Question

这是我的/etc/nginx/sites-enabled/"myapp" conf文件。我有ssl禁用，所以所有请求都通过非ssl连接路由。另外，我已经注释掉了ssl stapling on指令。

有些人告诉我（可能发生在所有人身上）当他们点击http://nickeleres.com时，浏览器会抛出一个安全例外。我想，我猜不到，因为我很久以前就在我所有的浏览器上将网站添加到了我接受的网站列表中。

导致此例外的原因是什么？

    server_tokens off; # for security-by-obscurity: stop displaying nginx version

    # this section is needed to proxy web-socket connections
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    # HTTP
    server {
    #    listen 80 default_server; # if this is not a default server, remove "default_server"
    #    listen [::]:80 default_server ipv6only=on;
         listen 80;

        root /home/nickeleres; # root is irrelevant
        index /home/nickeleres; # this is also irrelevant

        server_name nickeleres.com; # the domain on which we want to host the application. Since we set "default_server" previously, nginx will answer a$

        # redirect non-SSL to SSL
    #    location / {
    #       return 301 https://nickeleres.com;
    #       rewrite     ^ https://$server_name$request_uri? permanent;
    #   }

        # pass all requests to Meteor
        location / {
            proxy_pass http://127.0.0.1:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade; # allow websockets
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header X-Forwarded-For $remote_addr; # preserve client IP

            # this setting allows the browser to cache the application in a way compatible with Meteor
            # on every applicaiton update the name of CSS and JS file is different, so they can be cache infinitely (here: 30 days)
            # the root path (/) MUST NOT be cached
            if ($uri != '/') {
                expires 30d;
            }
        }

    }

    # HTTPS server
    server {
        listen 443 ssl spdy; # we enable SPDY here
        server_name nickeleres.com; # this domain must match Common Name (CN) in the SSL certificate

        root /home/nickeleres; # irrelevant
        index /home/nickeleres; # irrelevant

        ssl_certificate /etc/nginx/ssl/server.crt; # full path to SSL certificate and CA certificate concatenated together
        ssl_certificate_key /etc/nginx/ssl/server.key; # full path to SSL key

        # performance enhancement for SSL
        # ssl_stapling on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 5m;

        # safety enhancement to SSL: make sure we actually use a safe cipher
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECD$

        # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
        # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
        add_header Strict-Transport-Security "max-age=31536000;";

        # If your application is not compatible with IE <= 10, this will redirect visitors to a page advising a browser update
        # This works because IE 11 does not present itself as MSIE anymore
        if ($http_user_agent ~ "MSIE" ) {
            return 303 https://browser-update.org/update.html;
        }

        # pass all requests to Meteor
        location / {
            proxy_pass http://127.0.0.1:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade; # allow websockets
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header X-Forwarded-For $remote_addr; # preserve client IP

            # this setting allows the browser to cache the application in a way compatible with Meteor
            # on every applicaiton update the name of CSS and JS file is different, so they can be cache infinitely (here: 30 days)
            # the root path (/) MUST NOT be cached
            if ($uri != '/') {
                expires 30d;
            }
        }
    }

Answer 1

我已禁用ssl，因此所有请求都通过非ssl连接进行路由。

SSL未被禁用但处于活动状态，并且正在使用导致安全警告的自签名证书。

# HTTPS server
server {
    listen 443 ssl spdy; # we enable SPDY here
    ...

这是您配置SSL的配置的一部分。如您所见，在端口443上启用了SSL（和SPDY）。

您可能禁用的是从http：//重定向到https：//：

   # redirect non-SSL to SSL
#    location / {
#       return 301 https://nickeleres.com;
#       rewrite     ^ https://$server_name$request_uri? permanent;
#   }

但是，由于这是一个永久重定向（代码301而不是302），浏览器会缓存此重定向，下次用户访问浏览器已经知道的http：//网站时，它应该使用https： //站点而不是。一旦这样做，将找到无效证书并发出安全警告。

要解决此问题，请完全删除SSL（和SPDY），以便服务器不再侦听端口443。

连接到我的Ubuntu实例时，浏览器抛出异常

1 个答案: