如何阻止nginx pass-through从上游解析到IP

Question

我是nginx反向代理配置的新手。我们需要设置一个代理服务器，将请求路由到需要IP白名单的远程服务器。双向SSL也已到位。

我们一直在努力，但遇到了障碍。以下是配置：

server {
listen 80;
server_name myserver.com;
return 302 https://myserver.com;
}
server {
listen 443;
server_name myserver.com;
ssl on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 
ssl_certificate           /etc/nginx/keys/my-net.crt;
ssl_certificate_key       /etc/nginx/keys/my-net.key;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
location / {
resolver 8.8.8.8;
set $backend "https://remoteserver.com";
proxy_pass $backend;
proxy_ssl_server_name on;
proxy_ssl_trusted_certificate /home/ubuntu/myfile.pem;
proxy_ssl_session_reuse off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwared-For $proxy_add_x_forwarded_for; 
}
}

我们面临的问题是，代理服务器正在将域名解析为IP，因此SSLhandshake失败。我们需要停止此操作并点击域名，因为证书在域名上。

Error.log 中的错误

2022年3月3日14:10:02[错误]27012#27012:*8 SSL_do_handshake((失败(SSL:错误：14094410:SSL例程：ssl3_read_bytes:sslv3警报握手失败：SSL警报编号40(，同时SSL向上游握手，客户端：<gt；，服务器：<gt；，请求："；POST<gt；HTTP/1.1"；，上游："；https:<gt&"；，主机："<gt"2022/03/02 14:10:02[警报]27012#27012:*8 socket((在连接到上游时失败(97:协议不支持地址系列(，客户端：<gt；，服务器：<gt；，请求："；POST/gateway/api/txb/v1/支付/转账支付HTTP/1.1"；，上游："；https://[IPv6]:443/"；，主机："<gt">

已经尝试过这里的解决方案，但没有成功-如何阻止nginx从上游解析到ip？

Answer 1

在用proxy_set_heder设置头之后，您需要关闭proxy_pass_request_headers并侦听ssllisten 443 ssl;

server {
listen 80;
server_name myserver.com;
return 302 https://myserver.com;
}
server {
listen 443 ssl; 
server_name myserver.com;
ssl on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 
ssl_certificate           /etc/nginx/keys/my-net.crt;
ssl_certificate_key       /etc/nginx/keys/my-net.key;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
location / {
resolver 8.8.8.8;
set $backend "https://remoteserver.com";
proxy_pass $backend;
proxy_ssl_server_name on;
proxy_ssl_trusted_certificate /home/ubuntu/myfile.pem;
proxy_ssl_session_reuse off;
proxy_pass_request_headers off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwared-For $proxy_add_x_forwarded_for; 
}
}

Answer 2

试试这个：https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_server_name

proxy_ssl_server_name on;