Certbot SSL证书和http->https www->非www重定向到多次错误

Question

我在linode上运行一个rails应用程序。我在ubuntu上使用nginx，并且成功地为两个域(www和非www)创建了一个certbot证书

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: example.com
    Domains: www.example.com
    Expiry Date: 2020-02-19 20:17:51+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem
  Certificate Name: www.example.com
    Domains: example.com
    Expiry Date: 2020-02-20 07:33:06+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/www.example.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/www.example.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

这是我启用的nginx配置文件的内容

upstream puma {
  server unix:///home/deploy/apps/example/shared/tmp/sockets/example-puma.sock;
}

server {
  listen 80 default_server deferred;
  # server_name example.com;

  root /home/deploy/apps/example/current/public;
  access_log /home/deploy/apps/example/current/log/nginx.access.log;
  error_log /home/deploy/apps/example/current/log/nginx.error.log info;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  try_files $uri/index.html $uri @puma;
  location @puma {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    proxy_pass http://puma;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 10M;
  keepalive_timeout 10;
}

server {
  listen 80;
  # server_name example.com;
  server_name 172.104.228.105;

  return 301 $scheme://example.com$request_uri;
}

我想将所有流量重定向到https://heimlichhamburg.dehttps://non-www.com.

在我为非www域添加另一个证书之前，该证书一直适用于www。现在我在www中收到一个重定向您太多次错误，并且此站点无法在非www域上提供安全连接。

更新NGINX.CONF

upstream puma {
  server unix:///home/deploy/apps/wasgehthamburg/shared/tmp/sockets/wasgehthamburg-puma.sock;
}

server {
  listen 80 default_server deferred;
  # server_name example.com;

  root /home/deploy/apps/wasgehthamburg/current/public;
  access_log /home/deploy/apps/wasgehthamburg/current/log/nginx.access.log;
  error_log /home/deploy/apps/wasgehthamburg/current/log/nginx.error.log info;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  try_files $uri/index.html $uri @puma;
  location @puma {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    proxy_pass http://puma;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 10M;
  keepalive_timeout 10;
}

server {
  listen 80;
  # server_name example.com;
  server_name 172.XXX.XXX.105 www.example.org example.org;

  return 301 https://example.org.de$request_uri;
}

server {
    listen 443 ssl http2; #https of www*, 301 to right domain.
    server_name www.heimlichhamburg.de;
    #here the paths to your cert and key
    ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem
    include /etc/letsencrypt/options-ssl-nginx.conf; 
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; 

    return 301 https://example.org$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.org;

    ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    #do what you want to do here.
}

Answer 1

首先，您可以将所有网址发送到https，无论是使用w还是没有它。

server {
    listen 80; 
    server_name example.org www.example.org;
    return 301 https://example.org$request_uri;
}

如果主机是www*并且通过https，则重定向到不带www的https。顺便说一下，在这里你将使用www.example.com证书

server {
    listen 443 ssl http2; #https of www*, 301 to right domain.
    server_name www.example.org;
    #here the paths to your cert and key
    ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem
    include /etc/letsencrypt/options-ssl-nginx.conf; 
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; 

    return 301 https://example.org$request_uri;
}

最后，如果它带有正确的方案，并且具有正确的主机，请做任何您想做的事情。

server {
    listen 443 ssl http2;
    server_name example.org;

    ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    #do what you want to do here.
}

我发现你遇到的一个问题是，在example.com的80端口上，你重定向到scheme:/...，这意味着使用相同的方案到达，所以它是http不断(重定向循环)。

如果你有任何问题，就问他们： D