Golang + nginx + https（安全套接层）

huangapple
go评论129阅读模式
英文:

Golang + nginx + https

问题

我已经将您提供的内容翻译成中文，如下所示：

我有一个服务器，作为监听器使用Go来处理http和https请求。我已经配置了Nginx来处理传入的http和https请求，并且证书也是正确的。

当我使用单独的服务器在https协议上运行时，查询结果完全正常。然而，当我使用nginx进行代理时，https无法从服务器获取响应，而服务器Go会报错：

> "http: TLS handshake error from 127.0.0.1:54037: tls: first record
> does not look like a TLS handshake

可能是什么问题呢？

Go客户端代码：

  1. package main
  3. import (
  4. 	"net/http"
  5. 	"log"
  7. )
  9. func HelloSSLServer(w http.ResponseWriter, req *http.Request) {
  10. 	w.Header().Set("Content-Type", "text/plain")
  11. 	w.Write([]byte("This is an example server.\n"))
  12. 	// fmt.Fprintf(w, "This is an example server.\n")
  13. 	// io.WriteString(w, "This is an example server.\n")
  14. }
  16. func main() {
  17. 	http.HandleFunc("/", HelloSSLServer)
  18. 	go http.ListenAndServe("192.168.1.2:80", nil)
  19. 	err := http.ListenAndServeTLS("localhost:9007", "/etc/letsencrypt/live/somedomain/fullchain.pem", "/etc/letsencrypt/live/somedomain/privkey.pem", nil)
  21. 	if err != nil {
  22. 		log.Fatal("ListenAndServe: ", err)
  23. 	}
  24. }

Nginx配置文件：

  1. server {
  2.     listen       192.168.1.2:80;
  3.     server_name   somedomain;
  4.     rewrite ^ https://$host$request_uri? permanent;    
  5. }
  6. server {
  7.     listen        192.168.1.2:443 ssl;
  8.     server_name   somedomain;
  9.     access_log    /var/log/nginx/dom_access.log;
  10.     error_log     /var/log/nginx/dom_error.log;
  11.     ssl_certificate     /stuff/ssl/domain.cert;
  12.     ssl_certificate_key /stuff/ssl/private.cert;
  13.     ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  14.     ssl_ciphers         ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
  16.     location / {
  17.         proxy_pass http://localhost:9007;
  18.         proxy_cookie_domain localhost somedomain;
  19.         proxy_buffering off;
  21.         proxy_http_version 1.1;
  22.         proxy_set_header Host $host;
  23.         proxy_set_header X-Real-IP $remote_addr;
  24.         proxy_set_header Client-IP $remote_addr;
  25.         proxy_set_header X-Forwarded-For $remote_addr;
  26.     }
  27. }

希望对您有所帮助！如果您有任何其他问题，请随时提问。

英文:

I have - Go to the server as a listener http and https. Nginx configured to process incoming requests for http + https. Certificates in order.
Using separate servers runs perfectly on the results of queries to them on https protocol. However, when I use a proxying nginx https is not getting a response from the server and the server Go

> "http: TLS handshake error from 127.0.0.1:54037: tls: first record
> does not look like a TLS handshake

What could be the problem?

Client Go:

  1. package main
  3. import (
  4. 	"net/http"
  5. 	"log"
  7. )
  9. func HelloSSLServer(w http.ResponseWriter, req *http.Request) {
  10. 	w.Header().Set("Content-Type", "text/plain")
  11. 	w.Write([]byte("This is an example server.\n"))
  12. 	// fmt.Fprintf(w, "This is an example server.\n")
  13. 	// io.WriteString(w, "This is an example server.\n")
  14. }
  16. func main() {
  17. 	http.HandleFunc("/", HelloSSLServer)
  18. 	go http.ListenAndServe("192.168.1.2:80", nil)
  19. 	err := http.ListenAndServeTLS("localhost:9007", "/etc/letsencrypt/live/somedomain/fullchain.pem", "/etc/letsencrypt/live/somedomain/privkey.pem", nil)
  21. 	if err != nil {
  22. 		log.Fatal("ListenAndServe: ", err)
  23. 	}
  24. }

Nginx config:

  1. server {
  2.     listen       192.168.1.2:80;
  3.     server_name   somedomain;
  4.     rewrite ^ https://$host$request_uri? permanent;    
  5. }
  6. server {
  7.     listen        192.168.1.2:443 ssl;
  8.     server_name   somedomain;
  9.     access_log    /var/log/nginx/dom_access.log;
  10.     error_log     /var/log/nginx/dom_error.log;
  11.     ssl_certificate     /stuff/ssl/domain.cert;
  12.     ssl_certificate_key /stuff/ssl/private.cert;
  13.     ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  14.     ssl_ciphers         ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
  17.     location /
  18.     {
  19.         proxy_pass http://localhost:9007;
  20. #       proxy_redirect    http://localhost:1500 http://site1;
  21.         proxy_cookie_domain localhost somedomain;
  22.         proxy_buffering off;
  24.         proxy_http_version 1.1;
  25.         proxy_set_header Host $host;
  26.         proxy_set_header X-Real-IP $remote_addr;
  27.         proxy_set_header Client-IP $remote_addr;
  28.         proxy_set_header X-Forwarded-For $remote_addr;
  29.     }
  30. }

答案1

得分: 5

使用https与proxy_pass一起使用

  1. location /
  2. {
  3.     proxy_pass https://localhost:9007;
  4.     ...
  5. }
英文:

Use https with the proxy_pass

  1. location /
  2. {
  3.     proxy_pass https://localhost:9007;
  4.     ...
  5. }

答案2

得分: 0

nginx的配置文件应该像这样：

  1. server {
  2.     listen 443 ssl http2;
  3.     listen 80;
  4.     server_name www.mojotv.cn;
  5.     ssl_certificate     /home/go/src/my_go_web/ssl/**.pem; 
  6.     ssl_certificate_key /home/go/src/my_go_web/ssl/**.key; 
  7.     ssl_session_timeout 5m;
  8.     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  9.     ssl_ciphers AESGCM:ALL:!DH:!EXPORT:!RC4:+HIGH:!MEDIUM:!LOW:!aNULL:!eNULL;
  10.     ssl_prefer_server_ciphers on;
  11.     location /(css|js|fonts|img)/ {
  12.         access_log off;
  13.         expires 1d;
  14.         root "/home/go/src/my_go_web/static";
  15.         try_files $uri @backend;
  16.     }
  17.     location / {
  18.         try_files /_not_exists_ @backend;
  19.     }
  20.     location @backend {
  21.         proxy_set_header X-Forwarded-For $remote_addr;
  22.         proxy_set_header Host $http_host;
  23.         proxy_pass http://127.0.0.1:********;
  24.     }
  25.     access_log  /home/wwwroot/www.mojotv.cn.log;## nginx日志路径
  26. }

golang web应用程序带有nginx的http2 ssl功能

英文:

nginx .config file should like this

  1. server {
  2.         listen 443 ssl http2;
  3.         listen 80;
  4.         server_name www.mojotv.cn;
  5.         ssl_certificate     /home/go/src/my_go_web/ssl/**.pem; 
  6.         ssl_certificate_key /home/go/src/my_go_web/ssl/**.key; 
  7.         ssl_session_timeout 5m;
  8.         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  9.         ssl_ciphers AESGCM:ALL:!DH:!EXPORT:!RC4:+HIGH:!MEDIUM:!LOW:!aNULL:!eNULL;
  10.         ssl_prefer_server_ciphers on;
  11.         location /(css|js|fonts|img)/ {
  12.             access_log off;
  13.             expires 1d;
  14.             root "/home/go/src/my_go_web/static";
  15.             try_files $uri @backend;
  16.         }
  17.         location / {
  18.             try_files /_not_exists_ @backend;
  19.         }
  20.         location @backend {
  21.            proxy_set_header X-Forwarded-For $remote_addr;
  22.            proxy_set_header Host $http_host;
  23.            proxy_pass http://127.0.0.1:********;
  24.         }
  25.         access_log  /home/wwwroot/www.mojotv.cn.log;## nginx log path
  26. }

the golang web app with http2 ssl feature shiped with nginx

1: https://www.mojotv.cn "the golang app with http2 ssl feature"

答案3

得分: 0

我遇到了与OP类似的错误信息，这是针对一个更基本的Go服务器，没有额外的配置。

tls: first record does not look like a TLS handshake

我的临时解决方法是确保测试URL包括"https://"和URL中的端口号。

不起作用 - ipaddress

不起作用 - https://ipaddress

起作用 - https://ipaddress:8081

这对于测试来说足够了，直到进行更高级的设置。我发表这篇帖子是为了帮助其他人进行故障排除。

英文:

I get a similar error message to OP for a more basic Go server that doesn't have extra config.

> tls: first record does not look like a TLS handshake

My temp fix was simply to make sure the test URL includes both "https://" and the port number in the URL.

didn't work - ipaddress

didn't work - https://ipaddress

worked - https://ipaddress:8081

It'll do for testing, until a more advanced setup. Just posting this to help others in troubleshooting.

huangapple
  • 本文由 发表于 2016年11月26日 17:51:52
  • 转载请务必保留本文链接：https://go.coder-hub.com/40817027.html
  • go
  • https
  • nginx
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定