nginx+ECC 证书+http2， chrome49，访问无限 CONNECTION_RESET
fourstring 2016-03-13 15:33:53 +08:00 3106 次点击这是一个创建于 3556 天前的主题，其中的信息可能已经有所发展或是发生改变。
如题。我使用的是 Mozilla 的推荐配置文件， nginx-1.9.9 ， openssl-1.0.2f ， let's encrypt 的 ECC 证书。翻袋了一个维基百科。然而用 chrome 访问时，出现无限 CONNECTION_RESET 错误。尝试换成了普通 RSA 证书，就能正常打开。
服务端系统是 ubuntu14.04 64 位
求指点，感谢！
系统是 OS X 10.11.3
完整配置文件在下面
```
server {
server_name g.n4l.pw;
listen 80;
location ^~ /.well-known/acme-challenge/ {
alias /home/wwwroot/challenges/;
try_files $uri =404;
}
}
server {
listen 443 ssl http2;
#listen [::]:443 ssl http2;
# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate ssl_certificate /path/to/ecc.crt; ssl_certificate_key /path/to/ecc.key; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_ecdh_curve secp384r1; # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits ssl_dhparam /path/to/dhparams.pem; # modern configuration. tweak to your needs. ssl_protocols TLSv1.2; ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; ssl_prefer_server_ciphers on; # HSTS (ngx_http_headers_module is required) (15768000 secOnds= 6 months) add_header Strict-Transport-Security 'max-age=15768000;includeSubDomains;preload'; # OCSP Stapling --- # fetch OCSP records from URL in ssl_certificate and cache them ssl_stapling on; ssl_stapling_verify on; ## verify chain of trust of OCSP response using Root CA and Intermediate certs #ssl_trusted_certificate /root/ssl/intermediate.pem; resolver 8.8.8.8 8.8.4.4; location / { proxy_set_header Host 'zh.wikipedia.org'; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://zh.wikipedia.org/;
proxy_set_header Accept-Encoding "";
} }
```
 | 1 wbsdty331 2016-03-13 15:57:49 +08:00 重新编译 ssl 模块试试 |
 | 2 Niphor 2016-03-13 17:23:20 +08:00 请问 官方工具指定生成 ECC 证书用哪个参数啊？ |
 | 3 Return2legacy 2016-03-20 23:46:54 +08:00 为什么是 ssl_certificate /path/to/ecc.crt ？ 签出来不是 pem 的么？还是说你没有成功签出证书，只有自己的密钥？ |
Select Language