Transport-Security "max-age=31536000" always;

        proxy_buffering off;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;

        set $upstream_local_docker_proxy 10.10.0.2; #static location of inner nginx

        ssl_certificate /etc/tls/si.company.docker.development-chain.crt;
        ssl_certificate_key /etc/tls/si.company.docker.development-unencrypted.key;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;
        ssl_protocols TLSv1.2 TLSv1.3;

        #here we just have /url-location-level-routing/ , in case you want to know
        location /my-application-demo/ {
                proxy_pass http://$upstream_local_docker_proxy;
                proxy_set_header Host local.docker.company-my-application-demo;
                rewrite ^/my-application-demo/(.*) /$1 break;
        }
    }

对于您拥有的特定情况，我有一个 Windows 配置，您需要做的就是将 Windows 证书路径更改为 linux，它应该可以工作:

   worker_processes  1;
  
   events {
       worker_connections  1024;
   }

   http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;

    upstream local-company1-api {
            server localhost:5000;
    }

    server {

            listen 443 http2 ssl;

            server_name company1.company.si;


            add_header Strict-Transport-Security "max-age=31536000" always;

            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;

            ssl_certificate C:\\tls\\si.company.company1-chain.pem;
            ssl_certificate_key C:\\tls\\si.company.company1-unencrypted.pem;
            ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
            ssl_prefer_server_ciphers off;
            ssl_protocols TLSv1.2 TLSv1.3;

            # ----------------------------------------------------------------------------------------------------

            location / {

                    proxy_pass http://local-company1-api/;
                    proxy_redirect off;
            }
       }
   }

我希望这会有所帮助。