Nginx `proxy_ssl_trusted_certificate` 与 LetsEncrypt 上游

Question

我正在尝试使用proxy_passnginx 来加密与上游服务器的连接。上游服务器的证书已由 LetsEncrypt certbot 创建。

# upstream server: nginx.conf

stream {
  server {
    listen 636 ssl;

    ssl_certificate /etc/letsencrypt/live/upstream.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/upstream.example.com/privkey.pem; # managed by Certbot

    # ...
  }
}

当不在下游服务器中验证代理证书时，一切正常。

# downstream server: nginx.conf

stream {
  server {
    listen 636 ssl;

    ssl_certificate /etc/letsencrypt/live/downstream.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/downstream.example.com/privkey.pem; # managed by Certbot

    proxy_ssl on;
    proxy_ssl_verify off;

    proxy_pass upstream.example.com:636;

    # ...

  }
}

但是，如果我尝试验证下游服务器上的上游证书，则在 nginx 错误日志中与上游进行 SSL 握手时，会收到上游 SSL 证书验证错误：(2:无法获取颁发者证书) 。

# downstream server: nginx.conf

stream {
  server {
    listen 636 ssl;

    ssl_certificate /etc/letsencrypt/live/downstream.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/downstream.example.com/privkey.pem; # managed by Certbot

    proxy_ssl on;
    proxy_ssl_verify on;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream.example.com/chain.pem;
    proxy_ssl_verify_depth 2;

    proxy_pass upstream.example.com:636;

    # ...

  }
}

如果我尝试连接的上游服务器具有 LetsEncrypt 证书，我需要proxy_ssl_trusted_certificate哪些设置？proxy_ssl_verify_depth

我proxy_ssl_verify_depth从 0 到 5 不等，并且使用了上游服务器的fullchain.pem、chain.pem和cert.pemfor proxy_ssl_trusted_certificate，但每个都不成功。

附加信息

验证CA证书是否openssl有效：

# openssl verify -verify_depth 2 chain.pem
chain.pem: OK

fullchain.pem根据 CA 证书验证来自上游服务器的证书是否有效：

# openssl verify -CAfile chain.pem fullchain.pem
fullchain.pem: OK

进一步参考

• https://docs.nginx.com/nginx/admin-guide/security-controls/secure-http-traffic-upstream/
• https://nginx.org/en/docs/http/ngx_http_proxy_module.html

Answer 1

proxy_ssl_trusted_certificateLetsEncrypt 或上游服务器未提供所需的 CA 证书。它已经安装在下游服务器上。

在 Ubuntu 上，CA 证书的位置是/etc/ssl/certs/ca-certificates.crt。

# downstream server: nginx.conf

stream {
  server {
    listen 636 ssl;

    ssl_certificate /etc/letsencrypt/live/downstream.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/downstream.example.com/privkey.pem; # managed by Certbot

    proxy_ssl on;
    proxy_ssl_verify on;
    proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

    proxy_pass upstream.example.com:636;

    # ...

  }
}

文档

https://nginx.org/en/docs/http/ngx_http_proxy_module.html

proxy_ssl_verify 上 | 离开;

启用或禁用代理 HTTPS 服务器证书的验证。

proxy_ssl_verify_depth 数字；

设置代理 HTTPS 服务器证书链中的验证深度。

proxy_ssl_trusted_certificate 文件；

指定具有 PE​​M 格式的可信 CA 证书的文件，用于验证代理 HTTPS 服务器的证书。

也可以看看

• https://unix.stackexchange.com/a/484938/91720
• https://serverfault.com/a/1052976/167331