900字范文,内容丰富有趣,生活中的好帮手!
900字范文 > 宝塔nginx 默认站点禁止https://ip地址直接访问

宝塔nginx 默认站点禁止https://ip地址直接访问

时间:2023-04-04 20:17:08

相关推荐

宝塔nginx 默认站点禁止https://ip地址直接访问

宝塔nginx安装后,如果使用ip地址进行https访问,会暴露证书,解决方法如下:

1.在/www/server/panel/vhost/nginx/0.default.conf 中头部修改为如下代码:

listen 80;listen 443 ssl http2;server_name _;#直接用ip访问时重定向为444if ( $host ~* "\d+\.\d+\.\d+\.\d+" ) {return 444;#rewrite ^(.*) ;}#配置默认无效证书#HTTP_TO_HTTPS_ENDssl_certificate /www/server/panel/vhost/cert/default/fullchain.pem;ssl_certificate_key /www/server/panel/vhost/cert/default/privkey.pem;ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;ssl_session_timeout 10m;error_page 497 https://$host$request_uri;

其中,证书文件为:

大家可以使用我们已经生成的这张证书,反正只要域名不是你真实的域名就行了,提供如下

公共证书

-----BEGIN CERTIFICATE-----MIIDITCCAsagAwIBAgIUTcEWLzynkLCFCoAC1iDH2vG3EkYwCgYIKoZIzj0EAwIwgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYDVQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xOTAxMTMxNDMxMDBaFw0zNDAxMDkxNDMxMDBaMGIxGTAXBgNVBAoTEENsb3VkRmxhcmUsIEluYy4xHTAbBgNVBAsTFENsb3VkRmxhcmUgT3JpZ2luIENBMSYwJAYDVQQDEx1DbG91ZEZsYXJlIE9yaWdpbiBDZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAg/hZ9lDHj/f+0jDRAN23TkNEqIi46mCGnwZVD3glxLl+a1mpfXLHSEFTipnSyQgmvkPYzQGaEIFD0q6W/ZgMujggEqMIIBJjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCEZF6Eyem01XPbgwr6DXLZV1qsQMB8GA1UdIwQYMBaAFIUwXTsqcNTt1ZJnB/3rObQaDjinMEQGCCsGAQUFBwEBBDgwNjA0BggrBgEFBQcwAYYoaHR0cDovL29jc3AuY2xvdWRmbGFyZS5jb20vb3JpZ2luX2VjY19jYTAjBgNVHREEHDAaggwqLmRuc3BvZC5jb22CCmRuc3BvZC5jb20wPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5jbG91ZGZsYXJlLmNvbS9vcmlnaW5fZWNjX2NhLmNybDAKBggqhkjOPQQDAgNJADBGAiEAnrequCk/QZOOrcPH6C3Hgcy4SPNUy5rQtku/aYkjqQoCIQCN6IyYNiXuwG+8jUgJrveiirBjiz2jXZSTEfVAyibjTg==-----END CERTIFICATE-----

密钥

-----BEGIN PRIVATE KEY-----MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgK0HE3hTJQDg6p/fjnS92eSuRKZEZ5F4grT6tWFKNYVmhRANCAAQIP4WfZQx4/3/tIw0QDdt05DRKiIuOpghp8GVQ94JcS5fmtZqX1yx0hBU4qZ0skIJr5D2M0BmhCBQ9Kulv2YDL-----END PRIVATE KEY-----

经过以上配置,已经基本实现没有绑定的主机名和使用主机ip地址访问时重定向到444页面了!

下面是一个反向代理的例子:

#PROXY-START/location /{proxy_pass /;proxy_set_header Host $host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header REMOTE-HOST $remote_addr;add_header X-Cache $upstream_cache_status;#Set Nginx Cacheadd_header Cache-Control no-cache;expires 12h;}

如果使用非80端口访问网站,还需要判断一下非指定主机不允许访问!

如:

if ( $host != "" ) {rewrite ^(.*) ;}

以上为个人学习记录,可能不完全正确,有很多东西并不能透彻的理解.如有需要交流学习的可以加QQ群:26503822共同成长

本内容不代表本网观点和政治立场,如有侵犯你的权益请联系我们处理。
网友评论
网友评论仅供其表达个人看法,并不表明网站立场。