NGINX不路由https请求

Question

I have a reverse proxy with nginx routing to a node web server

I setup (I thought) SSL on the web server, but it looks like when my browser attempts to resolve the https request, no connection ever starts.

I wanted to ask a couple of questions

1. Where do I setup the SSL? on the reverse proxy where the request is first hit? or the node server where authentication occurs?

2. What is wrong with my configuration (if that is the problem

https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-on-ubuntu-14-04

This is the tutorial I used

Code included (sorry I totally forgot to include)

server {
   listen 443 ssl;

   server_name domain www.domain.com;

    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-$
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_stapling on;
    ssl_stapling_verify on;
    add_header Strict-Transport-Security max-age=15768000;


    location / {
    proxy_pass http://app_server_ip:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
}
}

server {
    listen 80;
    server_name domain.com www.domain.com;
    return 301 https://$host$request_uri;
}

Answer 1

1.On the reverse proxy

2.You should configure nginx file as similar following (using upstream parameter):

        upstream api-app {
                least_conn;
                server 127.0.0.1:3000 weight=1 max_fails=0;
             }
        server {
              listen 80;
              listen  443 ssl;
              server_name api.domain.net;
              ssl_certificate /etc/letsencrypt/live/api.domain.net/fullchain.pem;
              ssl_certificate_key /etc/letsencrypt/live/api.domain.net/privkey.pem;
              client_max_body_size 2000M;
              large_client_header_buffers 32 128k;
              location / {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://api-app;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "";
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;
              }
        }