Nginx proxy_ssl_server_name 解决后端多域名证书匹配失败的方法

location / {
    proxy_pass https://10.0.0.5;  # 后端是 IP 地址
}

SSL: error:0A000086:SSL routines::certificate verify failed

location / {
    proxy_pass https://backend.example.com;
    # 核心：启用 SNI，发送 Host 头作为服务器名
    proxy_ssl_server_name on;
    # 验证后端证书（生产环境必须开启）
    proxy_ssl_verify on;
    proxy_ssl_trusted_certificate /etc/nginx/certs/ca.crt;
    # 发送的 SNI 名称（默认使用 proxy_pass 中的主机名）
    proxy_ssl_name backend.example.com;
}

http {
    # 根据请求特征动态选择后端 SNI
    map $host $backend_sni {
        default              "api.internal.com";
        "client-a.example.com" "a-api.internal.com";
        "client-b.example.com" "b-api.internal.com";
    }
    server {
        location / {
            proxy_pass https://$backend_sni;
            # 启用 SNI 并使用变量指定名称
            proxy_ssl_server_name on;
            proxy_ssl_name $backend_sni;
            proxy_ssl_verify on;
            proxy_ssl_trusted_certificate /etc/nginx/certs/ca-chain.crt;
        }
    }
}

upstream backend_nodes {
    server 10.0.1.10:443;
    server 10.0.1.11:443;
}
server {
    location / {
        proxy_pass https://backend_nodes;
        # 必须使用 proxy_ssl_name 指定证书中的 CN/SAN
        proxy_ssl_server_name on;
        proxy_ssl_name api.internal.example.com;
        proxy_ssl_verify on;
        proxy_ssl_trusted_certificate /etc/nginx/certs/internal-ca.crt;
        # 透传原始 Host（与 SNI 分离）
        proxy_set_header Host $host;
    }
}

server {
    location /api/ {
        proxy_pass https://api.internal:443;
        proxy_ssl_server_name on;
        proxy_ssl_name api.internal;
        # 严格验证 + 深度
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 2;
        proxy_ssl_trusted_certificate /etc/nginx/certs/ca-bundle.crt;
        # 会话复用优化
        proxy_ssl_session_reuse on;
    }
    location /legacy/ {
        proxy_pass https://old.internal:443;
        proxy_ssl_server_name on;
        proxy_ssl_name old.internal;
        # 旧系统可能证书过期，临时放宽（不推荐长期）
        # proxy_ssl_verify off;
    }
}

server {
    resolver 10.0.0.2 valid=10s;
    location / {
        set $target "service.consul";
        proxy_pass https://$target:443;
        # 动态解析时必须显式设置 SNI
        proxy_ssl_server_name on;
        proxy_ssl_name service.consul;
        proxy_ssl_verify on;
        proxy_ssl_trusted_certificate /etc/nginx/certs/consul-ca.crt;
    }
}

# ❌ 错误：IP 代理无 SNI，后端返回默认证书
proxy_pass https://10.0.0.5;
# ✅ 修正：启用 SNI 并指定期望的证书域名
proxy_ssl_server_name on;
proxy_ssl_name api.example.com;
proxy_pass https://10.0.0.5;

proxy_ssl_server_name on;
proxy_ssl_protocols TLSv1.2 TLSv1.3;
proxy_ssl_ciphers HIGH:!aNULL:!MD5;

# 后端证书为 *.example.com
proxy_ssl_server_name on;
proxy_ssl_name api.example.com;  # 正确：具体子域名
# proxy_ssl_name *.example.com;  # 错误：SNI 不支持通配符写法

server {
    location / {
        proxy_pass https://backend;
        proxy_ssl_server_name on;
        proxy_ssl_name backend.example.com;
        # 临时开启详细日志（需编译时启用 debug）
        error_log /var/log/nginx/debug.log debug;
        # 添加响应头确认后端信息（调试用）
        add_header X-Debug-Upstream $upstream_addr;
        add_header X-Debug-Ssl-Name $proxy_ssl_name;
    }
}

upstream api_backend {
    server 10.0.2.10:443 weight=5;
    server 10.0.2.11:443 weight=5;
    keepalive 100;
}
server {
    listen 443 ssl http2;
    server_name gateway.example.com;
    # 客户端到 Nginx 的证书
    ssl_certificate     /etc/nginx/certs/gateway.crt;
    ssl_certificate_key /etc/nginx/certs/gateway.key;
    location /api/ {
        proxy_pass https://api_backend;
        # === SNI 核心配置 ===
        proxy_ssl_server_name on;
        proxy_ssl_name api.internal.example.com;
        # 证书验证
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 2;
        proxy_ssl_trusted_certificate /etc/nginx/certs/internal-ca-bundle.crt;
        # 连接优化
        proxy_ssl_session_reuse on;
        proxy_ssl_protocols TLSv1.2 TLSv1.3;
        # 标准代理头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Request-ID $request_id;
    }
}