NGINX：使用1個域名為多個端口設置SSL證書

Question

我已經建立了一個使用Rest API來獲取其所有數據的網站。 我的網站已通過SSL證書保護。 我的默認文件（ etc/nginx/sites-enabled/default ）如下所示：

server {
    listen 80;
    server_name example.com;
    rewrite ^/(.*) https://example.com/$1 permanent;
}

server {
    listen 443 ssl;
    listen [::]:80 default_server;

    root /var/www/example;

    index index.html;

    server_name example.com;
    ssl_certificate /root/example.com.crt;
    ssl_certificate_key /root/example.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
            try_files $uri $uri/ =404;
    }
}

問題是我的Rest API（我從中獲取所有數據）必須具有SSL證書，才能將所有數據安全地傳輸到我的網站。

我在默認文件（ etc/nginx/sites-enabled/default ）中為其余api創建了另一個服務器塊。 看起來像這樣：

server {
    listen 8877;
    server_name example.com;
    rewrite ^/(.*) https://example.com:8877/$1 permanent;
}

server {
    listen 443 ssl;
    listen [::]:8877 default_server;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;

    server_name example.com;
    ssl_certificate /root/example.com.crt;
    ssl_certificate_key /root/example.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
            proxy_pass http://example.com:1111;
    }
 }

我知道我應該這樣合並它們：

server {
    listen 80ssl;
    listen 8877 ssl;

    index index.html index.htm index.nginx-debian.html;

    server_name example.com;
    ssl_certificate /root/example.com.crt;
    ssl_certificate_key /root/example.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
        // DO SOMETHING
    }
}

問題是我需要位置塊在端口80和端口8877上均具有不同的功能。在端口8877上，位置塊應指向在backround proxy_pass http://example.com:1111;運行的NodeJS項目proxy_pass http://example.com:1111; 。 在端口80上，它不應指向我的NodeJS項目。 我該怎么做？

還是有更好的方法來做到這一點？ 我已經被這個問題困擾了2天了。 無法購買第二個域或SSL證書+我的證書支持單個域上的多個端口。

Answer 1

這是我會做的/嘗試的：

（如果不需要，請考慮關閉TLS 1.0）

# General HTTP to HTTPS
server {
        listen 80;
        listen [::]:80;
        server_name example.com default_server;

        location / {
                return 302 https://$host$request_uri;
        }
}

server {
    listen 443 ssl;
    server_name example.com default_server;

    root /var/www/example;
    index index.html;

    ssl_certificate /root/example.com.crt;
    ssl_certificate_key /root/example.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
            try_files $uri $uri/ =404;
    }
}

server {
    listen 8877 ssl;
    listen [::]:8877 ssl;
    server_name example.com;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;

    ssl_certificate /root/example.com.crt;
    ssl_certificate_key /root/example.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
            proxy_pass http://example.com:1111;
    }
 }