Nginx中HTTPS配置常见问题(证书过期/配置错误)的排查指南

# 查看证书有效期、签发者、主题、扩展信息（含 OCSP URI）
openssl x509 -in /etc/nginx/ssl/example.com/fullchain.pem -text -noout | \
  grep -E "(Not Before|Not After|Issuer:|Subject:|X509v3 Authority Information Access|X509v3 Subject Alternative Name)"

# 模拟客户端获取 OCSP 响应（需确保 nginx ssl_stapling on）
echo | openssl s_client -connect example.com:443 -status 2>&1 | \
  sed -n '/OCSP response:/,/^$/p'

#!/bin/bash
# /usr/local/bin/renew-https.sh
DOMAIN="example.com"
CERT_PATH="/etc/letsencrypt/live/$DOMAIN"
NGINX_CONF="/etc/nginx/sites-available/$DOMAIN"

# Step 1: 尝试续期
if ! certbot renew --quiet --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"; then
  echo "[ERROR] certbot renew failed" | logger -t renew-https
  exit 1
fi

# Step 2: 验证证书链完整性（关键！）
if ! openssl verify -CAfile <(cat "$CERT_PATH"/fullchain.pem) "$CERT_PATH"/cert.pem 2>/dev/null; then
  echo "[ERROR] Certificate chain verification failed" | logger -t renew-https
  exit 1
fi

# Step 3: 检查 Nginx 配置语法 & 重载
if nginx -t 2>/dev/null; then
  nginx -s reload
  echo "[INFO] HTTPS renewed and nginx reloaded for $DOMAIN" | logger -t renew-https
else
  echo "[ERROR] nginx config test failed after renewal" | logger -t renew-https
  exit 1
fi

# ❌ 错误：路径拼写错误，或权限不足
ssl_certificate /etc/nginx/ssl/example.com/cert.pem;
ssl_certificate_key /etc/nginx/ssl/example.com/privkey.key; # 实际文件名为 private.key

# 检查文件是否存在、可读、非空
ls -lh /etc/nginx/ssl/example.com/{cert,privkey}.pem
stat /etc/nginx/ssl/example.com/cert.pem | grep "Access\|Uid"
test -r /etc/nginx/ssl/example.com/cert.pem && echo "Readable" || echo "Permission denied"

# ✅ 必须设置（指向系统 CA 证书包或 Let's Encrypt 根证书）
ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
# 或针对 Let's Encrypt（下载自 https://letsencrypt.org/certs/）
# ssl_trusted_certificate /etc/nginx/ssl/letsencrypt-root.pem;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 1.1.1.1 valid=300s;
resolver_timeout 5s;

# 成功响应应包含 "OCSP Response Status: successful (0x0)"
openssl s_client -connect example.com:443 -status -servername example.com 2>&1 | \
  grep -E "(OCSP|stapling)"

# ❌ 禁用 TLSv1.2+ → 导致现代浏览器握手失败
ssl_protocols TLSv1 TLSv1.1;

# ❌ 仅启用 TLSv1.3 → 排除所有旧客户端（如 Android 7.0 以下、Java 8u251 以下）
ssl_protocols TLSv1.3;

# ✅ 兼顾安全与兼容：TLSv1.2 + TLSv1.3（Nginx 1.13.0+）
ssl_protocols TLSv1.2 TLSv1.3;

# 强制优先 TLSv1.3（若客户端支持）
ssl_prefer_server_ciphers off; # TLSv1.3 忽略此指令，但保留以兼容旧版

# ✅ Mozilla Intermediate（2024）—— 平衡安全与兼容
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

ssl_ecdh_curve secp384r1;
ssl_dhparam /etc/nginx/ssl/dhparam.pem; # 生成命令：openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

# 列出 Nginx 实际协商的套件（需启用 debug 日志）
nginx -t && nginx -s reload
# 在 error.log 中搜索：`SSL_do_handshake()`
# 或使用在线工具：https://www.ssllabs.com/ssltest/analyze.html?d=example.com

# 指定 SNI 名称发起连接（模拟客户端行为）
openssl s_client -connect example.com:443 -servername api.example.com -showcerts 2>/dev/null | \
  head -20 | grep "subject="

# ❌ max-age=0 → 立即清除 HSTS 策略（测试阶段可用，上线禁用）
add_header Strict-Transport-Security "max-age=0; includeSubDomains; preload" always;

# ❌ preload 但未提交至 Chromium HSTS Preload List → 浏览器忽略 preload 指令
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 仅对 HTTPS 请求添加 HSTS 头（避免 HTTP 响应中误加）
if ($scheme = http) {
    return 301 https://$host$request_uri;
}
# HTTPS 块内添加
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# ✅ 对 REST API 类服务：减小缓冲区，提升首字节时间（TTFB）
ssl_buffer_size 4k;

# ✅ 对大文件下载：增大缓冲区，减少系统调用
# ssl_buffer_size 32k;

# 对比 TTFB（使用 curl -w 模板）
curl -o /dev/null -s -w "TTFB: %{time_starttransfer}s\n" https://example.com/api/health

# ❌ 仅声明 http2，未启用 ssl，或 ssl_protocols 过低
listen 443 http2;
ssl_protocols TLSv1.1; # HTTP/2 要求 TLSv1.2+

server {
    listen 443 ssl http2; # ✅ 关键：ssl 和 http2 同时声明
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    # ... 其他 ssl 配置
}

# 在 http 块中
error_log /var/log/nginx/error.log debug;
# 重启后重现问题，然后关闭（避免磁盘爆满）
# error_log /var/log/nginx/error.log warn;

# ✅ 启用共享内存缓存（10MB ≈ 40,000 会话）
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 4h;

# ✅ 启用 TLSv1.2+ Session Tickets（无状态恢复）
ssl_session_tickets on;
ssl_session_ticket_key /etc/nginx/ssl/session_ticket.key; # 20 字节随机密钥

# 生成 20 字节密钥（base64 编码）
openssl rand 20 | base64 > /etc/nginx/ssl/session_ticket.key
chmod 600 /etc/nginx/ssl/session_ticket.key

openssl s_client -connect example.com:443 -tls1_2 2>&1 | grep "Protocol"
openssl s_client -connect example.com:443 -tls1_3 2>&1 | grep "Protocol"

System.out.println("Supported protocols: " + 
    Arrays.toString(SSLContext.getDefault().getSocketFactory().getSupportedSSLParameters().getProtocols()));

// JDK 11+ 方式
System.setProperty("jdk.tls.client.protocols", "TLSv1.3");
// 或在 JVM 启动参数中添加
// -Djdk.tls.client.protocols=TLSv1.3

SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
try (SSLSocket socket = (SSLSocket) factory.createSocket("example.com", 443)) {
    socket.setEnabledProtocols(new String[]{"TLSv1.2"});
    socket.setEnabledCipherSuites(new String[]{
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
    });
    socket.startHandshake();
}

import javax.net.ssl.*;
import java.security.cert.X509Certificate;
import java.util.Arrays;
public class SSLChainValidator {
    public static void main(String[] args) throws Exception {
        String host = "example.com";
        int port = 443;
        SSLContext context = SSLContext.getInstance("TLS");
        context.init(null, new TrustManager[]{new DebugTrustManager()}, null);
        SSLSocketFactory factory = context.getSocketFactory();
        try (SSLSocket socket = (SSLSocket) factory.createSocket(host, port)) {
            socket.startHandshake();
            SSLSession session = socket.getSession();
            System.out.println("Peer Host: " + session.getPeerHost());
            System.out.println("Cipher: " + session.getCipherSuite());
            System.out.println("Protocol: " + session.getProtocol());
            // 打印完整证书链
            X509Certificate[] chain = session.getPeerCertificateChain();
            System.out.println("\n--- Certificate Chain ---");
            for (int i = 0; i < chain.length; i++) {
                X509Certificate cert = chain[i];
                System.out.printf("[%d] Subject: %s%n", i + 1, cert.getSubjectDN());
                System.out.printf("      Issuer:  %s%n", cert.getIssuerDN());
                System.out.printf("      Serial:  %s%n", cert.getSerialNumber().toString(16));
            }
        }
    }
    // 自定义 TrustManager 用于调试（不校验，仅打印）
    static class DebugTrustManager implements X509TrustManager {
        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType) {}
        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) {}
        @Override
        public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
    }
}

server:
  ssl:
    key-store: classpath:keystore.p12
    key-store-password: changeit
    key-store-type: PKCS12
    key-alias: tomcat
# 自定义 RestTemplate Bean（注入信任库）
@Bean
public RestTemplate restTemplate() throws Exception {
    // 加载自定义 truststore（含中间 CA）
    KeyStore trustStore = KeyStore.getInstance("PKCS12");
    try (InputStream is = new ClassPathResource("truststore.p12").getInputStream()) {
        trustStore.load(is, "password".toCharArray());
    }
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(trustStore);
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, tmf.getTrustManagers(), null);
    CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLContext(sslContext)
        .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE) // 生产勿用！
        .build();
    HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();
    factory.setHttpClient(httpClient);
    return new RestTemplate(factory);
}

import okhttp3.*;
import javax.net.ssl.*;
import java.security.KeyStore;
import java.util.Arrays;
public class OkHttpTlsClient {
    public static OkHttpClient createSecureClient() throws Exception {
        // 1. 构建信任库（推荐：使用系统默认 + 自定义中间 CA）
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(
            TrustManagerFactory.getDefaultAlgorithm());
        tmf.init((KeyStore) null); // 使用 JVM 默认 cacerts
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);
        // 2. 配置 ConnectionSpec（显式声明支持的协议）
        ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
            .tlsVersions(TlsVersion.TLS_1_2, TlsVersion.TLS_1_3)
            .cipherSuites(
                CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
                CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
            .build();
        return new OkHttpClient.Builder()
            .sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) tmf.getTrustManagers()[0])
            .connectionSpecs(Arrays.asList(spec))
            .hostnameVerifier((hostname, session) -> {
                // 生产环境应使用 OkHostnameVerifier.DEFAULT
                return hostname.equals("example.com") || hostname.endsWith(".example.com");
            })
            .build();
    }
}

#!/bin/bash
# /usr/local/bin/nginx-https-diag.sh
DOMAIN=${1:-example.com}
echo "=== HTTPS Diagnosis for $DOMAIN ==="
echo "1. TCP Connect:"
timeout 3 bash -c "echo > /dev/tcp/$DOMAIN/443" 2>/dev/null && echo "✅ OK" || echo "❌ Failed"

echo -e "\n2. Certificate Dates:"
echo | openssl s_client -connect "$DOMAIN:443" 2>/dev/null | openssl x509 -noout -dates 2>/dev/null || echo "❌ No cert"

echo -e "\n3. OCSP Stapling:"
echo | openssl s_client -connect "$DOMAIN:443" -status 2>&1 | grep -i "response" | head -1 || echo "❌ Not stapled"

echo -e "\n4. TLS Versions (via nmap):"
nmap --script ssl-enum-ciphers -p 443 "$DOMAIN" 2>/dev/null | grep -E "(TLSv1\.2|TLSv1\.3)" | head -2 | sed 's/^/   /' || echo "❌ nmap not found or blocked"