使用nginx反向代理来自frp内网穿透的https网站

转载自桂圆 TECH.

直接使用nginx反代frp的https时会出现网页无法访问，查看nginx的错误日志 error.log可见类似错误：

2018/04/26 20:20:11 [warn] 1326#0: *5369 upstream server temporarily disabled while connecting to upstream, client: ***, server: cloud.cmdgy.com, request: "GET / HTTP/1.1", upstream: "https://***", host: "manuscript.from.cmdgy.com"

2018/04/26 20:20:11 [error] 1326#0: *5369 SSL_do_handshake() failed (SSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure) while SSL handshaking to upstream, client: ***, server: manuscript.from.cmdgy.com, request: "GET / HTTP/1.1", upstream: "https://***:443/", host: "abc.cmdgy.com"

其中SSLV3错误即使单纯手动指定proxy_ssl_protocols也无法避免。

采用以下nginx配置文件可解决该问题：

vhost配置文件如下

server{

listen 443;

ssl on;

#需按情况修改为真实证书路径

ssl_certificate /path/to/your/cert/fullchain.pem;

ssl_certificate_key /path/to/your/cert/privkey.pem;

ssl_session_cache builtin:1000 shared:SSL:10m;

ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

ssl_prefer_server_ciphers on;

server_name cloud.cmdgy.com;

location / {

proxy_pass https://path.cmdgy.com:8444; #frp代理地址和端口，需与frp配置文件中域名相同

proxy_ssl_server_name on;

proxy_ssl_session_reuse off;

proxy_set_header Host $http_host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Fprwarded-Proto $scheme;

proxy_ssl_verify off;

proxy_redirect http:// $scheme://;

proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

}

}