如何在 nginx 中同时使用自签名和 LetsEncrypt Certbot SSL 证书？

Question

我在数字海洋上托管一个 django 网站。我希望使用带有自签名证书的 https 访问我的网站的 IP，因为 Let's Encrypt 不提供公共 IP 地址的证书。我跟着guide 写了一个 nginx 服务器块。我可以通过以下方式访问 https://example-ip-address：

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    include /etc/nginx/snippets/self-signed.conf;
    include /etc/nginx/snippets/ssl-params.conf;

    server_name 123.123.12.123;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/user/djangotemplates;
    }

    location / {
        include /etc/nginx/proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }

}


server {
    listen 80;
    listen [::]:80;

    server_name 123.123.12.123;

    return 301 https://$server_name$request_uri;
}

而且，我可以访问https://example.com 和https://www.example.com，让我们按照this 加密SSL 证书，这是我写的服务器块：

server {
    server_name www.example.com example.com;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/user/djangotemplates;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}

server {
    if ($host = www.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name www.example.com example.com;
    return 404; # managed by Certbot




}

这里的问题是当我将两个服务器块放入一个配置文件并访问 https://example-ip-address 时，连接没有加密。但是，它适用于 https://example.com 和 https://www.example.com。知道这里出了什么问题吗？

我刚刚在数字海洋上启动了我的 django 网站 - 我收到了一封错误电子邮件“无效的 HTTP_HOST 标头：'123.123.12.123'。您可能需要将“123.123.12.123”添加到 ALLOWED_HOSTS。所以，我在 ALLOWED_HOSTS 中添加了 IP 地址。而且我觉得用https访问ip地址比较安全。

Answer 1

我建议您使用 certbot 而不是自签名证书 https://certbot.eff.org