兄弟们我又来了，有个问题又搞不懂了，帮帮我这个菜鸟吧

[z8596007]

server {
    listen 80;
    listen [::]:80;
    server_name xxx.xxx.xxx;
    return 301 $host$request_uri;
}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name xxx.xxx.xxx; 

    ssl_certificate   /etc/nginx/ssl/xxx.xxx.xxx.pem;
    ssl_certificate_key    /etc/nginx/ssl/xxx.xxx.xxx.key; 

    location  / {
        proxy_pass http://172.20.0.7:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header REMOTE-HOST $remote_addr;
        proxy_set_header X-Forwarded-Proto  $scheme;

        add_header X-Cache $upstream_cache_status;

        proxy_set_header Accept-Encoding "";
        sub_filter "http://" "https://";
        sub_filter_once off; 
    } 
} 

nginx 配置如上 现在的问题是 nginx 容器内可以访问 http://172.20.0.7:4000 ，宿主机也可以访问 172.20.0.7:4000,使用服务器 ip:4000 也可以访问这个容器，但是使用域名:https://xxx.xxx.xxx 就提示花了太长时间进行响应 443 端口也映射了。 不知道是什么问题了。。太难了。

```
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;

server {
listen 80;
listen [::]:80;
server_name www.xxx.xxx;
return 301 $host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name www.xxx.xxx;

ssl_certificate /etc/nginx/ssl/www.xxx.xxx.pem;
ssl_certificate_key /etc/nginx/ssl/www.xxx.xxx.key;

location / {
proxy_pass http://172.20.0.6:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}

# api.xxx.xxx
server {
listen 80;
listen [::]:80;
server_name api.xxx.xxx;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name api.xxx.xxx;

ssl_certificate /etc/nginx/ssl/api.xxx.xxx.pem;
ssl_certificate_key /etc/nginx/ssl/api.xxx.xxx.key;

location / {
proxy_pass http://172.20.0.7:4000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;

add_header X-Cache $upstream_cache_status;

proxy_set_header Accept-Encoding "";
sub_filter "http://" "https://";
sub_filter_once off;
}
}
}
```
我现在 www.xxx.xxx 可以正常访问。api.xxx.xxx 不可以访问

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid; 
events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream; 
    sendfile on;
    keepalive_timeout 65; 

    # www.xxx.xxx
    server {
        listen 80;
        listen [::]:80;
        server_name www.xxx.xxx;
        return 301 $host$request_uri;
    }
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name  www.xxx.xxx; 

        ssl_certificate   /etc/nginx/ssl/www.xxx.xxx.pem;
        ssl_certificate_key    /etc/nginx/ssl/www.xxx.xxx.key; 

        location / {
            proxy_pass http://172.20.0.6:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }  
    }  

    # api.xxx.xxx
    server {
        listen 80;
        listen [::]:80;
        server_name api.xxx.xxx;
        return 301 https://$host$request_uri; 
    }
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name api.xxx.xxx; 

        ssl_certificate   /etc/nginx/ssl/api.xxx.xxx.pem;
        ssl_certificate_key    /etc/nginx/ssl/api.xxx.xxx.key; 

        location  / {
            proxy_pass http://172.20.0.7:4000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header REMOTE-HOST $remote_addr;
            proxy_set_header X-Forwarded-Proto  $scheme;

            add_header X-Cache $upstream_cache_status;

            proxy_set_header Accept-Encoding "";
            sub_filter "http://" "https://";
            sub_filter_once off; 
        } 
    }  
}

我现在 www.xxx.xxx 可以正常访问。api.xxx.xxx 不可以访问

好像是找到原因了，可能是因为我在解析里增加了 @

[linauror]

先记下 nginx 访问日志，看有没有访问到 nginx ，或许是安全组的 443 端口没开？

[poporange]

你先看看 你防火墙开 443 端口了么

[vacuitym]

需要查看 ng 日志

[z8596007]

@linauror
```
400 Bad Request
The plain HTTP request was sent to HTTPS port
nginx/1.21.5
```
直接访问服务器:443 提示这个。

[z8596007]

@poporange
400 Bad Request
The plain HTTP request was sent to HTTPS port
nginx/1.21.5
直接访问服务器:443 提示这个。

[z8596007]

@vacuitym
ng 日志中没有啥东西。。
2023/07/26 06:11:50 [notice] 47#47: signal process started
2023/07/26 06:13:55 [notice] 50#50: signal process started
就启动时的

[cslive]

return 301 https://$host$request_uri; # 重定向到 https

[xulianbang]

cf 开了小黄云的话，到 ssl 里加蜜方式设置为完全
Nginx 改配置记得重新加载
好像遇到过此问题，记不清了，你试试

[kosmgco]

http://xxx.xxx.xxx:443 是这样访问的吗？

[LxnChan]

你 nginx 是怎么装的，也在容器里吗

[brader]

云防火墙开了 443 没

[z8596007]

@LxnChan 是在容器里的

[z8596007]

@cslive 改了 没啥效果

[z8596007]

@brader 开了的

[z8596007]

@xulianbang 不是走的 cf ，

[vacuitym]

@z8596007 error 和 info 日志都没东西吗，要是都没得话说明都没到 ng ，可以看下域名解析之类的

[z8596007]

@vacuitym 没有。域名解析是到这个服务器的

[kokutou]

@z8596007
域名 http 加 s 了没有。。。

[vacuitym]

@z8596007 不然你直接用服务器的外网 ip:443 请求下试试 ng 能不能收到，如果能的话就说明域名解析问题，如果不能 ng 的监听就有问题

[z8596007]

@vacuitym 可以收到。
返回的是
400 Bad Request
The plain HTTP request was sent to HTTPS port

[vacuitym]

@z8596007 那应该就是域名解析的问题了，你 ping 一下你的解析域名，如果没加防护的话应该可以直接看到解析的 ip

[z8596007]

@vacuitym ping 域名解析 还确实是我设置的 dns 地址

[vacuitym]

@z8596007 没招了，远程是在没办法猜到原因了