如何配置 nginx 反向代理以在上游使用 SECURE websockets？答案

【问题标题】：How to configure nginx reverse proxy to use SECURE websockets upstream?如何配置 nginx 反向代理以在上游使用 SECURE websockets？
【发布时间】：2019-07-09 14:29:42
【问题描述】：

我想使用 nginx 作为 websocket 连接的反向代理。

考虑将 echo.websocket.org 作为我的后端 websocket 服务。作为测试客户端，我使用来自https://github.com/websockets/wscat 的wscat。

什么有效：

客户端后端： wscat --connect ws://echo.websocket.org

客户端 ：wscat --connect wss://echo.websocket.org

客户端代理后端：wscat --connect ws://localhost 使用以下 nginx 配置：

events {
}

http {
    server {
        listen 80;

        location / {
            proxy_pass http://echo.websocket.org;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
        }
    }
}

客户端代理后端：wscat -n --connect wss://localhost 使用以下 nginx 配置：

events {
}

http {
    server {
        listen 443 ssl;
        ssl_certificate /pki/cert.pem;
        ssl_certificate_key /pki/key.pem;

        location / {
            proxy_pass http://echo.websocket.org;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
        }
    }
}

我想要并且需要帮助的是配置 nginx 以使用安全的 websocket 连接到后端。我想要这个配置：

客户端代理后端

我尝试将http://echo.websocket.org 更改为https://echo.websocket.org，但没有成功。这会导致 504 网关超时。

【问题讨论】：

我认为您缺少代理 SSL 证书设置。看看proxy_ssl_certificate documentation 和Securing HTTP Traffic to Upstream Servers guide...它应该（可能）也可以与WebSockets 一起使用。
我不知道周五和今天之间发生了什么变化，但它现在正在工作，没有任何改变。无论如何，谢谢你让我再试一次：D
我很高兴它的工作:)
@merl 请查看示例，可能证书或域信息昨天没有更新，我可能对你有用

标签： nginx websocket

【解决方案1】：

您需要使用proxy_ssl_certificate 和proxy_ssl_certificate_key 中指定的Nginx Docs

【讨论】：

【解决方案2】：

这是我的配置upstream、server_name、ssl_certificate、HTTP 301：

server {
    listen 80; # nginx 80
    location / {
        return 301 https://$host$request_uri;
    }
    location ^~ /.well-known/acme-challenge/ {
        # Set correct content type. According to this:
        # https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
        # Current specification requires "text/plain" or no content header at all.
        # It seems that "text/plain" is a safe option.
        default_type "text/plain";
        # This directory must be the same as in /etc/letsencrypt/cli.ini
        # as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
        # there to "webroot".
        # Do NOT use alias, use root! Target directory is located here:
        # /var/www/common/letsencrypt/.well-known/acme-challenge/
        root         /var/www/html;
    }
}
server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl_certificate /etc/letsencrypt/live/***0***0.ru/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/***0***0.ru/privkey.pem; # managed by Certbot
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name ***0***0.ru; # server name
    location /sockjs-node/ {
        proxy_pass http://node; # wep application
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
    location / {
    proxy_pass http://node;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location /smpp {
        rewrite /smpp(.*) /$1 break;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        proxy_pass http://smpp;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
upstream smpp {
    server localhost:5001;
}
upstream node {
    server localhost:5000;
}

【讨论】：