Nginx 是1.6.2
平台是 bananapro 開發板 裝的 armbian 核心是4.1.6 的Debian Jessie
情況是 只要在設定檔中啟用SPDY
一部分請求,多數為POST請求 Chrome 會報 error: net::ERR_SPDY_PROTOCOL_ERROR
之前在一VPS裡的CentOS(v6.5)也報過同樣的錯誤,
但是那時配了2個SSL的domain,只有1個用於科學翻牆的有問題
Nginx 是自己編譯的1.8.x
同時,之前開發板一直跑的是Ubuntu,源裡面的Nginx較新,從未出現這樣的問題...
日誌裡面也沒什麼特別的資訊,除了偶爾出現如下的資訊:
2015/09/07 21:16:46 [error] 1593#0: OCSP responder sent invalid "Content-Type" header: "text/html" while requesting certificate status, responder: ocsp.startssl.com
2015/09/07 21:18:41 [error] 1686#0: OCSP responder sent invalid "Content-Type" header: "text/html" while requesting certificate status, responder: ocsp.startssl.com
2015/09/07 21:18:45 [error] 1688#0: OCSP responder sent invalid "Content-Type" header: "text/html" while requesting certificate status, responder: ocsp.startssl.com
SSL配置用的是很普通的設定:
listen 443 ssl;
server_name a.mydomain.com;
#SSL Certificate
ssl_certificate /etc/nginx/certs/a.mydomain.com-unified.crt;
ssl_certificate_key /etc/nginx/certs/a.mydomain.com-decrypt.key;
#TLS only
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#SSL Session Cache
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
#OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/a.mydomain.com-unified.crt;
resolver 223.5.5.5;
#Disable Beast Attacks
ssl_prefer_server_ciphers on;
ssl_ciphers HIGH:!aNULL:!MD5:!DSS:!RC4;
#Stronger DHE Parameters
ssl_dhparam /etc/nginx/certs/dh4096.pem;
#HSTS
add_header Strict-Transport-Security "max-age=31536000";
#add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
同時附上相關文件&資料夾的權限
/etc/nginx# ls -al
drwxr-xr-x 6 root root 4096 Sep 7 10:27 .
drwxr-xr-x 86 root root 4096 Sep 7 20:21 ..
lrwxrwxrwx 1 root root 40 Sep 7 10:27 certs -> /mnt/config/etc/nginx/certs
drwxr-xr-x 2 root root 4096 Dec 1 2014 conf.d
-rw-r--r-- 1 root root 1034 Dec 1 2014 fastcgi.conf
-rw-r--r-- 1 root root 964 Dec 1 2014 fastcgi_params
-rw-r--r-- 1 root root 2837 Dec 1 2014 koi-utf
-rw-r--r-- 1 root root 2223 Dec 1 2014 koi-win
-rw-r--r-- 1 root root 3957 Dec 1 2014 mime.types
-rw-r--r-- 1 root root 1459 Dec 1 2014 nginx.conf
-rw-r--r-- 1 root root 180 Dec 1 2014 proxy_params
-rw-r--r-- 1 root root 596 Dec 1 2014 scgi_params
drwxr-xr-x 2 root root 4096 Sep 7 02:01 sites-available
drwxr-xr-x 2 root root 4096 Sep 7 10:38 sites-enabled
drwxr-xr-x 2 root root 4096 Sep 7 02:01 snippets
-rw-r--r-- 1 root root 623 Dec 1 2014 uwsgi_params
-rw-r--r-- 1 root root 3071 Dec 1 2014 win-utf
/var/lib/nginx# ls -al
drwxr-xr-x 7 root root 4096 Sep 7 02:01 .
drwxr-xr-x 32 root root 4096 Sep 7 02:06 ..
drwx------ 2 www-data root 4096 Sep 7 02:01 body
drwx------ 2 www-data root 4096 Sep 7 02:01 fastcgi
drwx------ 12 www-data root 4096 Sep 7 21:07 proxy
drwx------ 2 www-data root 4096 Sep 7 02:01 scgi
drwx------ 2 www-data root 4096 Sep 7 02:01 uwsgi
/var/lib/nginx# ps -aux | grep nginx
root 1725 0.0 0.2 24024 2348 ? Ss 21:19 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 1726 0.1 0.4 24448 4760 ? S 21:19 0:00 nginx: worker process
www-data 1727 0.1 0.4 24328 4592 ? S 21:19 0:00 nginx: worker process
www-data 1728 0.0 0.2 24180 2988 ? S 21:19 0:00 nginx: worker process
www-data 1729 0.0 0.2 24180 2988 ? S 21:19 0:00 nginx: worker process
實在是想不出問題的原因了,請哪位了解的來解答一下,謝謝了。
openssl版本問題?
話說開發板能裝CentOS?
昨晚裝了jessie-backport中的nginx 1.9.3,問題消失
難道說 nginx