\n# \u5176\u4ed6\u539f\u6709\u53c2\u6570<\/span>
\nmake<\/span> &&<\/span> make<\/span> install<\/span><\/p>\n
\u7f16\u8bd1\u540e\u53ef\u901a\u8fc7 nginx -V 2>&1 | grep stream_ssl_preread\u9a8c\u8bc1\u6a21\u5757\u662f\u5426\u5df2\u5305\u542b<\/p>\n
[root@nginx01 ~]# \/usr\/local\/nginx\/sbin\/nginx -V 2>&1 | grep stream_ssl_preread
\nconfigure arguments: –prefix=\/usr\/local\/nginx –group=nginx –user=nginx –sbin-path=\/usr\/local\/nginx\/sbin\/nginx –conf-path=\/etc\/nginx\/nginx.conf –error-log-path=\/var\/log\/nginx\/error.log –http-log-path=\/var\/log\/nginx\/access.log –http-client-body-temp-path=\/tmp\/nginx\/client_body –http-proxy-temp-path=\/tmp\/nginx\/proxy –http-fastcgi-temp-path=\/tmp\/nginx\/fastcgi –pid-path=\/var\/run\/nginx.pid –lock-path=\/var\/lock\/nginx –with-compat –with-file-aio –with-threads –with-http_addition_module –with-http_auth_request_module –with-http_dav_module –with-http_flv_module –with-http_gunzip_module –with-http_gzip_static_module –with-http_mp4_module –with-http_random_index_module –with-http_realip_module –with-http_secure_link_module –with-http_slice_module –with-http_ssl_module –with-http_stub_status_module –with-http_sub_module –with-http_v2_module –with-mail –with-mail_ssl_module –with-stream –with-stream_realip_module –with-stream_ssl_module –with-stream_ssl_preread_module –with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong –param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' –with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'<\/p>\n
\u6838\u5fc3\u6307\u4ee4\u4e0e\u53d8\u91cf<\/h4>\n
\u6307\u4ee4：<\/p>\n
- \n
- \n
ssl_preread on | off;<\/p>\n
\u5728 stream { server { … } }\u4e0a\u4e0b\u6587\u4e2d\u4f7f\u7528，\u5f00\u542f\u540e Nginx \u4f1a\u5728\u6536\u5230 ClientHello \u540e\u63d0\u53d6 SNI\u3001ALPN \u7b49\u4fe1\u606f\u3002<\/p>\n<\/li>\n<\/ul>\n
\u5185\u7f6e\u53d8\u91cf：<\/p>\n
\n
\u53d8\u91cf\u540d\u542b\u4e49\u5f15\u5165\u7248\u672c<\/tr>\n \n\n $ssl_preread_server_name<\/td>\n \u4ece SNI \u6269\u5c55\u4e2d\u63d0\u53d6\u7684\u670d\u52a1\u5668\u57df\u540d（\u7a7a\u4e32\u8868\u793a\u672a\u63d0\u4f9b）<\/td>\n 1.11.5<\/td>\n<\/tr>\n \n $ssl_preread_alpn_protocols<\/td>\n \u5ba2\u6237\u7aef\u5728 ALPN \u6269\u5c55\u4e2d\u58f0\u660e\u7684\u3001\u9017\u53f7\u5206\u9694\u7684\u534f\u8bae\u5217\u8868（\u5982 h2,http\/1.1）<\/td>\n 1.13.10<\/td>\n<\/tr>\n \n $ssl_preread_protocol<\/td>\n \u5ba2\u6237\u7aef\u652f\u6301\u7684\u6700\u9ad8 TLS\/SSL \u7248\u672c（\u5982 TLSv1.3；\u7a7a\u4e32\u8868\u793a\u65e0 SSL \u63e1\u624b\u4fe1\u606f）<\/td>\n 1.15.2<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u4e3a\u7f16\u8bd1\u5b89\u88c5\u7684 Nginx \u914d\u7f6e\u56db\u5c42\u8d1f\u8f7d\u5747\u8861，\u53ef\u4ee5\u901a\u8fc7\u5b50\u914d\u7f6e\u6587\u4ef6\u7684\u65b9\u5f0f\u5b9e\u73b0\u6a21\u5757\u5316\u7ba1\u7406\u3002\u4ee5\u4e0b\u662f\u5b8c\u6574\u914d\u7f6e\u65b9\u6848：\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7include\u6307\u4ee4\u5f15\u5165\u5b50\u914d\u7f6e\u6587\u4ef6\u3002\u521b\u5efa\u5b50\u914d\u7f6e\u6587\u4ef6，\u4f8b\u5982\u5728\/usr\/local\/nginx\/stream\/conf.d\/stream.conf，\u5e76\u5728\u8be5\u6587\u4ef6\u4e2d\u914d\u7f6e\u56db\u5c42\u8d1f\u8f7d\u5747\u8861\u3002\u5177\u4f53\u914d\u7f6e\u793a\u4f8b：\u4e3b\u914d\u7f6e\u6587\u4ef6（nginx.conf）\u4e2d，\u5728http\u914d\u7f6e\u5757\u4e4b\u5916，\u6dfb\u52a0stream\u914d\u7f6e\u5757\u7684\u5f15\u5165：\u6ce8\u610f：stream\u914d\u7f6e\u5757\u548chttp\u914d\u7f6e\u5757\u662f\u5e73\u7ea7\u7684<\/p>\n
[<\/span>root@nginx01 ~]<\/span># mkdir -p \/usr\/local\/nginx\/stream\/conf.d\/ #\u7528\u4e8e\u5b58\u653e\u56db\u5c42\u8d1f\u8f7d\u5747\u8861\u7684\u5b50\u914d\u7f6e\u6587\u4ef6\u76ee\u5f55<\/span><\/p>\n
\u7f16\u8f91\u4e3b\u914d\u7f6e\u6587\u4ef6 nginx.conf，\u5728 http\u5757\u540c\u7ea7\u6dfb\u52a0 stream\u914d\u7f6e：<\/p>\n
\u4ee3\u7406nginx-172.16.229.44
\n[<\/span>root@nginx01 ~]<\/span># vim \/etc\/nginx\/nginx.conf<\/span>
\nuser nginx;<\/span>
\nworker_processes auto;<\/span>
\nevents {<\/span>
\n worker_connections 1024<\/span>;<\/span>
\n}<\/span><\/p>\n# HTTP \u5c42\u914d\u7f6e<\/span>
\nhttp {<\/span>
\n include mime.types;<\/span>
\n default_type application\/octet-stream;<\/span>
\n # … \u5176\u4ed6 http \u914d\u7f6e<\/span>
\n}<\/span>
\n# Stream \u5c42\u914d\u7f6e（\u56db\u5c42\u8d1f\u8f7d\u5747\u8861）<\/span>
\nstream {<\/span>
\n # \u5305\u542b\u6240\u6709\u542f\u7528\u7684\u5b50\u914d\u7f6e<\/span>
\n include \/usr\/local\/nginx\/stream\/conf.d\/*.conf;<\/span><\/p>\n# \u65e5\u5fd7\u683c\u5f0f<\/span>
\n log_format basic '$remote_addr [$time_local] '<\/span>
\n '$protocol $status $bytes_sent $bytes_received '<\/span>
\n '$session_time "$ssl_preread_server_name"'<\/span>;<\/span><\/p>\naccess_log logs\/stream_access.log basic;<\/span>
\n error_log logs\/stream_error.log;<\/span><\/p>\n#\u6027\u80fd\u4f18\u5316\u5efa\u8bae<\/span>
\n # \u542f\u7528\u7aef\u53e3\u590d\u7528（Linux 3.9+）\u5982\u679c\u9700\u8981<\/span>
\n listen 443<\/span> reuseport;<\/span><\/p>\n# \u8c03\u6574\u9884\u8bfb\u7f13\u51b2\u533a\u5927\u5c0f<\/span>
\n preread_buffer_size 32k;<\/span>
\n preread_timeout 30s;<\/span><\/p>\n# \u8fde\u63a5\u4f18\u5316<\/span>
\n proxy_connect_timeout 5s;<\/span>
\n proxy_timeout 60s;<\/span><\/p>\n}<\/span><\/p>\n
#\u521b\u5efa\u5b58\u653e\u56db\u5c42\u8d1f\u8f7d\u5747\u8861\u7684\u65e5\u5fd7\u76ee\u5f55<\/span>
\n[<\/span>root@nginx01 ~]<\/span># mkdir \/usr\/local\/nginx\/logs <\/span><\/p>\n[<\/span>root@nginx01 ~]<\/span># \/usr\/local\/nginx\/sbin\/nginx -t <\/span>
\nnginx: the configuration file<\/span> \/etc\/nginx\/nginx.conf syntax is ok
\nnginx: configuration file<\/span> \/etc\/nginx\/nginx.conf test<\/span> is successful
\n[<\/span>root@nginx01 ~]<\/span># \/usr\/local\/nginx\/sbin\/nginx -s reload <\/span><\/p>\n\u914d\u7f6e\u793a\u4f8b<\/h4>\n
1.\u57fa\u4e8e SNI \u7684\u5206\u6d41<\/h5>\n
\u5c06\u4e0d\u540c\u57df\u540d\u7684\u8bf7\u6c42\u8def\u7531\u5230\u4e0d\u540c\u7684\u4e0a\u6e38\u670d\u52a1\u5668：<\/p>\n
\u57fa\u4e8e TLS SNI (Server Name Indication) \u7684\u56db\u5c42 TCP\/UDP \u4ee3\u7406\u914d\u7f6e，\u7528\u4e8e \u900f\u660e\u5730\u8f6c\u53d1 HTTPS \u6d41\u91cf，\u800c\u65e0\u9700\u89e3\u5bc6\u5176\u5185\u5bb9\u3002\u5b83\u5229\u7528\u4e86 Nginx \u7684 stream\u6a21\u5757（\u5e38\u7528\u4e8e\u4ee3\u7406 TCP\/UDP \u6d41\u91cf）\u548c ssl_preread\u6307\u4ee4\u3002<\/p>\n
\u8be5\u914d\u7f6e\u7684\u6838\u5fc3\u662f：\u6839\u636e\u5ba2\u6237\u7aef TLS \u63e1\u624b\u65f6\u53d1\u51fa\u7684 SNI \u4e3b\u673a\u540d，\u5c06\u52a0\u5bc6\u7684 HTTPS \u6d41\u91cf\u8f6c\u53d1\u5230\u4e0d\u540c\u7684\u540e\u7aef\u670d\u52a1\u5668\u3002<\/p>\n
1.\u914d\u7f6e\u7ed3\u6784 (map\u5757)：<\/h6>\n
map $ssl_preread_server_name $backend {
\n www.test1.com backend1;
\n www.test2.com backend2;
\n default backend_default;
\n}<\/p>\n- \n
- \u76ee\u7684：\u5efa\u7acb\u4e00\u4e2a\u6620\u5c04\u8868\u3002<\/li>\n
- \u53d8\u91cf：$ssl_preread_server_name\u662f ssl_preread\u6a21\u5757\u63d0\u53d6\u51fa\u7684 SNI \u4e3b\u673a\u540d\u3002<\/li>\n
- \u903b\u8f91：\u68c0\u67e5 SNI \u503c\u3002\u5982\u679c\u662f www.test1.com，\u5219\u5c06\u53d8\u91cf $backend\u7684\u503c\u8bbe\u7f6e\u4e3a backend1；\u5982\u679c\u662f www.test2.com，\u5219\u8bbe\u7f6e\u4e3a backend2；\u5176\u4ed6\u6240\u6709\u60c5\u51b5（\u5373 SNI \u4e0d\u5339\u914d\u6216\u4e3a\u7a7a），\u5219\u8bbe\u7f6e\u4e3a backend_default\u3002<\/li>\n<\/ul>\n
2.\u4e0a\u6e38\u5b9a\u4e49 (upstream\u5757)：<\/h6>\n
upstream backend1 { server www.test1.com:443; }
\nupstream backend2 { server www.test2.com:443; }
\nupstream backend_default { server 10.0.0.3:443; }<\/p>\n- \n
- \u5b9a\u4e49\u4e86\u4e09\u4e2a\u4e0a\u6e38\u670d\u52a1\u5668\u7ec4\u3002\u5f53\u6d41\u91cf\u9700\u8981\u88ab\u8f6c\u53d1\u65f6，Nginx \u4f1a\u8fde\u63a5\u5230\u8fd9\u91cc\u5b9a\u4e49\u7684\u5730\u5740\u3002<\/li>\n
- backend1\u548c backend2\u76f4\u63a5\u4ee3\u7406\u5230\u4e86\u4e92\u8054\u7f51\u4e0a\u7684\u771f\u5b9e\u670d\u52a1\u3002<\/li>\n
- backend_default\u662f\u4e00\u4e2a\u9ed8\u8ba4\u7684\u6216\u5185\u90e8\u7684\u540e\u7aef，\u4f8b\u5982\u4e00\u4e2a\u9ed8\u8ba4\u7684\u7f51\u7ad9\u3001\u4e00\u4e2a\u9519\u8bef\u9875\u9762\u670d\u52a1\u5668，\u6216\u8005\u4e00\u4e2a\u7528\u4e8e\u5904\u7406\u7684\u4e2d\u95f4\u670d\u52a1（\u5982 WAF）\u3002<\/li>\n<\/ul>\n
3.\u670d\u52a1\u5668\u5757 (server\u5757)：<\/h6>\n
server {
\n listen 443;
\n proxy_pass $backend;
\n ssl_preread on;
\n}<\/p>\n- \n
- listen 443;：\u5728 TCP 443 \u7aef\u53e3\u4e0a\u76d1\u542c（\u8fd9\u662f HTTPS \u7684\u6807\u51c6\u7aef\u53e3）\u3002<\/li>\n
- ssl_preread on;：\u5173\u952e\u6307\u4ee4\u3002\u5b83\u542f\u7528\u4e86\u4e00\u4e2a\u201c\u9884\u8bfb\u201d\u673a\u5236\u3002Nginx \u4f1a\u5728\u4e0d\u8fdb\u884c TLS \u89e3\u5bc6\u7684\u60c5\u51b5\u4e0b，\u4ece\u5ba2\u6237\u7aef\u53d1\u6765\u7684\u7b2c\u4e00\u4e2a\u6570\u636e\u5305（Client Hello）\u4e2d\u63d0\u53d6 SNI \u4fe1\u606f\u3002\u8fd9\u4e2a\u8fc7\u7a0b\u4e0d\u4f1a\u7834\u574f TLS \u7684\u52a0\u5bc6\u6027\u3002<\/li>\n
- proxy_pass $backend;：\u5c06\u63a5\u6536\u5230\u7684\u6240\u6709\u6d41\u91cf\u8f6c\u53d1\u5230 $backend\u53d8\u91cf\u6240\u6307\u5411\u7684\u4e0a\u6e38\u670d\u52a1\u5668\u7ec4\u3002\u8fd9\u4e2a\u53d8\u91cf\u7684\u503c\u7531\u7b2c\u4e00\u6b65\u7684 map\u89c4\u5219\u6839\u636e SNI \u51b3\u5b9a\u3002<\/li>\n<\/ul>\n
\u5de5\u4f5c\u539f\u7406\u4e0e\u6570\u636e\u6d41<\/h5>\n
- \u5ba2\u6237\u7aef\u8fde\u63a5：\u4e00\u4e2a\u5ba2\u6237\u7aef（\u5982\u6d4f\u89c8\u5668）\u5c1d\u8bd5\u8fde\u63a5\u5230 www.test1.com\u7684 443 \u7aef\u53e3\u3002<\/li>\n
- \u53d1\u9001 Client Hello：\u5ba2\u6237\u7aef\u53d1\u8d77 TLS \u63e1\u624b，\u5728 Client Hello\u6d88\u606f\u4e2d\u643a\u5e26 SNI \u5b57\u6bb5，\u660e\u6587\u6307\u51fa\u5b83\u60f3\u8981\u8fde\u63a5\u7684\u4e3b\u673a\u540d\u662f www.test1.com\u3002<\/li>\n
- Nginx \u9884\u8bfb SNI：Nginx \u5728 stream\u5c42（\u56db\u5c42）\u63a5\u6536\u5230\u8fd9\u4e2a TCP \u6570\u636e\u5305\u3002ssl_preread on;\u6307\u4ee4\u4f7f\u5176\u80fd\u591f\u89e3\u6790 Client Hello\u5e76\u63d0\u53d6\u51fa www.test1.com\u3002<\/li>\n
- \u6620\u5c04\u51b3\u7b56：\u63d0\u53d6\u51fa\u7684 SNI (www.test1.com) \u88ab\u8d4b\u503c\u7ed9\u53d8\u91cf $ssl_preread_server_name\u3002map\u89c4\u5219\u6839\u636e\u8fd9\u4e2a\u503c\u8fdb\u884c\u5339\u914d，\u51b3\u5b9a $backend\u7684\u503c\u4e3a backend1\u3002<\/li>\n
- \u900f\u660e\u8f6c\u53d1：proxy_pass $backend;\u5c06\u6574\u4e2a TCP \u6d41（\u5305\u542b\u540e\u7eed\u52a0\u5bc6\u7684 TLS \u5e94\u7528\u6570\u636e）\u8f6c\u53d1\u7ed9 upstream backend1\u4e2d\u5b9a\u4e49\u7684\u670d\u52a1\u5668 www.test1.com:443\u3002<\/li>\n
- \u5b8c\u6210\u8fde\u63a5：\u5ba2\u6237\u7aef\u4e0e\u771f\u6b63\u7684 www.test1.com\u670d\u52a1\u5668\u5b8c\u6210\u540e\u7eed\u7684 TLS \u63e1\u624b\u548c\u52a0\u5bc6\u901a\u4fe1，\u800c Nginx \u5728\u6574\u4e2a\u8fc7\u7a0b\u4e2d\u53ea\u662f\u4f5c\u4e3a\u900f\u660e\u7684\u201c\u7ba1\u9053\u201d，\u65e0\u6cd5\u770b\u5230\u89e3\u5bc6\u540e\u7684 HTTP \u5185\u5bb9\u3002<\/li>\n
\u914d\u7f6e\u7528\u9014\u4e0e\u573a\u666f<\/h5>\n
- \n
- SSL \u5378\u8f7d\u7f51\u5173\/\u53cd\u5411\u4ee3\u7406：\u53ef\u4ee5\u4f5c\u4e3a\u591a\u4e2a\u540e\u7aef HTTPS \u670d\u52a1\u7684\u7edf\u4e00\u5165\u53e3，\u6839\u636e\u57df\u540d\u5c06\u8bf7\u6c42\u5206\u53d1\u5230\u4e0d\u540c\u7684\u670d\u52a1\u5668，\u800c\u65e0\u9700\u5728\u6bcf\u4e2a\u540e\u7aef\u670d\u52a1\u5668\u4e0a\u914d\u7f6e SSL \u8bc1\u4e66\u3002<\/li>\n
- \u96a7\u9053\u6216\u900f\u660e\u4ee3\u7406：\u5e38\u7528\u4e8e\u9700\u8981\u6839\u636e\u57df\u540d\u8def\u7531\u52a0\u5bc6\u6d41\u91cf\u7684\u573a\u666f，\u5982\u5728\u4f01\u4e1a\u5185\u90e8\u7f51\u7edc\u4e2d，\u5c06\u7279\u5b9a\u57df\u540d\u7684\u6d41\u91cf\u5f15\u5bfc\u81f3\u5b89\u5168\u5ba1\u67e5\u8bbe\u5907\u6216\u4ee3\u7406\u670d\u52a1\u5668\u3002<\/li>\n
- \u8d1f\u8f7d\u5747\u8861\u7684\u524d\u7f6e\u8def\u7531：\u53ef\u4ee5\u5148\u6839\u636e SNI \u8fdb\u884c\u7c97\u7565\u8def\u7531，\u518d\u5728\u6bcf\u4e2a upstream\u5757\u5185\u5b9a\u4e49\u591a\u4e2a server\u5b9e\u73b0\u66f4\u7ec6\u7c92\u5ea6\u7684\u8d1f\u8f7d\u5747\u8861\u3002<\/li>\n<\/ul>\n
\u91cd\u8981\u7279\u6027<\/h5>\n
- \n
- \u5de5\u4f5c\u5728\u56db\u5c42 (Transport Layer)：\u8fd9\u662f\u5728 TCP \u5c42\u9762\u8fdb\u884c\u7684\u4ee3\u7406，\u4e0d\u6d89\u53ca\u4e03\u5c42（HTTP）\u534f\u8bae\u3002<\/li>\n
- \u4e0d\u89e3\u5bc6 TLS：ssl_preread\u53ea\u8bfb\u53d6\u63e1\u624b\u521d\u671f\u7684\u660e\u6587\u90e8\u5206，\u5168\u7a0b\u4e0d\u89e3\u5bc6\u5e94\u7528\u5c42\u6570\u636e，\u56e0\u6b64\u65e0\u9700\u914d\u7f6e SSL \u8bc1\u4e66\u548c\u79c1\u94a5\u3002<\/li>\n<\/ul>\n
\u5b8c\u6574\u914d\u7f6e<\/h5>\n
[<\/span>root@nginx01 ~]<\/span># cd \/usr\/local\/nginx\/stream\/conf.d\/<\/span>
\n[<\/span>root@nginx01 conf.d]<\/span># vim server_proxy.conf<\/span>
\n#SNI \u5230\u540e\u7aef\u6620\u5c04<\/span>
\nmap $ssl_preread_server_name<\/span> $backend<\/span> {<\/span>
\n www.test1.com backend1;<\/span>
\n www.test1.com backend2;<\/span>
\n default backend_default;<\/span>
\n }<\/span><\/p>\nupstream backend1 {<\/span> server www.test1.com:443;<\/span> }<\/span>
\n upstream backend2 {<\/span> server www.test2.com:443;<\/span> }<\/span>
\n upstream backend_default {<\/span> server 10.0<\/span>.0.3:443;<\/span> }<\/span><\/p>\nserver {<\/span>
\n listen 443<\/span>;<\/span>
\n proxy_pass $backend<\/span>;<\/span>
\n ssl_preread on;<\/span>
\n }<\/span><\/p>\n[<\/span>root@nginx01 ~]<\/span># \/usr\/local\/nginx\/sbin\/nginx -s reload<\/span><\/p>\n
\u5ba2\u6237\u7aef\u9a8c\u8bc1
\n[<\/span>root@web01 ~]<\/span># curl -v –resolve www.test1.com:443:172.16.229.44 https:\/\/www.baidu.com<\/span>
\n[<\/span>root@web01 ~]<\/span># curl -v –resolve www.test2.com:443:172.16.229.44 https:\/\/www.jd.com\/<\/span><\/p>\n2. \u57fa\u4e8e ALPN \u534f\u8bae\u7684\u5206\u6d41<\/p>\n
\u6839\u636e\u5ba2\u6237\u7aef\u58f0\u660e\u7684\u5e94\u7528\u5c42\u534f\u8bae（\u5982 HTTP\/2\u3001HTTP\/1.1）\u8fdb\u884c\u8def\u7531：<\/p>\n
stream {
\n map $ssl_preread_alpn_protocols $proxy {
\n ~\\\\bh2\\\\b 127.0.0.1:8001; # HTTP\/2
\n ~\\\\bhttp\/1.1\\\\b 127.0.0.1:8002; # HTTP\/1.1
\n ~\\\\bxmpp-client\\\\b 127.0.0.1:8003; # XMPP
\n }<\/p>\nserver {
\n listen 9000;
\n proxy_pass $proxy;
\n ssl_preread on;
\n }
\n}<\/p>\n3. \u5355\u7aef\u53e3\u540c\u65f6\u652f\u6301 HTTP \u4e0e HTTPS<\/p>\n
\u901a\u8fc7\u68c0\u6d4b\u662f\u5426\u5305\u542b SSL \u63e1\u624b\u4fe1\u606f，\u5c06\u6d41\u91cf\u5206\u522b\u5bfc\u5411 HTTP \u6216 HTTPS \u540e\u7aef：<\/p>\n
map\u5757：
\nmap $ssl_preread_protocol<\/span> $back<\/span> {<\/span>
\n ""<\/span> http_backend;<\/span>
\n default https_backend;<\/span>
\n}<\/span>
\n\u8fd9\u91cc\u5b9a\u4e49\u4e86\u4e00\u4e2a\u6620\u5c04，\u6839\u636e\u53d8\u91cf$ssl_preread_protocol<\/span>\u7684\u503c\u6765\u51b3\u5b9a$back<\/span>\u53d8\u91cf\u7684\u503c\u3002
\n$ssl_preread_protocol<\/span>\u662fssl_preread\u6a21\u5757\u63d0\u4f9b\u7684\u53d8\u91cf，\u7528\u4e8e\u83b7\u53d6\u5ba2\u6237\u7aefTLS\u63e1\u624b\u4e2dClientHello\u6d88\u606f\u7684\u534f\u8bae\u7248\u672c（\u5982TLSv1.2\u3001TLSv1.3\u7b49）\u3002
\n\u5982\u679c$ssl_preread_protocol<\/span>\u7684\u503c\u4e3a\u7a7a（\u5373\u975eTLS\u6d41\u91cf），\u5219$back<\/span>\u7684\u503c\u4e3ahttp_backend\u3002
\n\u5982\u679c$ssl_preread_protocol<\/span>\u7684\u503c\u975e\u7a7a（\u5373TLS\u6d41\u91cf），\u5219$back<\/span>\u7684\u503c\u4e3ahttps_backend\u3002<\/p>\nupstream\u5757：
\nupstream http_backend {<\/span> server www.testpm.cn:80;<\/span> }<\/span>
\nupstream https_backend {<\/span> server www.test1.com:443;<\/span> }<\/span>
\n\u5b9a\u4e49\u4e86\u4e24\u4e2a\u4e0a\u6e38\u670d\u52a1\u5668\u7ec4\u3002
\nhttp_backend：\u6307\u5411\u4e00\u4e2aHTTP\u670d\u52a1\u5668（www.testpm.cn\u768480\u7aef\u53e3）\u3002
\nhttps_backend：\u6307\u5411\u4e00\u4e2aHTTPS\u670d\u52a1\u5668（www.test1.com\u7684443\u7aef\u53e3）\u3002<\/p>\nserver\u5757：
\nserver {<\/span>
\n listen 8081<\/span>;<\/span>
\n proxy_pass $back<\/span>;<\/span>
\n ssl_preread on;<\/span>
\n}<\/span>
\n\u76d1\u542c8081\u7aef\u53e3\u3002
\nssl_preread on;<\/span>：\u542f\u7528ssl_preread\u529f\u80fd，\u5141\u8bb8Nginx\u5728\u8f6c\u53d1\u4e4b\u524d\u8bfb\u53d6TLS\u63e1\u624b\u7684\u521d\u59cb\u4fe1\u606f（\u5982\u534f\u8bae\u7248\u672c\u3001SNI\u7b49），\u800c\u4e0d\u8fdb\u884c\u89e3\u5bc6\u3002
\nproxy_pass $back<\/span>;<\/span>：\u5c06\u6d41\u91cf\u8f6c\u53d1\u5230\u7531$back<\/span>\u53d8\u91cf\u6307\u5b9a\u7684\u4e0a\u6e38\u670d\u52a1\u5668\u7ec4\u3002<\/p>\n\u5b8c\u6574\u914d\u7f6e<\/p>\n
[<\/span>root@nginx01 ~]<\/span># cd \/usr\/local\/nginx\/stream\/conf.d\/<\/span>
\n[<\/span>root@nginx01 conf.d]<\/span># vim server_proxy.conf<\/span>
\n map $ssl_preread_protocol<\/span> $back<\/span> {<\/span>
\n ""<\/span> http_backend;<\/span>
\n default https_backend;<\/span>
\n }<\/span><\/p>\nupstream http_backend {<\/span> server www.testpm.cn:80;<\/span> }<\/span>
\n upstream https_backend {<\/span> server www.test1.com:443;<\/span> }<\/span><\/p>\nserver {<\/span>
\n listen 8081<\/span>;<\/span>
\n proxy_pass $back<\/span>;<\/span>
\n ssl_preread on;<\/span>
\n }<\/span>
\n[<\/span>root@nginx01 ~]<\/span># vi \/etc\/hosts<\/span>
\n172.16<\/span>.229.47 www.testpm.cn #\u505a\u672c\u5730\u89e3\u6790\u57df\u540d\u5230\u6d4b\u8bd5\u865a\u62df\u673aip<\/span><\/p>\n\u5ba2\u6237\u7aef\u9a8c\u8bc1
\n[<\/span>root@web01 ~]<\/span># curl -vl http:\/\/172.16.229.44:8081<\/span>
\n[<\/span>root@web01 ~]<\/span># curl -vlk https:\/\/172.16.229.44:8081<\/span><\/p>\n![\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260726095705-6a65d9f1591c8.png\")
\n\u573a\u666f4：TCP\/UDP \u6df7\u5408\u534f\u8bae\u5206\u6d41<\/p>\nstream {<\/span>
\n map $ssl_preread_protocol<\/span> $upstream<\/span> {<\/span>
\n ""<\/span> tcp_backend;<\/span> # \u975e SSL \u6d41\u91cf<\/span>
\n "TLSv1.2"<\/span> tls_backend;<\/span> # TLS 1.2 \u6d41\u91cf<\/span>
\n "TLSv1.3"<\/span> tls_backend;<\/span> # TLS 1.3 \u6d41\u91cf<\/span>
\n default default_backend;<\/span>
\n }<\/span><\/p>\nupstream tcp_backend {<\/span> server 10.0<\/span>.1.1:22;<\/span> }<\/span> # SSH<\/span>
\n upstream tls_backend {<\/span> server 10.0<\/span>.1.2:443;<\/span> }<\/span> # HTTPS<\/span>
\n upstream default_backend {<\/span> server 10.0<\/span>.1.3:8080;<\/span> }<\/span><\/p>\nserver {<\/span>
\n listen 8443<\/span>;<\/span>
\n proxy_pass $upstream<\/span>;<\/span>
\n ssl_preread on;<\/span>
\n }<\/span>
\n}<\/span><\/p>\n- \u7070\u5ea6\u53d1\u5e03\/\u91d1\u4e1d\u96c0\u53d1\u5e03<\/li>\n
stream {<\/span>
\n # \u6309\u57df\u540d\u6743\u91cd\u5206\u6d41<\/span>
\n split_clients "${ssl_preread_server_name}<\/span> - \u7070\u5ea6\u53d1\u5e03\/\u91d1\u4e1d\u96c0\u53d1\u5e03<\/li>\n