Question

我的网站有这个nginx配置，我的域名使用通配符证书

server {
    server_name *.domain;
    root /var/www;

    index index.php;

    listen *:80;
    listen *:443 ssl http2;
    listen [::]:443 ssl http2;

    # indicate locations of SSL key files.
    ssl_certificate /etc/nginx/ssl/domain.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/domain.key;
    ssl_trusted_certificate /etc/nginx/ssl/domain.crt;
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_stapling on;

    # Enable HSTS. This forces SSL on clients that respect it, most modern browsers. The includeSubDomains flag is optional.
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

    # Set caches, protocols, and accepted ciphers. This config will merit an A+ SSL Labs score as of Sept 2015.
    ssl_session_cache shared:SSL:20m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

    # WordPress single site rules.
    # Designed to be included in any server {} block.

    # This order might seem weird - this is attempted to match last if rules below fail.
    # http://wiki.nginx.org/HttpCoreModule
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # Add trailing slash to */wp-admin requests.
    rewrite /wp-admin$ $scheme://$host$uri/ permanent;

    # Directives to send expires headers and turn off 404 error logging.
    location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
           access_log off; log_not_found off; expires max;
    }

    # Uncomment one of the lines below for the appropriate caching plugin (if used).
    #include global/wordpress-wp-super-cache.conf;
    #include global/wordpress-w3-total-cache.conf;

    # Pass all .php files onto a php-fpm/php-fcgi server.
    location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        if (!-f $document_root$fastcgi_script_name) {
            return 404;
        }
        # This is a robust solution for path info security issue and works with "cgi.fix_pathinfo = 1" in /etc/php.ini (default)

        include fastcgi_params;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    #   fastcgi_intercept_errors on;
        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        fastcgi_buffer_size 16k;
        fastcgi_buffers 4 16k;
    }


    error_log /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;
}

但我得到了错误

NET :: ERR_CERT_COMMON_NAME_INVALID

带有消息

此服务器无法证明它是 staging.wp.domain ;其安全证书来自 * .domain 。这可能是由于配置错误或攻击者拦截您的连接造成的。

我缺少什么。

由于

Answer 1

此服务器无法证明它是staging.wp.domain;其安全证书来自* .domain

因为您正在使用＆＃34;示例＆＃34;您的帖子中的名称，有点难以说，但我怀疑您正在尝试使用外卡进行多个子域名，这不起作用。

假设您拥有对这些名称有效的证书：

example.com
*。example.com

这可能是您拥有的外卡证书。您可以通过查看证书中的主题备用名称来判断。

＆＃34; *＆＃34;在证书中并不意味着＆＃34;多层次的深层＆＃34;，它意味着＆＃34;一层深层＆＃34;。

这些域对我们的证书有效：

foo.example.com
bar.example.com
example.dom

这些对此证书有效：

foo.bar.example.com
bar.foo.example.com

这里唯一的选择是获取*.wp.domain的证书，或者staging.wp.domain，如果您不需要外卡。 CA不会颁发对*.*.example.com有效的证书，甚至浏览器也会忽略这些通配符规则。

nginx通配符ssl配置

1 个答案: