Question

我正在尝试将“ www”子域重定向到没有“ www”的相同路由，但是在访问地址时出现以下错误：

您的连接不是私人的攻击者可能试图从www。*。com窃取您的信息（例如密码，消息或信用卡）。学到更多 NET :: ERR_CERT_COMMON_NAME_INVALID

没有'www'的子域处于完全活动状态，并使用我使用Lets Encrypt制作的SSL进行了设置（创建SSL时已注册了两个版本的子域）。

在“ www”域上执行curl命令时，我成功获得“ 301永久移动”。

这是我的nginx的配置文件：

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;
    return 301 sitename.com$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/sitename.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitename.com/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

Answer 1

已编辑，请参见评论

您可以尝试更完整的解决方案。使用通配符和改进的重定向。请尝试！

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;

    server_name .sitename.com;     # Note the '.' before sitename!

    return 301 https://$host$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name .sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/sitename.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitename.com/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

Docs

.sitename.com;

以“ .example.org”形式出现的特殊通配符名称可用于匹配确切名称“ example.org”和通配符名称“ * .example.org”。

Answer 2

我已决定以另一种方式解决此问题。我为“ www”子域生成了另一个Lets Encrypt SSL证书，并创建了另一个块。

现在一切正常。

这是我更新的配置：

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    server_name sitename.com www.sitename.com;
    listen [::]:80 default_server ipv6only=on;
    return 301 https://$host$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/sitename.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitename.com/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/www.sitename.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.sitename.com-0001/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

即使应用了重定向，WWW子域也不安全

2 个答案: