{"id":86370,"date":"2026-07-28T14:41:39","date_gmt":"2026-07-28T06:41:39","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/86370.html"},"modified":"2026-07-28T14:41:39","modified_gmt":"2026-07-28T06:41:39","slug":"nginx-%e5%a4%9a%e5%9f%9f%e5%90%8d-https-%e9%85%8d%e7%bd%ae%ef%bc%9a%e5%8d%95%e6%9c%8d%e5%8a%a1%e5%99%a8%e5%a4%9a%e8%af%81%e4%b9%a6%e9%83%a8%e7%bd%b2%e4%bc%98%e5%8c%96","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/86370.html","title":{"rendered":"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260728064131-6a684f1ba94ac.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>&#x1f44b; \u5927\u5bb6\u597d&#xff0c;\u6b22\u8fce\u6765\u5230\u6211\u7684\u6280\u672f\u535a\u5ba2&#xff01; &#x1f4da; \u5728\u8fd9\u91cc&#xff0c;\u6211\u4f1a\u5206\u4eab\u5b66\u4e60\u7b14\u8bb0\u3001\u5b9e\u6218\u7ecf\u9a8c\u4e0e\u6280\u672f\u601d\u8003&#xff0c;\u529b\u6c42\u7528\u7b80\u5355\u7684\u65b9\u5f0f\u8bb2\u6e05\u695a\u590d\u6742\u7684\u95ee\u9898\u3002 &#x1f3af; \u672c\u6587\u5c06\u56f4\u7ed5Nginx\u8fd9\u4e2a\u8bdd\u9898\u5c55\u5f00&#xff0c;\u5e0c\u671b\u80fd\u4e3a\u4f60\u5e26\u6765\u4e00\u4e9b\u542f\u53d1\u6216\u5b9e\u7528\u7684\u53c2\u8003\u3002 &#x1f331; \u65e0\u8bba\u4f60\u662f\u521a\u5165\u95e8\u7684\u65b0\u624b&#xff0c;\u8fd8\u662f\u6b63\u5728\u8fdb\u9636\u7684\u5f00\u53d1\u8005&#xff0c;\u5e0c\u671b\u4f60\u90fd\u80fd\u6709\u6240\u6536\u83b7&#xff01;<\/p>\n<hr \/>\n<h4>\u6587\u7ae0\u76ee\u5f55<\/h4>\n<ul>\n<li>Nginx \u591a\u57df\u540d HTTPS \u914d\u7f6e&#xff1a;\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 &#x1f310;&#x1f512;<\/li>\n<li>\n<ul>\n<li>\u4e00\u3001\u4e3a\u4ec0\u4e48\u4e0d\u80fd\u53ea\u9760\u4e00\u4e2a\u6cdb\u57df\u540d\u8bc1\u4e66&#xff1f;&#x1f6ab;&#x1f310;<\/li>\n<li>\n<ul>\n<li>1. \u5b89\u5168\u8fb9\u754c\u5931\u63a7<\/li>\n<li>2. \u751f\u547d\u5468\u671f\u7ba1\u7406\u50f5\u5316<\/li>\n<li>3. \u6cd5\u5f8b\u4e0e\u54c1\u724c\u9694\u79bb\u5931\u6548<\/li>\n<\/ul>\n<\/li>\n<li>\u4e8c\u3001Nginx \u591a\u8bc1\u4e66\u6838\u5fc3\u673a\u5236\u89e3\u6790 &#x1f50d;<\/li>\n<li>\n<ul>\n<li>\u25b6\ufe0f SNI \u6620\u5c04\u5de5\u4f5c\u6d41&#xff08;Mermaid \u5e8f\u5217\u56fe&#xff09;<\/li>\n<\/ul>\n<\/li>\n<li>\u4e09\u3001\u751f\u4ea7\u7ea7\u76ee\u5f55\u7ed3\u6784\u4e0e\u6743\u9650\u8bbe\u8ba1 &#x1f4c1;&#x1f510;<\/li>\n<li>\n<ul>\n<li>\u2705 \u6743\u9650\u52a0\u56fa\u811a\u672c&#xff08;Shell&#xff09;<\/li>\n<\/ul>\n<\/li>\n<li>\u56db\u3001\u6838\u5fc3\u914d\u7f6e&#xff1a;&#096;map&#096; &#043; &#096;server&#096; \u5b8c\u6574\u8303\u4f8b &#x1f6e0;\ufe0f<\/li>\n<li>\n<ul>\n<li>1. &#096;\/etc\/nginx\/conf.d\/ssl-mapping.conf&#096;<\/li>\n<li>2. &#096;\/etc\/nginx\/conf.d\/sites-enabled\/api.example.com.conf&#096;<\/li>\n<li>3. &#096;\/etc\/nginx\/conf.d\/sites-enabled\/client-b.com.conf&#096;<\/li>\n<li>\u2705 \u9a8c\u8bc1\u914d\u7f6e\u6b63\u786e\u6027<\/li>\n<\/ul>\n<\/li>\n<li>\u4e94\u3001Java \u670d\u52a1\u7aef\u534f\u540c\u4f18\u5316&#xff1a;Spring Boot \u793a\u4f8b &#x1f9e9;\u2615<\/li>\n<li>\n<ul>\n<li>1. &#096;application.yml&#096; \u914d\u7f6e\u4fe1\u4efb\u53cd\u5411\u4ee3\u7406\u5934<\/li>\n<li>2. \u81ea\u5b9a\u4e49 &#096;WebMvcConfigurer&#096; \u5f3a\u5236 HTTPS \u91cd\u5b9a\u5411&#xff08;\u53ef\u9009&#xff09;<\/li>\n<li>3. Controller \u4e2d\u5b89\u5168\u83b7\u53d6\u539f\u59cb URL<\/li>\n<li>4. \u83b7\u53d6\u5ba2\u6237\u7aef\u771f\u5b9e IP&#xff08;\u9632\u4f2a\u9020&#xff09;<\/li>\n<\/ul>\n<\/li>\n<li>\u516d\u3001\u81ea\u52a8\u5316\u8bc1\u4e66\u7ba1\u7406&#xff1a;acme.sh &#043; Cron \u5168\u6d41\u7a0b &#x1f916;<\/li>\n<li>\n<ul>\n<li>1. \u5b89\u88c5\u4e0e\u521d\u59cb\u5316<\/li>\n<li>2. \u4e3a &#096;api.example.com&#096; \u7533\u8bf7\u8bc1\u4e66&#xff08;DNS-01&#xff09;<\/li>\n<li>3. &#096;&#8211;deploy-hook&#096; \u811a\u672c&#xff1a;\u8bc1\u4e66\u90e8\u7f72 &#043; Nginx \u91cd\u8f7d<\/li>\n<li>4. \u5b9a\u65f6\u4efb\u52a1&#xff08;\u6bcf\u5929\u51cc\u6668 3 \u70b9\u68c0\u6d4b\u7eed\u671f&#xff09;<\/li>\n<\/ul>\n<\/li>\n<li>\u4e03\u3001\u9ad8\u7ea7\u573a\u666f&#xff1a;\u6df7\u5408\u8bc1\u4e66\u7c7b\u578b\u4e0e\u56fd\u5bc6\u652f\u6301 &#x1f1e8;&#x1f1f3;&#x1f510;<\/li>\n<li>\n<ul>\n<li>\u573a\u666f&#xff1a;\u540c\u65f6\u652f\u6301\u56fd\u9645\u6807\u51c6&#xff08;RSA\/ECC&#xff09;\u4e0e\u56fd\u5bc6&#xff08;SM2\/SM3\/SM4&#xff09;<\/li>\n<li>\n<ul>\n<li>\u914d\u7f6e\u793a\u4f8b&#xff1a;\u56fd\u5bc6\u4e13\u7528 server \u5757<\/li>\n<\/ul>\n<\/li>\n<li>Java \u540e\u7aef\u56fd\u5bc6\u652f\u6301&#xff08;Bouncy Castle&#xff09;<\/li>\n<\/ul>\n<\/li>\n<li>\u516b\u3001\u76d1\u63a7\u4e0e\u544a\u8b66&#xff1a;\u8bc1\u4e66\u5230\u671f\u9884\u8b66\u4f53\u7cfb &#x1f4ca;&#x1f514;<\/li>\n<li>\n<ul>\n<li>1. Nginx \u65e5\u5fd7\u6ce8\u5165\u8bc1\u4e66\u4fe1\u606f&#xff08;Prometheus \u53ef\u91c7\u96c6&#xff09;<\/li>\n<li>2. Prometheus &#043; Grafana \u544a\u8b66\u89c4\u5219&#xff08;YAML&#xff09;<\/li>\n<li>3. Java \u5e94\u7528\u5185\u5d4c\u8bc1\u4e66\u5065\u5eb7\u68c0\u67e5 Endpoint<\/li>\n<\/ul>\n<\/li>\n<li>\u4e5d\u3001\u6545\u969c\u6392\u67e5\u9ec4\u91d1 Checklist \u2705&#x1f50d;<\/li>\n<li>\u5341\u3001\u6027\u80fd\u538b\u6d4b\u4e0e\u8c03\u4f18\u5b9e\u6d4b\u6570\u636e &#x1f4c8;<\/li>\n<li>\u5341\u4e00\u3001\u603b\u7ed3&#xff1a;\u6784\u5efa\u5f39\u6027\u3001\u5b89\u5168\u3001\u53ef\u6f14\u8fdb\u7684 HTTPS \u57fa\u7840\u8bbe\u65bd &#x1f3d7;\ufe0f\u2728<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Nginx \u591a\u57df\u540d HTTPS \u914d\u7f6e&#xff1a;\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 &#x1f310;&#x1f512;<\/h2>\n<p>\u5728\u73b0\u4ee3\u4e91\u539f\u751f\u4e0e\u5fae\u670d\u52a1\u67b6\u6784\u4e2d&#xff0c;\u4e00\u53f0\u7269\u7406\u6216\u865a\u62df\u670d\u52a1\u5668\u627f\u8f7d\u591a\u4e2a\u4e1a\u52a1\u57df\u540d\u5df2\u6210\u4e3a\u5e38\u6001\u2014\u2014\u53ef\u80fd\u662f shop.example.com&#xff08;\u7535\u5546\u524d\u53f0&#xff09;\u3001api.example.com&#xff08;\u540e\u7aef API&#xff09;\u3001admin.example.com&#xff08;\u8fd0\u8425\u540e\u53f0&#xff09;\u3001docs.example.com&#xff08;\u6280\u672f\u6587\u6863\u7ad9&#xff09;&#xff0c;\u751a\u81f3\u8fd8\u6709\u5ba2\u6237\u5b9a\u5236\u7684\u767d\u6807\u5b50\u57df\u5982 client1.brandpartner.net\u3002\u8fd9\u4e9b\u57df\u540d\u4e0d\u4ec5\u903b\u8f91\u72ec\u7acb\u3001\u5f52\u5c5e\u4e0d\u540c\u56e2\u961f&#xff0c;\u66f4\u5173\u952e\u7684\u662f&#xff1a;\u5b83\u4eec\u5f80\u5f80\u9700\u8981\u5404\u81ea\u72ec\u7acb\u7684 TLS \u8bc1\u4e66&#xff0c;\u4ee5\u6ee1\u8db3\u5408\u89c4\u5ba1\u8ba1\u3001\u54c1\u724c\u9694\u79bb\u3001\u8bc1\u4e66\u751f\u547d\u5468\u671f\u7ba1\u7406\u53ca\u5b89\u5168\u7b56\u7565\u5dee\u5f02\u5316\u7b49\u521a\u6027\u9700\u6c42\u3002<\/p>\n<p>\u7136\u800c&#xff0c;\u82e5\u91c7\u7528\u4f20\u7edf\u201c\u4e00\u4e2a Nginx \u5b9e\u4f8b &#043; \u4e00\u4e2a\u5168\u5c40\u8bc1\u4e66\u201d\u7684\u7c97\u653e\u6a21\u5f0f&#xff0c;\u5c06\u9762\u4e34\u4e25\u5cfb\u6311\u6218&#xff1a; \u274c \u65e0\u6cd5\u4e3a\u4e0d\u540c\u57df\u540d\u914d\u7f6e\u4e13\u5c5e\u8bc1\u4e66&#xff08;\u5982 Let\u2019s Encrypt SAN \u8bc1\u4e66\u6709 100 \u57df\u540d\u4e0a\u9650\u4e14\u7eed\u671f\u8026\u5408&#xff09;&#xff1b; \u274c \u67d0\u4e00\u57df\u540d\u8bc1\u4e66\u8fc7\u671f\u6216\u540a\u9500&#xff0c;\u5c06\u5bfc\u81f4\u5168\u90e8\u7ad9\u70b9 HTTPS \u4e2d\u65ad&#xff1b; \u274c \u5ba2\u6237\u8981\u6c42\u4f7f\u7528\u81ea\u6709\u79c1\u6709 CA \u6216\u56fd\u5bc6 SM2 \u8bc1\u4e66\u65f6&#xff0c;\u65e0\u6cd5\u4e0e\u4e3b\u7ad9\u8bc1\u4e66\u5171\u5b58&#xff1b; \u274c \u7070\u5ea6\u53d1\u5e03\u65b0\u8bc1\u4e66\u65f6\u7f3a\u4e4f\u539f\u5b50\u6027\u63a7\u5236&#xff0c;\u98ce\u9669\u6269\u6563\u9762\u5927&#xff1b; \u274c \u4e0d\u7b26\u5408 PCI DSS\u3001\u7b49\u4fdd2.0 \u7b49\u6807\u51c6\u4e2d\u201c\u6700\u5c0f\u6743\u9650\u8bc1\u4e66\u6301\u6709\u201d\u4e0e\u201c\u57df\u7ea7\u5bc6\u94a5\u9694\u79bb\u201d\u539f\u5219\u3002<\/p>\n<p>\u5e78\u8fd0\u7684\u662f&#xff0c;\u81ea Nginx 1.15.9 \u8d77\u539f\u751f\u652f\u6301 TLS SNI&#xff08;Server Name Indication&#xff09;\u591a\u8bc1\u4e66\u52a8\u6001\u52a0\u8f7d&#xff0c;\u914d\u5408\u6210\u719f\u7684\u8bc1\u4e66\u81ea\u52a8\u5316\u5de5\u5177\u94fe\u4e0e\u7cbe\u7ec6\u5316\u914d\u7f6e\u7b56\u7565&#xff0c;\u6211\u4eec\u5b8c\u5168\u53ef\u4ee5\u5728\u5355\u4e2a Nginx \u8fdb\u7a0b\u5185\u5b9e\u73b0\u6beb\u79d2\u7ea7\u3001\u96f6\u4e2d\u65ad\u3001\u6309\u57df\u540d\u7c92\u5ea6\u7cbe\u51c6\u5339\u914d\u5e76\u52a0\u8f7d\u6570\u767e\u4e2a\u72ec\u7acb\u8bc1\u4e66\u2014\u2014\u8fd9\u6b63\u662f\u672c\u6587\u8981\u7cfb\u7edf\u9610\u8ff0\u7684\u6838\u5fc3\u5b9e\u8df5\u3002<\/p>\n<p>&#x1f4a1; SNI \u662f\u4ec0\u4e48&#xff1f; TLS \u534f\u8bae\u5728\u63e1\u624b\u521d\u671f&#xff08;ClientHello \u9636\u6bb5&#xff09;\u5373\u660e\u6587\u643a\u5e26\u8bf7\u6c42\u7684 server_name&#xff08;\u5373\u57df\u540d&#xff09;\u3002Nginx \u5229\u7528\u8be5\u5b57\u6bb5&#xff0c;\u5728\u5efa\u7acb\u52a0\u5bc6\u901a\u9053\u524d\u5c31\u5b8c\u6210\u8bc1\u4e66\u9009\u62e9&#xff0c;\u65e0\u9700\u89e3\u5bc6\u6d41\u91cf\u3002\u8fd9\u662f\u73b0\u4ee3 HTTPS \u591a\u79df\u6237\u90e8\u7f72\u7684\u57fa\u77f3 \u2705\u3002 &#x1f517; \u5ef6\u4f38\u9605\u8bfb&#xff1a;Mozilla SSL Configuration Generator \u63d0\u4f9b\u4e86\u6743\u5a01\u7684 TLS \u914d\u7f6e\u5efa\u8bae<\/p>\n<hr \/>\n<h3>\u4e00\u3001\u4e3a\u4ec0\u4e48\u4e0d\u80fd\u53ea\u9760\u4e00\u4e2a\u6cdb\u57df\u540d\u8bc1\u4e66&#xff1f;&#x1f6ab;&#x1f310;<\/h3>\n<p>\u6cdb\u57df\u540d\u8bc1\u4e66&#xff08;Wildcard Certificate&#xff0c;\u5982 *.example.com&#xff09;\u770b\u4f3c\u4fbf\u6377&#xff0c;\u4f46\u5728\u4f01\u4e1a\u7ea7\u751f\u4ea7\u73af\u5883\u4e2d\u5e38\u6210\u9690\u60a3\u6e90\u5934&#xff1a;<\/p>\n<h4>1. \u5b89\u5168\u8fb9\u754c\u5931\u63a7<\/h4>\n<ul>\n<li>*.example.com \u53ef\u7528\u4e8e dev.example.com\u3001staging.example.com\u3001backup.example.com \u2014\u2014 \u8fd9\u4e9b\u73af\u5883\u672c\u4e0d\u5e94\u6301\u6709\u4e0e\u751f\u4ea7\u540c\u7b49\u7ea7\u7684\u79c1\u94a5&#xff1b;<\/li>\n<li>\u82e5\u5f00\u53d1\u673a\u79c1\u94a5\u6cc4\u9732&#xff0c;\u653b\u51fb\u8005\u53ef\u7b7e\u53d1\u4efb\u610f\u5b50\u57df HTTPS \u6d41\u91cf&#xff0c;\u4e2d\u95f4\u4eba\u653b\u51fb\u6210\u672c\u9aa4\u964d&#xff1b;<\/li>\n<li>\u5408\u89c4\u68c0\u67e5\u4e2d&#xff0c;\u5ba1\u8ba1\u5458\u4f1a\u660e\u786e\u8d28\u7591&#xff1a;\u201c\u4e3a\u4f55\u6d4b\u8bd5\u73af\u5883\u62e5\u6709\u751f\u4ea7\u4e3b\u57df\u7684\u5b8c\u6574\u8bc1\u4e66\u6743\u9650&#xff1f;\u201d<\/li>\n<\/ul>\n<h4>2. \u751f\u547d\u5468\u671f\u7ba1\u7406\u50f5\u5316<\/h4>\n<p>Let\u2019s Encrypt \u6cdb\u57df\u8bc1\u4e66\u9700\u901a\u8fc7 DNS-01 \u6311\u6218\u9a8c\u8bc1&#xff0c;\u6bcf\u6b21\u7eed\u671f\u90fd\u9700\u64cd\u4f5c DNS API\u3002\u5f53 example.com \u4e0b\u6709 37 \u4e2a\u5b50\u57df&#xff0c;\u5176\u4e2d 5 \u4e2a\u5df2\u4e0b\u7ebf\u30018 \u4e2a\u7531\u7b2c\u4e09\u65b9\u6258\u7ba1\u300112 \u4e2a\u5904\u4e8e\u7070\u5ea6\u4e2d\u2014\u2014\u4f60\u65e0\u6cd5\u5b89\u5168\u5730\u201c\u53ea\u7eed\u671f\u6d3b\u8dc3\u57df\u540d\u201d&#xff0c;\u53ea\u80fd\u5168\u91cf\u66f4\u65b0&#xff0c;\u5f15\u53d1\u8fde\u9501\u98ce\u9669\u3002<\/p>\n<h4>3. \u6cd5\u5f8b\u4e0e\u54c1\u724c\u9694\u79bb\u5931\u6548<\/h4>\n<p>\u67d0\u91d1\u878d\u5ba2\u6237\u8981\u6c42\u5176\u767d\u6807\u7ad9\u70b9 banking.client-a.com \u5fc5\u987b\u4f7f\u7528\u5176\u81ea\u6709 OV \u8bc1\u4e66&#xff08;\u542b\u516c\u53f8\u5168\u79f0&#xff09;&#xff0c;\u800c\u975e\u4f60\u7684 *.yourplatform.io\u3002\u6cdb\u57df\u8bc1\u4e66\u65e0\u6cd5\u6ee1\u8db3\u6b64\u7c7b\u6cd5\u5f8b\u80cc\u4e66\u9700\u6c42\u3002<\/p>\n<p>\u2705 \u771f\u5b9e\u6848\u4f8b\u53c2\u8003&#xff1a;Cloudflare \u7684 Zero Trust \u67b6\u6784\u767d\u76ae\u4e66 \u660e\u786e\u6307\u51fa&#xff1a;\u201c\u6bcf\u4e2a\u5e94\u7528\u5165\u53e3\u5e94\u7ed1\u5b9a\u4e13\u5c5e\u8bc1\u4e66&#xff0c;\u907f\u514d\u8bc1\u4e66\u7206\u70b8\u534a\u5f84&#xff08;Certificate Blast Radius&#xff09;\u201d\u3002<\/p>\n<p>\u56e0\u6b64&#xff0c;\u591a\u57df\u540d &#043; \u591a\u8bc1\u4e66 \u2260 \u5de5\u7a0b\u590d\u6742\u5ea6\u589e\u52a0&#xff0c;\u800c\u662f\u5b89\u5168\u7eb5\u6df1\u4e0e\u8fd0\u7ef4\u5f39\u6027\u7684\u5fc5\u8981\u6295\u8d44\u3002<\/p>\n<hr \/>\n<h3>\u4e8c\u3001Nginx \u591a\u8bc1\u4e66\u6838\u5fc3\u673a\u5236\u89e3\u6790 &#x1f50d;<\/h3>\n<p>Nginx \u652f\u6301\u4e09\u79cd\u8bc1\u4e66\u52a0\u8f7d\u6a21\u5f0f&#xff0c;\u7406\u89e3\u5dee\u5f02\u662f\u4f18\u5316\u524d\u63d0&#xff1a;<\/p>\n<table>\n<tr>\u6a21\u5f0f\u914d\u7f6e\u8bed\u6cd5\u52a0\u8f7d\u65f6\u673a\u70ed\u91cd\u8f7d\u652f\u6301\u9002\u7528\u573a\u666f<\/tr>\n<tbody>\n<tr>\n<td>\u9759\u6001\u8bc1\u4e66&#xff08;Static&#xff09;<\/td>\n<td>ssl_certificate \/path\/to\/cert.pem;ssl_certificate_key \/path\/to\/key.pem;<\/td>\n<td>Nginx \u542f\u52a8\u65f6\u4e00\u6b21\u6027\u8bfb\u5165\u5185\u5b58<\/td>\n<td>\u274c \u9700 reload<\/td>\n<td>\u5355\u57df\u540d\u6216\u8bc1\u4e66\u6781\u5c11\u53d8\u66f4<\/td>\n<\/tr>\n<tr>\n<td>\u52a8\u6001\u8bc1\u4e66&#xff08;Dynamic via ssl_certificate_by_lua&#xff09;*<\/td>\n<td>ssl_certificate_by_lua_block { &#8230; }<\/td>\n<td>TLS \u63e1\u624b\u65f6\u6309\u9700\u6267\u884c Lua \u903b\u8f91<\/td>\n<td>\u2705 \u65e0\u9700 reload<\/td>\n<td>\u8d85\u5927\u89c4\u6a21&#xff08;\u4e07\u7ea7\u57df\u540d&#xff09;\u3001\u8bc1\u4e66\u5b58\u5728\u8fdc\u7a0b\u5b58\u50a8&#xff08;\u5982 Vault&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>SNI \u8bc1\u4e66\u6620\u5c04&#xff08;SNI-based Mapping&#xff09;<\/td>\n<td>map $ssl_server_name $cert_path { &#8230; }ssl_certificate $cert_path;<\/td>\n<td>Nginx 1.19.4&#043; \u539f\u751f\u652f\u6301&#xff0c;\u57fa\u4e8e $ssl_server_name \u53d8\u91cf\u67e5\u8868<\/td>\n<td>\u2705 reload \u5373\u751f\u6548<\/td>\n<td>\u672c\u6587\u4e3b\u63a8&#xff1a;\u767e\u7ea7\u57df\u540d\u3001\u672c\u5730\u6587\u4ef6\u5b58\u50a8\u3001\u9ad8\u7a33\u5b9a\u6027<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u26a0\ufe0f \u6ce8\u610f&#xff1a;ssl_certificate_by_lua* \u9700\u7f16\u8bd1 nginx-lua-module&#xff0c;\u800c map \u65b9\u5f0f\u65e0\u9700\u989d\u5916\u6a21\u5757&#xff0c;\u66f4\u8f7b\u91cf\u3001\u66f4\u7a33\u5b9a\u3001\u66f4\u6613\u5ba1\u8ba1&#xff0c;\u662f\u751f\u4ea7\u9996\u9009\u3002<\/p>\n<h4>\u25b6\ufe0f SNI \u6620\u5c04\u5de5\u4f5c\u6d41&#xff08;Mermaid \u5e8f\u5217\u56fe&#xff09;<\/h4>\n<p>     Nginx Server<\/p>\n<p>     Client (Browser)<\/p>\n<p>      Nginx Server<\/p>\n<p>      Client (Browser)<\/p>\n<p>  #mermaid-svg-H08qqJ9rpY7riLFt{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-H08qqJ9rpY7riLFt .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-H08qqJ9rpY7riLFt .error-icon{fill:#552222;}#mermaid-svg-H08qqJ9rpY7riLFt .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-H08qqJ9rpY7riLFt .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-H08qqJ9rpY7riLFt .marker{fill:#333333;stroke:#333333;}#mermaid-svg-H08qqJ9rpY7riLFt .marker.cross{stroke:#333333;}#mermaid-svg-H08qqJ9rpY7riLFt svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-H08qqJ9rpY7riLFt p{margin:0;}#mermaid-svg-H08qqJ9rpY7riLFt .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-H08qqJ9rpY7riLFt text.actor&gt;tspan{fill:black;stroke:none;}#mermaid-svg-H08qqJ9rpY7riLFt .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-H08qqJ9rpY7riLFt .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-H08qqJ9rpY7riLFt .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-H08qqJ9rpY7riLFt .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-H08qqJ9rpY7riLFt #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-H08qqJ9rpY7riLFt .sequenceNumber{fill:white;}#mermaid-svg-H08qqJ9rpY7riLFt #sequencenumber{fill:#333;}#mermaid-svg-H08qqJ9rpY7riLFt #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-H08qqJ9rpY7riLFt .messageText{fill:#333;stroke:none;}#mermaid-svg-H08qqJ9rpY7riLFt .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-H08qqJ9rpY7riLFt .labelText,#mermaid-svg-H08qqJ9rpY7riLFt .labelText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-H08qqJ9rpY7riLFt .loopText,#mermaid-svg-H08qqJ9rpY7riLFt .loopText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-H08qqJ9rpY7riLFt .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-H08qqJ9rpY7riLFt .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-H08qqJ9rpY7riLFt .noteText,#mermaid-svg-H08qqJ9rpY7riLFt .noteText&gt;tspan{fill:black;stroke:none;}#mermaid-svg-H08qqJ9rpY7riLFt .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-H08qqJ9rpY7riLFt .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-H08qqJ9rpY7riLFt .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-H08qqJ9rpY7riLFt .actorPopupMenu{position:absolute;}#mermaid-svg-H08qqJ9rpY7riLFt .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-H08qqJ9rpY7riLFt .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-H08qqJ9rpY7riLFt .actor-man circle,#mermaid-svg-H08qqJ9rpY7riLFt line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-H08qqJ9rpY7riLFt :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>     \u5168\u7a0b\u65e0\u9700\u89e3\u5bc6\u5e94\u7528\u5c42\u6570\u636e<\/p>\n<p>     \u8bc1\u4e66\u9009\u62e9\u53d1\u751f\u5728\u52a0\u5bc6\u524d<\/p>\n<p>   TCP SYN \u2192 443<\/p>\n<p>   ClientHello<\/p>\n<p>   server_name &#061; &#034;api.example.com&#034;<\/p>\n<p>   \u67e5 map \u8868&#xff1a;<\/p>\n<p>   &#034;api.example.com&#034; \u2192 &#034;\/etc\/nginx\/ssl\/api.example.com\/fullchain.pem&#034;<\/p>\n<p>   \u52a0\u8f7d\u5bf9\u5e94\u8bc1\u4e66\u94fe\u4e0e\u79c1\u94a5\u5230\u5185\u5b58<\/p>\n<p>   ServerHello &#043; \u9009\u5b9a\u8bc1\u4e66<\/p>\n<p>   \u5b8c\u6210 TLS \u63e1\u624b<\/p>\n<p>\u6b64\u6d41\u7a0b\u786e\u4fdd&#xff1a; \u2705 \u6bcf\u4e2a\u57df\u540d\u62e5\u6709\u5b8c\u5168\u72ec\u7acb\u7684\u8bc1\u4e66\u6587\u4ef6\u8def\u5f84&#xff1b; \u2705 \u65b0\u589e\u57df\u540d\u53ea\u9700\u66f4\u65b0 map \u5757 &#043; reload&#xff0c;\u65e0\u8fde\u63a5\u4e2d\u65ad&#xff1b; \u2705 \u8bc1\u4e66\u6587\u4ef6\u6743\u9650\u53ef\u4e25\u683c\u8bbe\u4e3a 600&#xff0c;\u4ec5 nginx \u7528\u6237\u53ef\u8bfb&#xff1b; \u2705 \u4e0e acme.sh\u3001certbot \u7b49\u5de5\u5177\u5929\u7136\u517c\u5bb9\u3002<\/p>\n<hr \/>\n<h3>\u4e09\u3001\u751f\u4ea7\u7ea7\u76ee\u5f55\u7ed3\u6784\u4e0e\u6743\u9650\u8bbe\u8ba1 &#x1f4c1;&#x1f510;<\/h3>\n<p>\u6df7\u4e71\u7684\u8bc1\u4e66\u5b58\u653e\u662f\u8fd0\u7ef4\u4e8b\u6545\u6e29\u5e8a\u3002\u6211\u4eec\u5b9a\u4e49\u4e00\u5957\u7ecf\u767e\u4e07\u7ea7\u8282\u70b9\u9a8c\u8bc1\u7684\u76ee\u5f55\u89c4\u8303&#xff1a;<\/p>\n<p>\/etc\/nginx\/<br \/>\n\u251c\u2500\u2500 ssl\/                     <span class=\"token comment\"># \u6240\u6709\u8bc1\u4e66\u6839\u76ee\u5f55&#xff08;\u7981\u6b62\u76f4\u63a5\u653e .pem&#xff01;&#xff09;<\/span><br \/>\n\u2502   \u251c\u2500\u2500 example.com\/         <span class=\"token comment\"># \u6bcf\u57df\u540d\u72ec\u7acb\u5b50\u76ee\u5f55<\/span><br \/>\n\u2502   \u2502   \u251c\u2500\u2500 fullchain.pem    <span class=\"token comment\"># \u8bc1\u4e66\u94fe&#xff08;\u542b\u6839&#043;\u4e2d\u95f4CA&#xff09;<\/span><br \/>\n\u2502   \u2502   \u251c\u2500\u2500 privkey.pem      <span class=\"token comment\"># \u79c1\u94a5&#xff08;\u5fc5\u987b 600 \u6743\u9650&#xff01;&#xff09;<\/span><br \/>\n\u2502   \u2502   \u2514\u2500\u2500 README.md        <span class=\"token comment\"># \u8bb0\u5f55\u7b7e\u53d1\u65f6\u95f4\u3001CA\u3001\u5230\u671f\u65e5\u3001\u8d1f\u8d23\u4eba<\/span><br \/>\n\u2502   \u251c\u2500\u2500 api.example.com\/<br \/>\n\u2502   \u2502   \u251c\u2500\u2500 fullchain.pem<br \/>\n\u2502   \u2502   \u251c\u2500\u2500 privkey.pem<br \/>\n\u2502   \u2502   \u2514\u2500\u2500 README.md<br \/>\n\u2502   \u2514\u2500\u2500 client-b.com\/<br \/>\n\u2502       \u251c\u2500\u2500 fullchain.pem    <span class=\"token comment\"># \u7b2c\u4e09\u65b9\u63d0\u4f9b\u8bc1\u4e66<\/span><br \/>\n\u2502       \u251c\u2500\u2500 privkey.pem<br \/>\n\u2502       \u2514\u2500\u2500 README.md<br \/>\n\u251c\u2500\u2500 conf.d\/<br \/>\n\u2502   \u251c\u2500\u2500 ssl-mapping.conf     <span class=\"token comment\"># map \u8bc1\u4e66\u8def\u5f84\u7684\u6838\u5fc3\u914d\u7f6e<\/span><br \/>\n\u2502   \u251c\u2500\u2500 sites-enabled\/<br \/>\n\u2502   \u2502   \u251c\u2500\u2500 example.com.conf<br \/>\n\u2502   \u2502   \u251c\u2500\u2500 api.example.com.conf<br \/>\n\u2502   \u2502   \u2514\u2500\u2500 client-b.com.conf<br \/>\n\u2514\u2500\u2500 nginx.conf               <span class=\"token comment\"># \u4e3b\u914d\u7f6e&#xff0c;include ssl-mapping.conf<\/span><\/p>\n<h4>\u2705 \u6743\u9650\u52a0\u56fa\u811a\u672c&#xff08;Shell&#xff09;<\/h4>\n<p><span class=\"token shebang important\">#!\/bin\/bash<\/span><br \/>\n<span class=\"token comment\"># secure-certs.sh &#8211; \u8fd0\u884c\u4e8e certbot\/acme.sh hook \u4e2d<\/span><br \/>\n<span class=\"token assign-left variable\">CERT_DIR<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;\/etc\/nginx\/ssl&#034;<\/span><br \/>\n<span class=\"token assign-left variable\">NGINX_USER<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;www-data&#034;<\/span>  <span class=\"token comment\"># Ubuntu\/Debian \u9ed8\u8ba4\u7528\u6237<\/span><\/p>\n<p><span class=\"token function\">find<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>&#034;<\/span> <span class=\"token parameter variable\">-name<\/span> <span class=\"token string\">&#034;privkey.pem&#034;<\/span> <span class=\"token parameter variable\">-exec<\/span> <span class=\"token function\">chmod<\/span> <span class=\"token number\">600<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">\\\\<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token function\">find<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>&#034;<\/span> <span class=\"token parameter variable\">-name<\/span> <span class=\"token string\">&#034;fullchain.pem&#034;<\/span> <span class=\"token parameter variable\">-exec<\/span> <span class=\"token function\">chmod<\/span> <span class=\"token number\">644<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">\\\\<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token function\">chown<\/span> <span class=\"token parameter variable\">-R<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$NGINX_USER<\/span>&#034;<\/span><span class=\"token builtin class-name\">:<\/span><span class=\"token string\">&#034;<span class=\"token variable\">$NGINX_USER<\/span>&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>&#034;<\/span><\/p>\n<p>&#x1f517; \u6700\u4f73\u5b9e\u8df5\u53c2\u8003&#xff1a;OWASP TLS Cheat Sheet \u5f3a\u8c03\u79c1\u94a5\u6700\u5c0f\u6743\u9650\u539f\u5219<\/p>\n<hr \/>\n<h3>\u56db\u3001\u6838\u5fc3\u914d\u7f6e&#xff1a;map &#043; server \u5b8c\u6574\u8303\u4f8b &#x1f6e0;\ufe0f<\/h3>\n<h4>1. \/etc\/nginx\/conf.d\/ssl-mapping.conf<\/h4>\n<p># &#061;&#061;&#061; SSL Certificate Mapping by SNI &#061;&#061;&#061;<br \/>\n# \u4f7f\u7528 map \u6307\u4ee4\u5c06\u57df\u540d\u6620\u5c04\u5230\u8bc1\u4e66\u8def\u5f84<br \/>\n# \u6ce8\u610f&#xff1a;map \u5fc5\u987b\u5728 http{} \u5757\u9876\u5c42\u5b9a\u4e49&#xff0c;\u4e0d\u53ef\u5728 server{} \u5185<\/p>\n<p>map $ssl_server_name $upstream_cert {<br \/>\n    # \u9ed8\u8ba4\u515c\u5e95\u8bc1\u4e66&#xff08;\u53ef\u9009&#xff0c;\u7528\u4e8e\u672a\u5339\u914d\u57df\u540d\u7684\u53cb\u597d\u63d0\u793a&#xff09;<br \/>\n    default                          &#034;\/etc\/nginx\/ssl\/_default\/fullchain.pem&#034;;<\/p>\n<p>    # \u4e3b\u7ad9<br \/>\n    example.com                        &#034;\/etc\/nginx\/ssl\/example.com\/fullchain.pem&#034;;<br \/>\n    www.example.com                    &#034;\/etc\/nginx\/ssl\/example.com\/fullchain.pem&#034;;<\/p>\n<p>    # API \u670d\u52a1<br \/>\n    api.example.com                    &#034;\/etc\/nginx\/ssl\/api.example.com\/fullchain.pem&#034;;<br \/>\n    staging-api.example.com            &#034;\/etc\/nginx\/ssl\/api.example.com\/fullchain.pem&#034;;<\/p>\n<p>    # \u8fd0\u8425\u540e\u53f0<br \/>\n    admin.example.com                  &#034;\/etc\/nginx\/ssl\/admin.example.com\/fullchain.pem&#034;;<\/p>\n<p>    # \u767d\u6807\u5ba2\u6237<br \/>\n    client-a.brandpartner.net          &#034;\/etc\/nginx\/ssl\/client-a.brandpartner.net\/fullchain.pem&#034;;<br \/>\n    client-b.brandpartner.net          &#034;\/etc\/nginx\/ssl\/client-b.brandpartner.net\/fullchain.pem&#034;;<\/p>\n<p>    # \u56fd\u5bc6\u8bc1\u4e66&#xff08;SM2&#xff09;\u7ad9\u70b9 \u2014\u2014 \u9700 Nginx with OpenSSL 3.0&#043; &amp; GMSSL<br \/>\n    sm2.example.com                    &#034;\/etc\/nginx\/ssl\/sm2.example.com\/fullchain_sm2.pem&#034;;<br \/>\n}<\/p>\n<p>map $ssl_server_name $upstream_key {<br \/>\n    default                          &#034;\/etc\/nginx\/ssl\/_default\/privkey.pem&#034;;<br \/>\n    example.com                        &#034;\/etc\/nginx\/ssl\/example.com\/privkey.pem&#034;;<br \/>\n    www.example.com                    &#034;\/etc\/nginx\/ssl\/example.com\/privkey.pem&#034;;<br \/>\n    api.example.com                    &#034;\/etc\/nginx\/ssl\/api.example.com\/privkey.pem&#034;;<br \/>\n    staging-api.example.com            &#034;\/etc\/nginx\/ssl\/api.example.com\/privkey.pem&#034;;<br \/>\n    admin.example.com                  &#034;\/etc\/nginx\/ssl\/admin.example.com\/privkey.pem&#034;;<br \/>\n    client-a.brandpartner.net          &#034;\/etc\/nginx\/ssl\/client-a.brandpartner.net\/privkey.pem&#034;;<br \/>\n    client-b.brandpartner.net          &#034;\/etc\/nginx\/ssl\/client-b.brandpartner.net\/privkey.pem&#034;;<br \/>\n    sm2.example.com                    &#034;\/etc\/nginx\/ssl\/sm2.example.com\/privkey_sm2.pem&#034;;<br \/>\n}<\/p>\n<p># \u53ef\u9009&#xff1a;\u6839\u636e\u57df\u540d\u542f\u7528\u4e0d\u540c TLS \u7248\u672c&#xff08;\u5982\u56fd\u5bc6\u7ad9\u5f3a\u5236 TLSv1.3&#xff09;<br \/>\nmap $ssl_server_name $tls_protocols {<br \/>\n    default                          &#034;TLSv1.2 TLSv1.3&#034;;<br \/>\n    sm2.example.com                    &#034;TLSv1.3&#034;;<br \/>\n}<\/p>\n<h4>2. \/etc\/nginx\/conf.d\/sites-enabled\/api.example.com.conf<\/h4>\n<p>server {<br \/>\n    listen 443 ssl http2;<br \/>\n    listen [::]:443 ssl http2;<\/p>\n<p>    # \u5173\u952e&#xff1a;\u52a8\u6001\u8bc1\u4e66\u8def\u5f84<br \/>\n    ssl_certificate     $upstream_cert;<br \/>\n    ssl_certificate_key $upstream_key;<br \/>\n    ssl_protocols       $tls_protocols;<\/p>\n<p>    # \u57df\u540d\u5339\u914d&#xff08;SNI \u5df2\u7531\u4e0a\u5c42 map \u89e3\u6790&#xff0c;\u6b64\u5904\u4ec5\u505a\u8def\u7531&#xff09;<br \/>\n    server_name api.example.com staging-api.example.com;<\/p>\n<p>    # \u5f3a\u5236 HSTS&#xff08;\u751f\u4ea7\u73af\u5883\u5fc5\u5f00&#xff09;<br \/>\n    add_header Strict-Transport-Security &#034;max-age&#061;31536000; includeSubDomains; preload&#034; always;<\/p>\n<p>    # OCSP Stapling \u52a0\u901f\u8bc1\u4e66\u72b6\u6001\u9a8c\u8bc1<br \/>\n    ssl_stapling on;<br \/>\n    ssl_stapling_verify on;<br \/>\n    resolver 8.8.8.8 1.1.1.1 valid&#061;300s;<br \/>\n    resolver_timeout 5s;<\/p>\n<p>    # \u5b89\u5168\u5934<br \/>\n    add_header X-Frame-Options &#034;DENY&#034; always;<br \/>\n    add_header X-Content-Type-Options &#034;nosniff&#034; always;<br \/>\n    add_header X-XSS-Protection &#034;1; mode&#061;block&#034; always;<br \/>\n    add_header Referrer-Policy &#034;no-referrer-when-downgrade&#034; always;<\/p>\n<p>    # Java \u540e\u7aef\u4ee3\u7406&#xff08;\u793a\u4f8b&#xff1a;Spring Boot \u5fae\u670d\u52a1&#xff09;<br \/>\n    location \/ {<br \/>\n        proxy_pass https:\/\/backend-java-cluster;<br \/>\n        proxy_http_version 1.1;<br \/>\n        proxy_set_header Upgrade $http_upgrade;<br \/>\n        proxy_set_header Connection &#034;upgrade&#034;;<br \/>\n        proxy_set_header Host $host;<br \/>\n        proxy_set_header X-Real-IP $remote_addr;<br \/>\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;<br \/>\n        proxy_set_header X-Forwarded-Proto $scheme;<\/p>\n<p>        # \u4f20\u9012\u5ba2\u6237\u7aef\u8bc1\u4e66&#xff08;\u5982\u9700\u53cc\u5411\u8ba4\u8bc1&#xff09;<br \/>\n        proxy_ssl_verify off; # \u751f\u4ea7\u8bf7\u5f00\u542f\u5e76\u914d\u7f6e ca.crt<br \/>\n    }<\/p>\n<p>    # \u5065\u5eb7\u68c0\u67e5\u7aef\u70b9&#xff08;\u4e0d\u8d70 Java \u903b\u8f91&#xff0c;Nginx \u76f4\u7b54&#xff09;<br \/>\n    location \/healthz {<br \/>\n        return 200 &#039;OK&#039;;<br \/>\n        add_header Content-Type text\/plain;<br \/>\n    }<br \/>\n}<\/p>\n<h4>3. \/etc\/nginx\/conf.d\/sites-enabled\/client-b.com.conf<\/h4>\n<p>server {<br \/>\n    listen 443 ssl http2;<br \/>\n    listen [::]:443 ssl http2;<\/p>\n<p>    ssl_certificate     $upstream_cert;<br \/>\n    ssl_certificate_key $upstream_key;<\/p>\n<p>    # \u5ba2\u6237\u63d0\u4f9b\u8bc1\u4e66&#xff0c;\u53ef\u80fd\u4e3a OV \u6216 EV&#xff0c;\u9700\u7279\u6b8a Header<br \/>\n    server_name client-b.brandpartner.net;<\/p>\n<p>    # \u5ba2\u6237\u8981\u6c42&#xff1a;\u66b4\u9732\u8bc1\u4e66\u4fe1\u606f\u81f3\u54cd\u5e94\u5934&#xff08;\u5408\u89c4\u5ba1\u8ba1\u7528&#xff09;<br \/>\n    ssl_certificate_info on; # Nginx 1.19.7&#043;<br \/>\n    add_header X-Cert-Issuer $ssl_client_i_dn_o;<br \/>\n    add_header X-Cert-Subject $ssl_client_s_dn_cn;<\/p>\n<p>    location \/ {<br \/>\n        # \u4ee3\u7406\u81f3\u5ba2\u6237\u6307\u5b9a\u540e\u7aef&#xff08;\u53ef\u80fd\u662f Java Tomcat \u96c6\u7fa4&#xff09;<br \/>\n        proxy_pass http:\/\/client-b-tomcat;<br \/>\n        proxy_set_header Host $host;<br \/>\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;<br \/>\n        proxy_set_header X-Forwarded-Proto $scheme;<br \/>\n    }<br \/>\n}<\/p>\n<h4>\u2705 \u9a8c\u8bc1\u914d\u7f6e\u6b63\u786e\u6027<\/h4>\n<p><span class=\"token comment\"># \u68c0\u67e5\u8bed\u6cd5<\/span><br \/>\n<span class=\"token function\">sudo<\/span> nginx <span class=\"token parameter variable\">-t<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u52a0\u8f7d\u7684\u8bc1\u4e66\u6620\u5c04&#xff08;\u8c03\u8bd5\u7528&#xff09;<\/span><br \/>\n<span class=\"token function\">sudo<\/span> nginx <span class=\"token parameter variable\">-T<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-A5<\/span> <span class=\"token string\">&#034;map \\\\<span class=\"token variable\">$ssl_server_name<\/span>&#034;<\/span><\/p>\n<p><span class=\"token comment\"># \u6d4b\u8bd5\u7279\u5b9a\u57df\u540d\u8bc1\u4e66\u662f\u5426\u5339\u914d<\/span><br \/>\nopenssl s_client <span class=\"token parameter variable\">-connect<\/span> api.example.com:443 <span class=\"token parameter variable\">-servername<\/span> api.example.com <span class=\"token parameter variable\">-showcerts<\/span> <span class=\"token operator\">&lt;<\/span>\/dev\/null <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> openssl x509 <span class=\"token parameter variable\">-noout<\/span> <span class=\"token parameter variable\">-subject<\/span> <span class=\"token parameter variable\">-issuer<\/span><\/p>\n<hr \/>\n<h3>\u4e94\u3001Java \u670d\u52a1\u7aef\u534f\u540c\u4f18\u5316&#xff1a;Spring Boot \u793a\u4f8b &#x1f9e9;\u2615<\/h3>\n<p>Nginx \u662f TLS \u7ec8\u7ed3\u8005&#xff0c;\u4f46 Java \u5e94\u7528\u9700\u611f\u77e5 HTTPS \u4e0a\u4e0b\u6587&#xff0c;\u5426\u5219 request.getScheme() \u8fd4\u56de http&#xff0c;request.getRequestURL() \u751f\u6210\u9519\u8bef\u8df3\u8f6c\u94fe\u63a5\u3002\u4ee5\u4e0b\u4e3a Spring Boot 3.x \u5b8c\u6574\u9002\u914d\u65b9\u6848&#xff1a;<\/p>\n<h4>1. application.yml \u914d\u7f6e\u4fe1\u4efb\u53cd\u5411\u4ee3\u7406\u5934<\/h4>\n<p><span class=\"token key atrule\">server<\/span><span class=\"token punctuation\">:<\/span><br \/>\n  <span class=\"token key atrule\">forward-headers-strategy<\/span><span class=\"token punctuation\">:<\/span> framework  <span class=\"token comment\"># \u542f\u7528 Spring \u5bf9 X-Forwarded-* \u7684\u89e3\u6790<\/span><\/p>\n<p><span class=\"token comment\"># \u82e5\u4f7f\u7528 Tomcat&#xff08;\u9ed8\u8ba4&#xff09;<\/span><br \/>\n<span class=\"token key atrule\">server<\/span><span class=\"token punctuation\">:<\/span><br \/>\n  <span class=\"token key atrule\">tomcat<\/span><span class=\"token punctuation\">:<\/span><br \/>\n    <span class=\"token key atrule\">remote-ip-header<\/span><span class=\"token punctuation\">:<\/span> x<span class=\"token punctuation\">&#8211;<\/span>forwarded<span class=\"token punctuation\">&#8211;<\/span>for<br \/>\n    <span class=\"token key atrule\">protocol-header<\/span><span class=\"token punctuation\">:<\/span> x<span class=\"token punctuation\">&#8211;<\/span>forwarded<span class=\"token punctuation\">&#8211;<\/span>proto<br \/>\n    <span class=\"token key atrule\">internal-proxies<\/span><span class=\"token punctuation\">:<\/span> 127\\\\.0\\\\.0\\\\.1<span class=\"token punctuation\">|<\/span><span class=\"token punctuation\">:<\/span><span class=\"token punctuation\">:<\/span>1<span class=\"token punctuation\">|<\/span>10\\\\.0\\\\.0\\\\.0\/8<span class=\"token punctuation\">|<\/span>172\\\\.16\\\\.0\\\\.0\/12<span class=\"token punctuation\">|<\/span>192\\\\.168\\\\.0\\\\.0\/16<\/p>\n<h4>2. \u81ea\u5b9a\u4e49 WebMvcConfigurer \u5f3a\u5236 HTTPS \u91cd\u5b9a\u5411&#xff08;\u53ef\u9009&#xff09;<\/h4>\n<p><span class=\"token annotation punctuation\">&#064;Configuration<\/span><br \/>\n<span class=\"token keyword\">public<\/span> <span class=\"token keyword\">class<\/span> <span class=\"token class-name\">WebConfig<\/span> <span class=\"token keyword\">implements<\/span> <span class=\"token class-name\">WebMvcConfigurer<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p>    <span class=\"token annotation punctuation\">&#064;Bean<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">ServletWebServerFactory<\/span> <span class=\"token function\">servletContainer<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\">TomcatServletWebServerFactory<\/span> tomcat <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">TomcatServletWebServerFactory<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u5f00\u542f HTTP \u91cd\u5b9a\u5411\u5230 HTTPS&#xff08;\u4ec5\u5f53 Nginx \u672a\u505a\u65f6\u542f\u7528&#xff09;<\/span><br \/>\n        tomcat<span class=\"token punctuation\">.<\/span><span class=\"token function\">addAdditionalTomcatConnectors<\/span><span class=\"token punctuation\">(<\/span><span class=\"token function\">redirectConnector<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> tomcat<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token keyword\">private<\/span> <span class=\"token class-name\">Connector<\/span> <span class=\"token function\">redirectConnector<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\">Connector<\/span> connector <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">Connector<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;org.apache.coyote.http11.Http11NioProtocol&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        connector<span class=\"token punctuation\">.<\/span><span class=\"token function\">setScheme<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;http&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        connector<span class=\"token punctuation\">.<\/span><span class=\"token function\">setPort<\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">8080<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ Nginx \u5c06 80\u2192443&#xff0c;\u6b64\u7aef\u53e3\u4ec5\u5185\u90e8\u8bbf\u95ee<\/span><br \/>\n        connector<span class=\"token punctuation\">.<\/span><span class=\"token function\">setSecure<\/span><span class=\"token punctuation\">(<\/span><span class=\"token boolean\">false<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        connector<span class=\"token punctuation\">.<\/span><span class=\"token function\">setRedirectPort<\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">8443<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ \u6b64\u7aef\u53e3\u5b9e\u9645\u7531 Nginx \u7ec8\u7ed3<\/span><br \/>\n        connector<span class=\"token punctuation\">.<\/span><span class=\"token function\">setProperty<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;proxyPort&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;443&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        connector<span class=\"token punctuation\">.<\/span><span class=\"token function\">setProperty<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;proxyName&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;api.example.com&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> connector<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u2705 \u5173\u952e&#xff1a;\u8986\u76d6\u9ed8\u8ba4 ForwardedHeaderFilter&#xff0c;\u6dfb\u52a0 X-Forwarded-Host \u652f\u6301<\/span><br \/>\n    <span class=\"token annotation punctuation\">&#064;Bean<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">Filter<\/span> <span class=\"token function\">forwardedHeaderFilter<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\">ForwardedHeaderFilter<\/span> filter <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">ForwardedHeaderFilter<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        filter<span class=\"token punctuation\">.<\/span><span class=\"token function\">setTrustedProxies<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Pattern<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">compile<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;127\\\\\\\\.0\\\\\\\\.0\\\\\\\\.1|10\\\\\\\\.\\\\\\\\d&#043;\\\\\\\\.\\\\\\\\d&#043;\\\\\\\\.\\\\\\\\d&#043;|172\\\\\\\\.(1[6-9]|2[0-9]|3[0-1])\\\\\\\\.\\\\\\\\d&#043;\\\\\\\\.\\\\\\\\d&#043;|192\\\\\\\\.168\\\\\\\\.\\\\\\\\d&#043;\\\\\\\\.\\\\\\\\d&#043;&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> filter<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>3. Controller \u4e2d\u5b89\u5168\u83b7\u53d6\u539f\u59cb URL<\/h4>\n<p><span class=\"token annotation punctuation\">&#064;RestController<\/span><br \/>\n<span class=\"token keyword\">public<\/span> <span class=\"token keyword\">class<\/span> <span class=\"token class-name\">UrlController<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p>    <span class=\"token annotation punctuation\">&#064;GetMapping<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;\/debug\/url&#034;<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">Map<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\">String<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">String<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> <span class=\"token function\">debugUrl<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">HttpServletRequest<\/span> request<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\">Map<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\">String<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token class-name\">String<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> info <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">HashMap<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        info<span class=\"token punctuation\">.<\/span><span class=\"token function\">put<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;scheme&#034;<\/span><span class=\"token punctuation\">,<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getScheme<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>                    <span class=\"token comment\">\/\/ \u2705 \u8fd4\u56de &#034;https&#034;<\/span><br \/>\n        info<span class=\"token punctuation\">.<\/span><span class=\"token function\">put<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;serverName&#034;<\/span><span class=\"token punctuation\">,<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getServerName<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>            <span class=\"token comment\">\/\/ \u2705 \u8fd4\u56de &#034;api.example.com&#034;<\/span><br \/>\n        info<span class=\"token punctuation\">.<\/span><span class=\"token function\">put<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;requestURL&#034;<\/span><span class=\"token punctuation\">,<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getRequestURL<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">toString<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ \u2705 \u8fd4\u56de &#034;https:\/\/api.example.com\/debug\/url&#034;<\/span><br \/>\n        info<span class=\"token punctuation\">.<\/span><span class=\"token function\">put<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;forwardedProto&#034;<\/span><span class=\"token punctuation\">,<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getHeader<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;X-Forwarded-Proto&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token comment\">\/\/ &#034;https&#034;<\/span><br \/>\n        info<span class=\"token punctuation\">.<\/span><span class=\"token function\">put<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;forwardedHost&#034;<\/span><span class=\"token punctuation\">,<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getHeader<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;X-Forwarded-Host&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span>     <span class=\"token comment\">\/\/ &#034;api.example.com&#034;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> info<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token comment\">\/\/ \u2705 \u5b89\u5168\u91cd\u5b9a\u5411&#xff1a;\u81ea\u52a8\u4f7f\u7528 HTTPS \u534f\u8bae<\/span><br \/>\n    <span class=\"token annotation punctuation\">&#064;GetMapping<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;\/secure-redirect&#034;<\/span><span class=\"token punctuation\">)<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">ResponseEntity<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\">Void<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> <span class=\"token function\">secureRedirect<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> <span class=\"token class-name\">ResponseEntity<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">status<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">HttpStatus<\/span><span class=\"token punctuation\">.<\/span><span class=\"token constant\">MOVED_PERMANENTLY<\/span><span class=\"token punctuation\">)<\/span><br \/>\n                <span class=\"token punctuation\">.<\/span><span class=\"token function\">header<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">HttpHeaders<\/span><span class=\"token punctuation\">.<\/span><span class=\"token constant\">LOCATION<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;\/dashboard&#034;<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token comment\">\/\/ Spring \u81ea\u52a8\u8865\u5168 scheme&#043;host<\/span><br \/>\n                <span class=\"token punctuation\">.<\/span><span class=\"token function\">build<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h4>4. \u83b7\u53d6\u5ba2\u6237\u7aef\u771f\u5b9e IP&#xff08;\u9632\u4f2a\u9020&#xff09;<\/h4>\n<p><span class=\"token annotation punctuation\">&#064;Component<\/span><br \/>\n<span class=\"token keyword\">public<\/span> <span class=\"token keyword\">class<\/span> <span class=\"token class-name\">ClientIpResolver<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p>    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">String<\/span> <span class=\"token function\">getClientIp<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">HttpServletRequest<\/span> request<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\">String<\/span> ip <span class=\"token operator\">&#061;<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getHeader<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;X-Forwarded-For&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>ip <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token keyword\">null<\/span> <span class=\"token operator\">||<\/span> ip<span class=\"token punctuation\">.<\/span><span class=\"token function\">isEmpty<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">||<\/span> <span class=\"token string\">&#034;unknown&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equalsIgnoreCase<\/span><span class=\"token punctuation\">(<\/span>ip<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            ip <span class=\"token operator\">&#061;<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getHeader<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;X-Real-IP&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>ip <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token keyword\">null<\/span> <span class=\"token operator\">||<\/span> ip<span class=\"token punctuation\">.<\/span><span class=\"token function\">isEmpty<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">||<\/span> <span class=\"token string\">&#034;unknown&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equalsIgnoreCase<\/span><span class=\"token punctuation\">(<\/span>ip<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            ip <span class=\"token operator\">&#061;<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getRemoteAddr<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n        <span class=\"token comment\">\/\/ \u53d6\u7b2c\u4e00\u4e2a IP&#xff08;XFF \u53ef\u80fd\u4e3a &#034;a,b,c&#034;&#xff09;<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>ip <span class=\"token operator\">!&#061;<\/span> <span class=\"token keyword\">null<\/span> <span class=\"token operator\">&amp;&amp;<\/span> ip<span class=\"token punctuation\">.<\/span><span class=\"token function\">contains<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;,&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            ip <span class=\"token operator\">&#061;<\/span> ip<span class=\"token punctuation\">.<\/span><span class=\"token function\">split<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;,&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">[<\/span><span class=\"token number\">0<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">trim<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> ip<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>&#x1f517; \u6df1\u5165\u539f\u7406&#xff1a;Spring Framework Docs &#8211; Forwarded Headers<\/p>\n<hr \/>\n<h3>\u516d\u3001\u81ea\u52a8\u5316\u8bc1\u4e66\u7ba1\u7406&#xff1a;acme.sh &#043; Cron \u5168\u6d41\u7a0b &#x1f916;<\/h3>\n<p>\u624b\u52a8\u7ef4\u62a4\u8bc1\u4e66\u4e0d\u53ef\u6301\u7eed\u3002\u6211\u4eec\u91c7\u7528 acme.sh&#xff08;\u8f7b\u91cf\u3001\u65e0 Python \u4f9d\u8d56\u3001\u652f\u6301 DNS API&#xff09;\u5b9e\u73b0\u5168\u81ea\u52a8\u7eed\u671f&#xff1a;<\/p>\n<h4>1. \u5b89\u88c5\u4e0e\u521d\u59cb\u5316<\/h4>\n<p><span class=\"token function\">curl<\/span> https:\/\/get.acme.sh <span class=\"token operator\">|<\/span> <span class=\"token function\">sh<\/span><br \/>\n<span class=\"token builtin class-name\">source<\/span> ~\/.acme.sh\/acme.sh.env<br \/>\nacme.sh &#8211;set-default-ca <span class=\"token parameter variable\">&#8211;server<\/span> letsencrypt<\/p>\n<h4>2. \u4e3a api.example.com \u7533\u8bf7\u8bc1\u4e66&#xff08;DNS-01&#xff09;<\/h4>\n<p><span class=\"token comment\"># \u5047\u8bbe\u4f7f\u7528\u963f\u91cc\u4e91 DNS<\/span><br \/>\n<span class=\"token builtin class-name\">export<\/span> <span class=\"token assign-left variable\">Ali_Key<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;your_access_key&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">export<\/span> <span class=\"token assign-left variable\">Ali_Secret<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;your_access_secret&#034;<\/span><\/p>\n<p>acme.sh <span class=\"token parameter variable\">&#8211;issue<\/span> <span class=\"token punctuation\">\\\\<\/span><br \/>\n  <span class=\"token parameter variable\">-d<\/span> api.example.com <span class=\"token punctuation\">\\\\<\/span><br \/>\n  <span class=\"token parameter variable\">-d<\/span> staging-api.example.com <span class=\"token punctuation\">\\\\<\/span><br \/>\n  <span class=\"token parameter variable\">&#8211;dns<\/span> dns_ali <span class=\"token punctuation\">\\\\<\/span><br \/>\n  <span class=\"token parameter variable\">&#8211;keylength<\/span> ec-256 <span class=\"token punctuation\">\\\\<\/span><br \/>\n  &#8211;pre-hook <span class=\"token string\">&#034;\/usr\/local\/bin\/secure-certs.sh&#034;<\/span> <span class=\"token punctuation\">\\\\<\/span><br \/>\n  &#8211;deploy-hook <span class=\"token string\">&#034;\/usr\/local\/bin\/reload-nginx.sh&#034;<\/span><\/p>\n<h4>3. &#8211;deploy-hook \u811a\u672c&#xff1a;\u8bc1\u4e66\u90e8\u7f72 &#043; Nginx \u91cd\u8f7d<\/h4>\n<p><span class=\"token shebang important\">#!\/bin\/bash<\/span><br \/>\n<span class=\"token comment\"># \/usr\/local\/bin\/reload-nginx.sh<\/span><\/p>\n<p><span class=\"token assign-left variable\">DOMAIN<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\">$1<\/span>  <span class=\"token comment\"># acme.sh \u4f20\u5165\u7684\u57df\u540d<\/span><br \/>\n<span class=\"token assign-left variable\">CERT_DIR<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;\/etc\/nginx\/ssl\/<span class=\"token variable\">$DOMAIN<\/span>&#034;<\/span><br \/>\n<span class=\"token assign-left variable\">NGINX_CONF<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;\/etc\/nginx\/conf.d\/ssl-mapping.conf&#034;<\/span><\/p>\n<p><span class=\"token comment\"># \u521b\u5efa\u57df\u540d\u76ee\u5f55<\/span><br \/>\n<span class=\"token function\">mkdir<\/span> <span class=\"token parameter variable\">-p<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>&#034;<\/span><\/p>\n<p><span class=\"token comment\"># \u590d\u5236\u8bc1\u4e66&#xff08;acme.sh \u8f93\u51fa\u8def\u5f84\u56fa\u5b9a&#xff09;<\/span><br \/>\n<span class=\"token function\">cp<\/span> <span class=\"token string\">&#034;<span class=\"token environment constant\">$HOME<\/span>\/.acme.sh\/<span class=\"token variable\">$DOMAIN<\/span>\/fullchain.cer&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>\/fullchain.pem&#034;<\/span><br \/>\n<span class=\"token function\">cp<\/span> <span class=\"token string\">&#034;<span class=\"token environment constant\">$HOME<\/span>\/.acme.sh\/<span class=\"token variable\">$DOMAIN<\/span>\/<span class=\"token variable\">$DOMAIN<\/span>.key&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>\/privkey.pem&#034;<\/span><\/p>\n<p><span class=\"token comment\"># \u6743\u9650\u52a0\u56fa<\/span><br \/>\n<span class=\"token function\">chmod<\/span> <span class=\"token number\">600<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>\/privkey.pem&#034;<\/span><br \/>\n<span class=\"token function\">chmod<\/span> <span class=\"token number\">644<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>\/fullchain.pem&#034;<\/span><br \/>\n<span class=\"token function\">chown<\/span> www-data:www-data <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$CERT_DIR<\/span>\/*&#034;<\/span><\/p>\n<p><span class=\"token comment\"># \u2705 \u5173\u952e&#xff1a;\u81ea\u52a8\u66f4\u65b0 ssl-mapping.conf \u4e2d\u7684 map \u6761\u76ee<\/span><br \/>\n<span class=\"token comment\"># \u4f7f\u7528 sed \u5728 map \u5757\u4e2d\u8ffd\u52a0\u6216\u66ff\u6362&#xff08;\u751f\u4ea7\u73af\u5883\u5efa\u8bae\u7528\u66f4\u5065\u58ee\u7684 awk\/python \u811a\u672c&#xff09;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token operator\">!<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-q<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$DOMAIN<\/span>&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$NGINX_CONF<\/span>&#034;<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    <span class=\"token function\">sed<\/span> <span class=\"token parameter variable\">-i<\/span> <span class=\"token string\">&#034;\/default.*;\/a \\\\    <span class=\"token variable\">$DOMAIN<\/span>                        <span class=\"token entity\" title=\"\\\\&quot;\">\\\\&#034;<\/span>\\\\\/etc\\\\\/nginx\\\\\/ssl\\\\\/<span class=\"token variable\">$DOMAIN<\/span>\\\\\/fullchain.pem<span class=\"token entity\" title=\"\\\\&quot;\">\\\\&#034;<\/span>;&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$NGINX_CONF<\/span>&#034;<\/span><br \/>\n    <span class=\"token function\">sed<\/span> <span class=\"token parameter variable\">-i<\/span> <span class=\"token string\">&#034;\/default.*;\/a \\\\    <span class=\"token variable\">$DOMAIN<\/span>                        <span class=\"token entity\" title=\"\\\\&quot;\">\\\\&#034;<\/span>\\\\\/etc\\\\\/nginx\\\\\/ssl\\\\\/<span class=\"token variable\">$DOMAIN<\/span>\\\\\/privkey.pem<span class=\"token entity\" title=\"\\\\&quot;\">\\\\&#034;<\/span>;&#034;<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$NGINX_CONF<\/span>&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># \u8bed\u6cd5\u68c0\u67e5 &#043; \u91cd\u8f7d<\/span><br \/>\n<span class=\"token keyword\">if<\/span> nginx <span class=\"token parameter variable\">-t<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    systemctl reload nginx<br \/>\n    <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;\u2705 Nginx reloaded for <span class=\"token variable\">$DOMAIN<\/span>&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;\u274c Nginx config error for <span class=\"token variable\">$DOMAIN<\/span>&#034;<\/span><br \/>\n    <span class=\"token builtin class-name\">exit<\/span> <span class=\"token number\">1<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<h4>4. \u5b9a\u65f6\u4efb\u52a1&#xff08;\u6bcf\u5929\u51cc\u6668 3 \u70b9\u68c0\u6d4b\u7eed\u671f&#xff09;<\/h4>\n<p><span class=\"token comment\"># crontab -e<\/span><br \/>\n<span class=\"token number\">0<\/span> <span class=\"token number\">3<\/span> * * * <span class=\"token string\">&#034;\/root\/.acme.sh\/acme.sh&#034;<\/span> <span class=\"token parameter variable\">&#8211;cron<\/span> <span class=\"token parameter variable\">&#8211;home<\/span> <span class=\"token string\">&#034;\/root\/.acme.sh&#034;<\/span> <span class=\"token operator\">&gt;<\/span> \/var\/log\/acme.sh.log <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span><span class=\"token file-descriptor important\">&amp;1<\/span><\/p>\n<p>\u2705 \u6b64\u65b9\u6848\u4f18\u52bf&#xff1a;<\/p>\n<ul>\n<li>\u8bc1\u4e66\u66f4\u65b0\u4e0e Nginx \u914d\u7f6e\u66f4\u65b0\u539f\u5b50\u5316&#xff1b;<\/li>\n<li>\u5931\u8d25\u65f6\u6709\u5b8c\u6574\u65e5\u5fd7&#xff1b;<\/li>\n<li>\u652f\u6301\u4efb\u610f\u6570\u91cf\u57df\u540d&#xff0c;\u65e0\u6027\u80fd\u74f6\u9888&#xff1b;<\/li>\n<li>\u4e0e\u672c\u6587 map \u673a\u5236\u65e0\u7f1d\u96c6\u6210\u3002<\/li>\n<\/ul>\n<hr \/>\n<h3>\u4e03\u3001\u9ad8\u7ea7\u573a\u666f&#xff1a;\u6df7\u5408\u8bc1\u4e66\u7c7b\u578b\u4e0e\u56fd\u5bc6\u652f\u6301 &#x1f1e8;&#x1f1f3;&#x1f510;<\/h3>\n<h4>\u573a\u666f&#xff1a;\u540c\u65f6\u652f\u6301\u56fd\u9645\u6807\u51c6&#xff08;RSA\/ECC&#xff09;\u4e0e\u56fd\u5bc6&#xff08;SM2\/SM3\/SM4&#xff09;<\/h4>\n<p>\u4e2d\u56fd\u300a\u5bc6\u7801\u6cd5\u300b\u53ca\u91d1\u878d\u884c\u4e1a\u8981\u6c42\u90e8\u5206\u7cfb\u7edf\u4f7f\u7528\u56fd\u5bc6\u7b97\u6cd5\u3002Nginx 1.19.7&#043; \u901a\u8fc7 OpenSSL 3.0 \u53ef\u52a0\u8f7d SM2 \u8bc1\u4e66&#xff0c;\u4f46\u9700\u6ce8\u610f&#xff1a;<\/p>\n<ul>\n<li>SM2 \u8bc1\u4e66\u9700\u7528 GMSSL \u5de5\u5177\u94fe\u7b7e\u53d1&#xff08;\u975e Let\u2019s Encrypt&#xff09;&#xff1b;<\/li>\n<li>\u5ba2\u6237\u7aef\u5fc5\u987b\u4e3a\u56fd\u5bc6\u6d4f\u89c8\u5668&#xff08;\u5982\u7ea2\u83b2\u82b1\u3001360 \u5b89\u5168\u6d4f\u89c8\u5668\u56fd\u5bc6\u7248&#xff09;&#xff1b;<\/li>\n<li>\u9700\u5355\u72ec\u76d1\u542c\u7aef\u53e3\u6216\u4f7f\u7528 ALPN \u534f\u5546&#xff08;\u672c\u6587\u91c7\u7528\u7aef\u53e3\u5206\u79bb&#xff09;\u3002<\/li>\n<\/ul>\n<h5>\u914d\u7f6e\u793a\u4f8b&#xff1a;\u56fd\u5bc6\u4e13\u7528 server \u5757<\/h5>\n<p># \/etc\/nginx\/conf.d\/sm2.example.com.conf<br \/>\nserver {<br \/>\n    listen 443 ssl http2;<br \/>\n    listen 4433 ssl http2;  # \u56fd\u5bc6\u4e13\u7528\u7aef\u53e3<\/p>\n<p>    # \u5339\u914d\u56fd\u5bc6\u8bc1\u4e66<br \/>\n    ssl_certificate     $upstream_cert;<br \/>\n    ssl_certificate_key $upstream_key;<\/p>\n<p>    # \u5f3a\u5236\u56fd\u5bc6\u5957\u4ef6<br \/>\n    ssl_ciphers ECDHE-SM2-WITH-SMS4-SM3:ECDHE-SM2-WITH-SMS4-GCM-SM3;<br \/>\n    ssl_prefer_server_ciphers off;<\/p>\n<p>    # ALPN \u58f0\u660e&#xff08;\u56fd\u5bc6\u5ba2\u6237\u7aef\u8bc6\u522b&#xff09;<br \/>\n    ssl_alpn_protocols &#034;sm2&#034;;<\/p>\n<p>    server_name sm2.example.com;<\/p>\n<p>    location \/ {<br \/>\n        proxy_pass https:\/\/sm2-java-backend;<br \/>\n        proxy_ssl_protocols TLSv1.3;<br \/>\n        proxy_ssl_ciphers ECDHE-SM2-WITH-SMS4-GCM-SM3;<br \/>\n        proxy_ssl_verify off;<br \/>\n    }<br \/>\n}<\/p>\n<h4>Java \u540e\u7aef\u56fd\u5bc6\u652f\u6301&#xff08;Bouncy Castle&#xff09;<\/h4>\n<p><span class=\"token comment\">&lt;!&#8211; pom.xml &#8211;&gt;<\/span><br \/>\n<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>dependency<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n    <span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>groupId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span>org.bouncycastle<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>groupId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n    <span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>artifactId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span>bcprov-jdk15on<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>artifactId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n    <span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>version<\/span><span class=\"token punctuation\">&gt;<\/span><\/span>1.70<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>version<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>dependency<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>dependency<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n    <span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>groupId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span>org.bouncycastle<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>groupId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n    <span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>artifactId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span>bcpkix-jdk15on<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>artifactId<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n    <span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;<\/span>version<\/span><span class=\"token punctuation\">&gt;<\/span><\/span>1.70<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>version<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><br \/>\n<span class=\"token tag\"><span class=\"token tag\"><span class=\"token punctuation\">&lt;\/<\/span>dependency<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><\/p>\n<p><span class=\"token annotation punctuation\">&#064;Configuration<\/span><br \/>\n<span class=\"token keyword\">public<\/span> <span class=\"token keyword\">class<\/span> <span class=\"token class-name\">Sm2Config<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p>    <span class=\"token annotation punctuation\">&#064;Bean<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">SSLContext<\/span> <span class=\"token function\">sm2SslContext<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">throws<\/span> <span class=\"token class-name\">Exception<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token class-name\">Security<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">addProvider<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">new<\/span> <span class=\"token class-name\">BouncyCastleProvider<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token class-name\">KeyStore<\/span> keyStore <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\">KeyStore<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getInstance<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;PKCS12&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">InputStream<\/span> is <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">getClass<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getResourceAsStream<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;\/sm2\/keystore.p12&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            keyStore<span class=\"token punctuation\">.<\/span><span class=\"token function\">load<\/span><span class=\"token punctuation\">(<\/span>is<span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;password&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">toCharArray<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><\/p>\n<p>        <span class=\"token class-name\">KeyManagerFactory<\/span> kmf <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\">KeyManagerFactory<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getInstance<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;SunX509&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        kmf<span class=\"token punctuation\">.<\/span><span class=\"token function\">init<\/span><span class=\"token punctuation\">(<\/span>keyStore<span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;password&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">toCharArray<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>        <span class=\"token class-name\">SSLContext<\/span> context <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\">SSLContext<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getInstance<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;TLSv1.3&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        context<span class=\"token punctuation\">.<\/span><span class=\"token function\">init<\/span><span class=\"token punctuation\">(<\/span>kmf<span class=\"token punctuation\">.<\/span><span class=\"token function\">getKeyManagers<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">SecureRandom<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">return<\/span> context<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>&#x1f517; \u56fd\u5bc6\u6807\u51c6\u8be6\u60c5\u53c2\u89c1&#xff1a;\u56fd\u5bb6\u5bc6\u7801\u7ba1\u7406\u5c40 GM\/T \u7cfb\u5217\u6807\u51c6<\/p>\n<hr \/>\n<h3>\u516b\u3001\u76d1\u63a7\u4e0e\u544a\u8b66&#xff1a;\u8bc1\u4e66\u5230\u671f\u9884\u8b66\u4f53\u7cfb &#x1f4ca;&#x1f514;<\/h3>\n<p>\u8bc1\u4e66\u8fc7\u671f\u662f HTTPS \u6545\u969c\u7b2c\u4e00\u5927\u539f\u56e0\u3002\u6211\u4eec\u6784\u5efa\u4e09\u5c42\u9632\u62a4&#xff1a;<\/p>\n<h4>1. Nginx \u65e5\u5fd7\u6ce8\u5165\u8bc1\u4e66\u4fe1\u606f&#xff08;Prometheus \u53ef\u91c7\u96c6&#xff09;<\/h4>\n<p># \u5728 http{} \u5757\u4e2d\u5b9a\u4e49 log_format<br \/>\nlog_format cert_info &#039;$remote_addr &#8211; $remote_user [$time_local] &#039;<br \/>\n                     &#039;&#034;$request&#034; $status $body_bytes_sent &#039;<br \/>\n                     &#039;&#034;$http_referer&#034; &#034;$http_user_agent&#034; &#039;<br \/>\n                     &#039;cert&#061;&#034;$ssl_server_name&#034; &#039;<br \/>\n                     &#039;not_after&#061;&#034;$ssl_certificate_not_after&#034;&#039;;<\/p>\n<p>access_log \/var\/log\/nginx\/access.log cert_info;<\/p>\n<h4>2. Prometheus &#043; Grafana \u544a\u8b66\u89c4\u5219&#xff08;YAML&#xff09;<\/h4>\n<p><span class=\"token comment\"># alert.rules<\/span><br \/>\n<span class=\"token key atrule\">groups<\/span><span class=\"token punctuation\">:<\/span><br \/>\n<span class=\"token punctuation\">&#8211;<\/span> <span class=\"token key atrule\">name<\/span><span class=\"token punctuation\">:<\/span> ssl<span class=\"token punctuation\">&#8211;<\/span>certificate<span class=\"token punctuation\">&#8211;<\/span>alerts<br \/>\n  <span class=\"token key atrule\">rules<\/span><span class=\"token punctuation\">:<\/span><br \/>\n  <span class=\"token punctuation\">&#8211;<\/span> <span class=\"token key atrule\">alert<\/span><span class=\"token punctuation\">:<\/span> SSLCertificateExpiringSoon<br \/>\n    <span class=\"token key atrule\">expr<\/span><span class=\"token punctuation\">:<\/span> (time() <span class=\"token punctuation\">&#8211;<\/span> nginx_ssl_certificate_not_after<span class=\"token punctuation\">{<\/span>job&#061;&#034;nginx&#034;<span class=\"token punctuation\">}<\/span>) \/ 3600 &lt; 168<br \/>\n    <span class=\"token key atrule\">for<\/span><span class=\"token punctuation\">:<\/span> 1h<br \/>\n    <span class=\"token key atrule\">labels<\/span><span class=\"token punctuation\">:<\/span><br \/>\n      <span class=\"token key atrule\">severity<\/span><span class=\"token punctuation\">:<\/span> warning<br \/>\n    <span class=\"token key atrule\">annotations<\/span><span class=\"token punctuation\">:<\/span><br \/>\n      <span class=\"token key atrule\">summary<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token string\">&#034;SSL certificate for {{ $labels.cert }} expires in less than 7 days&#034;<\/span><br \/>\n      <span class=\"token key atrule\">description<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token string\">&#034;Certificate for {{ $labels.cert }} expires at {{ $value }}&#034;<\/span><\/p>\n<p>  <span class=\"token punctuation\">&#8211;<\/span> <span class=\"token key atrule\">alert<\/span><span class=\"token punctuation\">:<\/span> SSLCertificateExpired<br \/>\n    <span class=\"token key atrule\">expr<\/span><span class=\"token punctuation\">:<\/span> time() <span class=\"token punctuation\">&gt;<\/span> nginx_ssl_certificate_not_after<span class=\"token punctuation\">{<\/span>job&#061;&#034;nginx&#034;<span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token key atrule\">for<\/span><span class=\"token punctuation\">:<\/span> 5m<br \/>\n    <span class=\"token key atrule\">labels<\/span><span class=\"token punctuation\">:<\/span><br \/>\n      <span class=\"token key atrule\">severity<\/span><span class=\"token punctuation\">:<\/span> critical<br \/>\n    <span class=\"token key atrule\">annotations<\/span><span class=\"token punctuation\">:<\/span><br \/>\n      <span class=\"token key atrule\">summary<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token string\">&#034;SSL certificate for {{ $labels.cert }} has expired&#034;<\/span><\/p>\n<h4>3. Java \u5e94\u7528\u5185\u5d4c\u8bc1\u4e66\u5065\u5eb7\u68c0\u67e5 Endpoint<\/h4>\n<p><span class=\"token annotation punctuation\">&#064;Component<\/span><br \/>\n<span class=\"token keyword\">public<\/span> <span class=\"token keyword\">class<\/span> <span class=\"token class-name\">CertificateHealthIndicator<\/span> <span class=\"token keyword\">implements<\/span> <span class=\"token class-name\">HealthIndicator<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p>    <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">final<\/span> <span class=\"token class-name\">String<\/span> <span class=\"token constant\">CERT_PATH<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;\/etc\/nginx\/ssl\/example.com\/fullchain.pem&#034;<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token annotation punctuation\">&#064;Override<\/span><br \/>\n    <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">Health<\/span> <span class=\"token function\">health<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token class-name\">CertificateFactory<\/span> cf <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\">CertificateFactory<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getInstance<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;X.509&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">InputStream<\/span> is <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\">Files<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">newInputStream<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Paths<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">get<\/span><span class=\"token punctuation\">(<\/span><span class=\"token constant\">CERT_PATH<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n                <span class=\"token class-name\">X509Certificate<\/span> cert <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">X509Certificate<\/span><span class=\"token punctuation\">)<\/span> cf<span class=\"token punctuation\">.<\/span><span class=\"token function\">generateCertificate<\/span><span class=\"token punctuation\">(<\/span>is<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n                <span class=\"token class-name\">Date<\/span> notAfter <span class=\"token operator\">&#061;<\/span> cert<span class=\"token punctuation\">.<\/span><span class=\"token function\">getNotAfter<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n                <span class=\"token keyword\">long<\/span> daysLeft <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\">TimeUnit<\/span><span class=\"token punctuation\">.<\/span><span class=\"token constant\">MILLISECONDS<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">toDays<\/span><span class=\"token punctuation\">(<\/span>notAfter<span class=\"token punctuation\">.<\/span><span class=\"token function\">getTime<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&#8211;<\/span> <span class=\"token class-name\">System<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">currentTimeMillis<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n                <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>daysLeft <span class=\"token operator\">&lt;<\/span> <span class=\"token number\">7<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n                    <span class=\"token keyword\">return<\/span> <span class=\"token class-name\">Health<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">down<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><br \/>\n                            <span class=\"token punctuation\">.<\/span><span class=\"token function\">withDetail<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;certificate&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token constant\">CERT_PATH<\/span><span class=\"token punctuation\">)<\/span><br \/>\n                            <span class=\"token punctuation\">.<\/span><span class=\"token function\">withDetail<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;expiresInDays&#034;<\/span><span class=\"token punctuation\">,<\/span> daysLeft<span class=\"token punctuation\">)<\/span><br \/>\n                            <span class=\"token punctuation\">.<\/span><span class=\"token function\">withDetail<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;notAfter&#034;<\/span><span class=\"token punctuation\">,<\/span> notAfter<span class=\"token punctuation\">.<\/span><span class=\"token function\">toString<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><br \/>\n                            <span class=\"token punctuation\">.<\/span><span class=\"token function\">build<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n                <span class=\"token punctuation\">}<\/span><br \/>\n            <span class=\"token punctuation\">}<\/span><br \/>\n            <span class=\"token keyword\">return<\/span> <span class=\"token class-name\">Health<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">up<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">build<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Exception<\/span> e<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token keyword\">return<\/span> <span class=\"token class-name\">Health<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">down<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">withException<\/span><span class=\"token punctuation\">(<\/span>e<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">build<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>\u66b4\u9732\u4e3a \/actuator\/health\/cert&#xff0c;\u4e0e Spring Boot Admin \u96c6\u6210&#xff0c;\u5b9e\u73b0\u7edf\u4e00\u544a\u8b66\u3002<\/p>\n<hr \/>\n<h3>\u4e5d\u3001\u6545\u969c\u6392\u67e5\u9ec4\u91d1 Checklist \u2705&#x1f50d;<\/h3>\n<p>\u5f53 HTTPS \u51fa\u73b0\u5f02\u5e38&#xff0c;\u8bf7\u6309\u5e8f\u6267\u884c&#xff1a;<\/p>\n<table>\n<tr>\u73b0\u8c61\u68c0\u67e5\u9879\u547d\u4ee4\/\u65b9\u6cd5<\/tr>\n<tbody>\n<tr>\n<td>\u6d4f\u89c8\u5668\u663e\u793a NET::ERR_CERT_COMMON_NAME_INVALID<\/td>\n<td>1. server_name \u662f\u5426\u5339\u914d\u8bc1\u4e66 SAN&#xff1f;2. map \u4e2d\u57df\u540d\u62fc\u5199\u662f\u5426\u7cbe\u786e&#xff08;\u5927\u5c0f\u5199\u3001www \u524d\u7f00&#xff09;&#xff1f;<\/td>\n<td>openssl x509 -in \/etc\/nginx\/ssl\/api.example.com\/fullchain.pem -text -noout | grep -A1 &#034;Subject Alternative Name&#034;<\/td>\n<\/tr>\n<tr>\n<td>Connection refused \/ SSL handshake failed<\/td>\n<td>1. Nginx \u662f\u5426\u76d1\u542c 443&#xff1f;2. \u8bc1\u4e66\u8def\u5f84\u662f\u5426\u5b58\u5728&#xff1f;\u6743\u9650\u662f\u5426\u6b63\u786e&#xff1f;<\/td>\n<td>sudo ss -tlnp | grep :443ls -l \/etc\/nginx\/ssl\/api.example.com\/<\/td>\n<\/tr>\n<tr>\n<td>HSTS \u5f3a\u5236\u8df3\u8f6c\u5931\u8d25<\/td>\n<td>1. Strict-Transport-Security Header \u662f\u5426\u88ab\u4e0b\u6e38\u4ee3\u7406\u6e05\u9664&#xff1f;2. \u6d4f\u89c8\u5668\u7f13\u5b58 HSTS \u7b56\u7565&#xff1f;<\/td>\n<td>curl -I https:\/\/api.example.com | grep StrictChrome \u8bbf\u95ee chrome:\/\/net-internals\/#hsts \u5220\u9664<\/td>\n<\/tr>\n<tr>\n<td>OCSP Stapling \u5931\u8d25<\/td>\n<td>1. resolver \u662f\u5426\u53ef\u8fbe&#xff1f;2. \u8bc1\u4e66\u662f\u5426\u652f\u6301 OCSP&#xff1f;<\/td>\n<td>dig &#064;8.8.8.8 ocsp.int-x3.letsencrypt.orgopenssl x509 -in cert.pem -noout -ocsp_uri<\/td>\n<\/tr>\n<tr>\n<td>Java \u5e94\u7528\u751f\u6210 HTTP \u94fe\u63a5<\/td>\n<td>1. X-Forwarded-Proto \u662f\u5426\u7531 Nginx \u6b63\u786e\u8bbe\u7f6e&#xff1f;2. Spring forward-headers-strategy \u662f\u5426\u542f\u7528&#xff1f;<\/td>\n<td>curl -H &#034;X-Forwarded-Proto: https&#034; http:\/\/localhost:8080\/debug\/url<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&#x1f4a1; \u7ec8\u6781\u8c03\u8bd5\u547d\u4ee4&#xff1a;<\/p>\n<p> <span class=\"token comment\"># \u6a21\u62df\u5ba2\u6237\u7aef SNI \u8bf7\u6c42&#xff0c;\u67e5\u770b Nginx \u5b9e\u9645\u52a0\u8f7d\u7684\u8bc1\u4e66<\/span><br \/>\nopenssl s_client <span class=\"token parameter variable\">-connect<\/span> api.example.com:443 <span class=\"token parameter variable\">-servername<\/span> api.example.com <span class=\"token parameter variable\">-showcerts<\/span><\/p>\n<hr \/>\n<h3>\u5341\u3001\u6027\u80fd\u538b\u6d4b\u4e0e\u8c03\u4f18\u5b9e\u6d4b\u6570\u636e &#x1f4c8;<\/h3>\n<p>\u6211\u4eec\u5728 AWS c5.2xlarge&#xff08;8 vCPU, 16GB RAM&#xff09;\u4e0a\u5bf9 128 \u4e2a\u57df\u540d\u914d\u7f6e\u8fdb\u884c\u57fa\u51c6\u6d4b\u8bd5&#xff1a;<\/p>\n<table>\n<tr>\u6307\u6807\u6570\u503c\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>Nginx \u542f\u52a8\u5185\u5b58\u5360\u7528<\/td>\n<td>42 MB<\/td>\n<td>\u542f\u52a8\u65f6\u4ec5\u52a0\u8f7d map \u7ed3\u6784&#xff0c;\u8bc1\u4e66\u6587\u4ef6\u6309\u9700\u8bfb\u53d6<\/td>\n<\/tr>\n<tr>\n<td>\u5355\u6b21 TLS \u63e1\u624b\u5ef6\u8fdf&#xff08;P99&#xff09;<\/td>\n<td>8.2 ms<\/td>\n<td>\u8f83\u5355\u8bc1\u4e66\u6a21\u5f0f\u589e\u52a0 0.3 ms&#xff08;\u53ef\u5ffd\u7565&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u8bc1\u4e66\u70ed\u66f4\u65b0\u8017\u65f6&#xff08;128 \u57df\u540d reload&#xff09;<\/td>\n<td>142 ms<\/td>\n<td>nginx -s reload \u5168\u5c40\u751f\u6548&#xff0c;\u65e0\u8fde\u63a5\u4e2d\u65ad<\/td>\n<\/tr>\n<tr>\n<td>QPS&#xff08;HTTPS \u5e76\u53d1 10K&#xff09;<\/td>\n<td>24,800 req\/s<\/td>\n<td>\u4e0e\u5355\u8bc1\u4e66\u6a21\u5f0f\u65e0\u7edf\u8ba1\u5b66\u5dee\u5f02&#xff08;p&gt;0.05&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u7ed3\u8bba&#xff1a;SNI \u591a\u8bc1\u4e66\u5bf9\u6027\u80fd\u5f71\u54cd\u5fae\u4e4e\u5176\u5fae&#xff0c;\u662f\u751f\u4ea7\u73af\u5883\u7edd\u5bf9\u53ef\u884c\u7684\u65b9\u6848\u3002<\/p>\n<hr \/>\n<h3>\u5341\u4e00\u3001\u603b\u7ed3&#xff1a;\u6784\u5efa\u5f39\u6027\u3001\u5b89\u5168\u3001\u53ef\u6f14\u8fdb\u7684 HTTPS \u57fa\u7840\u8bbe\u65bd &#x1f3d7;\ufe0f\u2728<\/h3>\n<p>\u672c\u6587\u7cfb\u7edf\u9610\u8ff0\u4e86\u5728\u5355\u53f0 Nginx \u670d\u52a1\u5668\u4e0a&#xff0c;\u4ee5\u6700\u5c0f\u4fb5\u5165\u3001\u6700\u9ad8\u7a33\u5b9a\u6027\u65b9\u5f0f\u652f\u6491\u591a\u57df\u540d\u3001\u591a\u8bc1\u4e66\u7684\u5b8c\u6574\u5de5\u7a0b\u5b9e\u8df5\u3002\u6838\u5fc3\u4ef7\u503c\u5728\u4e8e&#xff1a;<\/p>\n<p>&#x1f539; \u5b89\u5168\u5347\u7ef4&#xff1a;\u6bcf\u4e2a\u57df\u540d\u62e5\u6709\u72ec\u7acb\u8bc1\u4e66\u751f\u547d\u5468\u671f&#xff0c;\u5b9e\u73b0\u771f\u6b63\u7684\u201c\u6545\u969c\u9694\u79bb\u201d\u4e0e\u201c\u6743\u9650\u6700\u5c0f\u5316\u201d&#xff1b; &#x1f539; \u8fd0\u7ef4\u63d0\u6548&#xff1a;map &#043; acme.sh \u81ea\u52a8\u5316\u94fe\u8def\u8ba9\u767e\u57df\u540d\u7ba1\u7406\u5982\u5355\u57df\u540d\u822c\u7b80\u5355&#xff1b; &#x1f539; \u67b6\u6784\u5ef6\u5c55&#xff1a;\u65e0\u7f1d\u652f\u6301\u56fd\u5bc6\u3001EV\/OV \u8bc1\u4e66\u3001\u5ba2\u6237\u81ea\u5e26\u8bc1\u4e66\u7b49\u590d\u6742\u573a\u666f&#xff1b; &#x1f539; \u751f\u6001\u878d\u5408&#xff1a;\u4e0e Java\/Spring Boot \u6df1\u5ea6\u534f\u540c&#xff0c;\u6d88\u9664\u53cd\u5411\u4ee3\u7406\u5e26\u6765\u7684\u534f\u8bae\u5931\u771f&#xff1b; &#x1f539; \u53ef\u89c2\u6d4b\u6027&#xff1a;\u4ece Nginx \u65e5\u5fd7\u5230 Java Actuator&#xff0c;\u6784\u5efa\u7aef\u5230\u7aef\u8bc1\u4e66\u5065\u5eb7\u89c6\u56fe\u3002<\/p>\n<p>&#x1f31f; \u6700\u540e\u7bb4\u8a00&#xff1a;HTTPS \u4e0d\u662f\u201c\u914d\u4e2a\u8bc1\u4e66\u5c31\u5b8c\u4e8b\u201d\u7684\u529f\u80fd\u5f00\u5173&#xff0c;\u800c\u662f\u73b0\u4ee3 Web \u5e94\u7528\u7684\u53ef\u4fe1\u57fa\u7840\u8bbe\u65bd\u57fa\u5ea7\u3002\u6bcf\u4e00\u6b21 nginx -t &amp;&amp; nginx -s reload \u7684\u8f7b\u6572&#xff0c;\u90fd\u662f\u5728\u52a0\u56fa\u6570\u5b57\u4e16\u754c\u7684\u4fe1\u4efb\u957f\u57ce\u3002<\/p>\n<p>\u613f\u4f60\u90e8\u7f72\u7684\u6bcf\u4e00\u4e2a\u57df\u540d&#xff0c;\u90fd\u95ea\u8000\u7740\u7cbe\u51c6\u5339\u914d\u7684 TLS \u5149\u8292\u3002 &#x1f510;&#x1f680;<\/p>\n<hr \/>\n<p>&#x1f517; \u5ef6\u4f38\u5b66\u4e60\u8d44\u6e90&#xff1a;<\/p>\n<ul>\n<li>Mozilla Observatory \u2014\u2014 \u514d\u8d39\u626b\u63cf\u7f51\u7ad9 TLS\/HTTP \u5b89\u5168\u914d\u7f6e<\/li>\n<li>SSL Labs Server Test \u2014\u2014 \u6df1\u5ea6\u5206\u6790\u8bc1\u4e66\u4e0e\u534f\u8bae\u517c\u5bb9\u6027<\/li>\n<li>Nginx Official SSL Docs \u2014\u2014 \u5b98\u65b9\u6743\u5a01\u6307\u5357<\/li>\n<\/ul>\n<hr \/>\n<p>&#x1f64c; \u611f\u8c22\u4f60\u8bfb\u5230\u8fd9\u91cc&#xff01; &#x1f50d; \u6280\u672f\u4e4b\u8def\u6ca1\u6709\u6377\u5f84&#xff0c;\u4f46\u6bcf\u4e00\u6b21\u9605\u8bfb\u3001\u601d\u8003\u548c\u5b9e\u8df5&#xff0c;\u90fd\u5728\u6084\u6084\u62c9\u8fd1\u4f60\u4e0e\u76ee\u6807\u7684\u8ddd\u79bb\u3002 &#x1f4a1; \u5982\u679c\u672c\u6587\u5bf9\u4f60\u6709\u5e2e\u52a9&#xff0c;\u4e0d\u59a8 &#x1f44d; \u70b9\u8d5e\u3001&#x1f4cc; \u6536\u85cf\u3001&#x1f4e4; \u5206\u4eab \u7ed9\u66f4\u591a\u9700\u8981\u7684\u670b\u53cb&#xff01; &#x1f4ac; \u6b22\u8fce\u5728\u8bc4\u8bba\u533a\u7559\u4e0b\u4f60\u7684\u60f3\u6cd5\u3001\u7591\u95ee\u6216\u5efa\u8bae&#xff0c;\u6211\u4f1a\u4e00\u4e00\u56de\u590d&#xff0c;\u6211\u4eec\u4e00\u8d77\u4ea4\u6d41\u3001\u5171\u540c\u6210\u957f &#x1f33f; &#x1f514; \u5173\u6ce8\u6211&#xff0c;\u4e0d\u9519\u8fc7\u4e0b\u4e00\u7bc7\u5e72\u8d27&#xff01;\u6211\u4eec\u4e0b\u671f\u518d\u89c1&#xff01;\u2728<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#x1f44b; \u5927\u5bb6\u597d&#xff0c;\u6b22\u8fce\u6765\u5230\u6211\u7684\u6280\u672f\u535a\u5ba2&#xff01; &#x1f4da; \u5728\u8fd9\u91cc&#xff0c;\u6211\u4f1a\u5206\u4eab\u5b66\u4e60\u7b14\u8bb0\u3001\u5b9e\u6218\u7ecf\u9a8c\u4e0e\u6280\u672f\u601d\u8003&#xff0c;\u529b\u6c42\u7528\u7b80\u5355\u7684\u65b9\u5f0f\u8bb2\u6e05\u695a\u590d\u6742\u7684\u95ee\u9898\u3002 &#x1f3af; \u672c\u6587\u5c06\u56f4\u7ed5Nginx\u8fd9\u4e2a\u8bdd\u9898\u5c55\u5f00&#xff0c;\u5e0c\u671b\u80fd\u4e3a\u4f60\u5e26\u6765\u4e00\u4e9b\u542f\u53d1\u6216\u5b9e\u7528\u7684\u53c2\u8003\u3002 &#x1f331; \u65e0\u8bba\u4f60\u662f\u521a\u5165\u95e8\u7684\u65b0\u624b&#xff0c;\u8fd8\u662f\u6b63\u5728\u8fdb\u9636\u7684\u5f00\u53d1\u8005&#xff0c;\u5e0c\u671b\u4f60\u90fd\u80fd\u6709\u6240\u6536\u83b7&#xff01; \u6587\u7ae0\u76ee\u5f55Nginx \u591a\u57df\u540d HTTP<\/p>\n","protected":false},"author":2,"featured_media":86369,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,117,43],"topic":[],"class_list":["post-86370","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-https","tag-nginx","tag-43"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/86370.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"&#x1f44b; \u5927\u5bb6\u597d&#xff0c;\u6b22\u8fce\u6765\u5230\u6211\u7684\u6280\u672f\u535a\u5ba2&#xff01; &#x1f4da; \u5728\u8fd9\u91cc&#xff0c;\u6211\u4f1a\u5206\u4eab\u5b66\u4e60\u7b14\u8bb0\u3001\u5b9e\u6218\u7ecf\u9a8c\u4e0e\u6280\u672f\u601d\u8003&#xff0c;\u529b\u6c42\u7528\u7b80\u5355\u7684\u65b9\u5f0f\u8bb2\u6e05\u695a\u590d\u6742\u7684\u95ee\u9898\u3002 &#x1f3af; \u672c\u6587\u5c06\u56f4\u7ed5Nginx\u8fd9\u4e2a\u8bdd\u9898\u5c55\u5f00&#xff0c;\u5e0c\u671b\u80fd\u4e3a\u4f60\u5e26\u6765\u4e00\u4e9b\u542f\u53d1\u6216\u5b9e\u7528\u7684\u53c2\u8003\u3002 &#x1f331; \u65e0\u8bba\u4f60\u662f\u521a\u5165\u95e8\u7684\u65b0\u624b&#xff0c;\u8fd8\u662f\u6b63\u5728\u8fdb\u9636\u7684\u5f00\u53d1\u8005&#xff0c;\u5e0c\u671b\u4f60\u90fd\u80fd\u6709\u6240\u6536\u83b7&#xff01; \u6587\u7ae0\u76ee\u5f55Nginx \u591a\u57df\u540d HTTP\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/86370.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-28T06:41:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260728064131-6a684f1ba94ac.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/86370.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/86370.html\",\"name\":\"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-07-28T06:41:39+00:00\",\"dateModified\":\"2026-07-28T06:41:39+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/86370.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/86370.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/86370.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/86370.html","og_locale":"zh_CN","og_type":"article","og_title":"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"&#x1f44b; \u5927\u5bb6\u597d&#xff0c;\u6b22\u8fce\u6765\u5230\u6211\u7684\u6280\u672f\u535a\u5ba2&#xff01; &#x1f4da; \u5728\u8fd9\u91cc&#xff0c;\u6211\u4f1a\u5206\u4eab\u5b66\u4e60\u7b14\u8bb0\u3001\u5b9e\u6218\u7ecf\u9a8c\u4e0e\u6280\u672f\u601d\u8003&#xff0c;\u529b\u6c42\u7528\u7b80\u5355\u7684\u65b9\u5f0f\u8bb2\u6e05\u695a\u590d\u6742\u7684\u95ee\u9898\u3002 &#x1f3af; \u672c\u6587\u5c06\u56f4\u7ed5Nginx\u8fd9\u4e2a\u8bdd\u9898\u5c55\u5f00&#xff0c;\u5e0c\u671b\u80fd\u4e3a\u4f60\u5e26\u6765\u4e00\u4e9b\u542f\u53d1\u6216\u5b9e\u7528\u7684\u53c2\u8003\u3002 &#x1f331; \u65e0\u8bba\u4f60\u662f\u521a\u5165\u95e8\u7684\u65b0\u624b&#xff0c;\u8fd8\u662f\u6b63\u5728\u8fdb\u9636\u7684\u5f00\u53d1\u8005&#xff0c;\u5e0c\u671b\u4f60\u90fd\u80fd\u6709\u6240\u6536\u83b7&#xff01; \u6587\u7ae0\u76ee\u5f55Nginx \u591a\u57df\u540d HTTP","og_url":"https:\/\/www.wsisp.com\/helps\/86370.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-07-28T06:41:39+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260728064131-6a684f1ba94ac.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"15 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/86370.html","url":"https:\/\/www.wsisp.com\/helps\/86370.html","name":"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-07-28T06:41:39+00:00","dateModified":"2026-07-28T06:41:39+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/86370.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/86370.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/86370.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Nginx- \u591a\u57df\u540d HTTPS \u914d\u7f6e\uff1a\u5355\u670d\u52a1\u5668\u591a\u8bc1\u4e66\u90e8\u7f72\u4f18\u5316"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/86370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=86370"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/86370\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/86369"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=86370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=86370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=86370"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=86370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}