nginx+ECC 证书+http2， chrome49，访问无限 CONNECTION_RESET
fourstring · 2016-03-13 15:33:53 +08:00 · 2750 次点击这是一个创建于 3162 天前的主题，其中的信息可能已经有所发展或是发生改变。
如题。我使用的是 Mozilla 的推荐配置文件， nginx-1.9.9 ， openssl-1.0.2f ， let's encrypt 的 ECC 证书。翻袋了一个维基百科。然而用 chrome 访问时，出现无限 CONNECTION_RESET 错误。尝试换成了普通 RSA 证书，就能正常打开。
服务端系统是 ubuntu14.04 64 位
求指点，感谢！
系统是 OS X 10.11.3
完整配置文件在下面
```
server {
server_name g.n4l.pw;
listen 80;
location ^~ /.well-known/acme-challenge/ {
alias /home/wwwroot/challenges/;
try_files $uri =404;
}
}
server {
listen 443 ssl http2;
#listen [::]:443 ssl http2;
# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
ssl_certificate /path/to/ecc.crt;
ssl_certificate_key /path/to/ecc.key;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_ecdh_curve secp384r1;
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
ssl_dhparam /path/to/dhparams.pem;
# modern configuration. tweak to your needs.
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
add_header Strict-Transport-Security 'max-age=15768000;includeSubDomains;preload';
# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
ssl_stapling on;
ssl_stapling_verify on;
## verify chain of trust of OCSP response using Root CA and Intermediate certs
#ssl_trusted_certificate /root/ssl/intermediate.pem;
resolver 8.8.8.8 8.8.4.4;
location / {
proxy_set_header Host 'zh.wikipedia.org';
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://zh.wikipedia.org/;
proxy_set_header Accept-Encoding "";
}
}
```
 |
1
wbsdty331 2016-03-13 15:57:49 +08:00
重新编译 ssl 模块试试
|
 |
2
Niphor 2016-03-13 17:23:20 +08:00
请问 官方工具指定生成 ECC 证书用哪个参数啊？
|
 |
3
Return2legacy 2016-03-20 23:46:54 +08:00
为什么是 ssl_certificate /path/to/ecc.crt ？
签出来不是 pem 的么？还是说你没有成功签出证书，只有自己的密钥？ |
Select Language