文档建议反馈控制台
首页
学习
活动
专区
工具
TVP
最新优惠活动
文章/答案/技术大牛
发布
社区首页 >问答首页 >ssl_certificate路径中使用变量的nginx配置引发权限错误

问ssl_certificate路径中使用变量的nginx配置引发权限错误
EN

Server Fault用户
提问于 2019-06-19 18:45:42
回答 1查看 3.5K关注 0票数 3

nginx配置服务器块：

代码语言：javascript
复制
localhost:/etc/nginx$ cat nginx.conf | grep -B 3 -A 6 '$ssl_server_name'
  server {
    listen 443 ssl http2 default_server;

    ssl_certificate         /etc/letsencrypt/live/$ssl_server_name/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/$ssl_server_name/privkey.pem;

    location / {
      include /etc/nginx/snippets/set-headers.conf;
      proxy_pass http://localhost:8080;
    }
  }

这是从nginx1.15.9开始支持的证书指令中的使用变量 $ssl_server_name。nginx文档的相关部分。

该配置传递nginx -t并在没有问题的情况下加载，但页面不会在浏览器中加载，而且即使nginx作为root运行，也有一个权限被拒绝的错误在error.log中打开证书：

代码语言：javascript
复制
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/19 18:51:47 [error] 5676#5676: *251 cannot load certificate "/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443
localhost:/etc/nginx$ ps -ef | grep nginx | grep -v grep
www-data  5676 24653  0 18:49 ?        00:00:00 nginx: worker process
root     24653     1  0 15:08 ?        00:00:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
localhost:/etc/nginx$ sudo ls -l /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem
lrwxrwxrwx 1 root root 56 Apr 17 18:53 /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem -> ../../archive/[DOMAIN NAME REDACTED]/fullchain1.pem
localhost:/etc/nginx$ sudo ls -l /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
-rw-r--r-- 1 root root 3591 Apr 17 18:53 /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/19 18:51:47 [error] 5676#5676: *251 cannot load certificate "/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443
localhost:/etc/nginx$ ps -ef | grep nginx | grep -v grep
www-data  5676 24653  0 18:49 ?        00:00:00 nginx: worker process
root     24653     1  0 15:08 ?        00:00:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
localhost:/etc/nginx$ sudo ls -l /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem
lrwxrwxrwx 1 root root 56 Apr 17 18:53 /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem -> ../../archive/[DOMAIN NAME REDACTED]/fullchain1.pem
localhost:/etc/nginx$ sudo ls -l /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
-rw-r--r-- 1 root root 3591 Apr 17 18:53 /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
localhost:/etc/nginx$ openssl
OpenSSL> version
OpenSSL 1.0.2g  1 Mar 2016
OpenSSL> ^C
localhost:/etc/nginx$ nginx -v
nginx version: nginx/1.17.0

当我在nginx配置中用域名替换$ssl_server_name时，没有权限错误读取相同的cert文件，并且页面加载在浏览器中。

为什么在cert路径中使用变量不起作用？

更新：

我将归档文件夹组更新为www-data，仍然查看权限错误：

代码语言：javascript
复制
localhost:/etc/nginx$ sudo chgrp -R www-data /etc/letsencrypt/archive
localhost:/etc/nginx$ sudo namei -l /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
f: /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
drwxr-xr-x root root     /
drwxr-xr-x root root     etc
drwxr-xr-x root root     letsencrypt
drwx------ root www-data archive
drwxr-xr-x root www-data [DOMAIN NAME REDACTED]
-rw-r--r-- root www-data fullchain1.pem
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/20 07:18:58 [error] 4897#4897: *6 cannot load certificate "/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443

更新2：

将组读取和执行权限添加到归档文件夹，但仍会看到权限错误：

代码语言：javascript
复制
localhost:/etc/nginx$ sudo chmod g+r /etc/letsencrypt/archive
localhost:/etc/nginx$ sudo chmod g+x /etc/letsencrypt/archive
localhost:/etc/nginx$ sudo namei -l /etc/letsencrypt/archive/ [DOMAIN NAME REDACTED]/fullchain1.pem
f: /etc/letsencrypt/archive/[DOMAIN NAME REDACTED]/fullchain1.pem
drwxr-xr-x root root     /
drwxr-xr-x root root     etc
drwxr-xr-x root root     letsencrypt
drwxr-x--- root www-data archive
drwxr-xr-x root www-data  [DOMAIN NAME REDACTED]
-rw-r--r-- root www-data fullchain1.pem
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/20 07:39:58 [error] 4897#4897: *22 cannot load certificate "/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/ [DOMAIN NAME REDACTED]/fullchain.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443

更新3：

尝试成为使用sudo的www-数据，但得到了一个错误：

代码语言：javascript
复制
localhost:/etc/nginx$ sudo su - www-data
No directory, logging in with HOME=/
This account is currently not available.

更新4：

我还更新了符号链接路径活动文件夹上的权限，仍然查看权限错误：

代码语言：javascript
复制
localhost:/etc/nginx$ ll /etc/letsencrypt | grep live
drwx------   5 root root     4096 Apr 17 18:53 live/
localhost:/etc/nginx$ sudo chgrp www-data /etc/letsencrypt/live
localhost:/etc/nginx$ sudo chmod g+rx /etc/letsencrypt/live
localhost:/etc/nginx$ ll /etc/letsencrypt | grep live
drwxr-x---   5 root www-data 4096 Apr 17 18:53 live/
localhost:/etc/nginx$ sudo namei -l /etc/letsencrypt/live
f: /etc/letsencrypt/live
drwxr-xr-x root root     /
drwxr-xr-x root root     etc
drwxr-xr-x root root     letsencrypt
drwxr-x--- root www-data live
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/20 07:57:48 [error] 5104#5104: *17 cannot load certificate key "/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/privkey.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/privkey.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443

更新5：

列出路径中所有dir的权限，包括符号链接：

代码语言：javascript
复制
localhost:/etc/nginx$ sudo namei -l /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem
f: /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem
drwxr-xr-x root root     /
drwxr-xr-x root root     etc
drwxr-xr-x root root     letsencrypt
drwxr-x--- root www-data live
drwxr-xr-x root root     [DOMAIN NAME REDACTED]
lrwxrwxrwx root root     fullchain.pem -> ../../archive/[DOMAIN NAME REDACTED]/fullchain1.pem
drwxr-x--- root www-data   ..
drwxr-xr-x root root       ..
drwxr-x--- root www-data   archive
drwxr-xr-x root www-data   [DOMAIN NAME REDACTED]
-rw-r--r-- root www-data   fullchain1.pem

更新6：

尝试为www-data用户临时更改shell，使用sudo变成www-数据，并测试读取证书是可能的，但权限错误仍在发生：

代码语言：javascript
复制
localhost:/etc/nginx$ cat /etc/passwd | grep www-data
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
localhost:/$ cat /etc/passwd | grep www-data
www-data:x:33:33:www-data:/var/www:/bin/bash
localhost:/etc/nginx$ sudo vim /etc/passwd
localhost:/etc/nginx$ sudo su - www-data
No directory, logging in with HOME=/
localhost:01:/$ whoami
www-data
localhost:/$ cat /etc/letsencrypt/live/[DOMAIN NAME REDACTED]/fullchain.pem
-----BEGIN CERTIFICATE-----
[REDACTED CERT]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[REDACTED CERT]
-----END CERTIFICATE-----
localhost:/$ exit
logout
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/20 08:40:23 [error] 5259#5259: *14 cannot load certificate key "/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/privkey.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/letsencrypt/live/[DOMAIN NAME REDACTED]/privkey.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443

更新7：

尝试将证书导出到另一个文件夹：

代码语言：javascript
复制
localhost:/etc/nginx$ mkdir /tmp/exported-certs
localhost:/etc/nginx$ sudo rsync -razL /etc/letsencrypt/live/ /tmp/exported-certs
localhost:/etc/nginx$ sudo ls -l /tmp/exported-certs/[DOMAIN NAME REDACTED]/fullchain.pem
-rw-r--r-- 1 root www-data 3591 Apr 17 18:53 /tmp/exported-certs/[DOMAIN NAME REDACTED]/fullchain.pem
localhost:/etc/nginx$ sudo ls -l /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
-rw------- 1 root www-data 1704 Apr 17 18:53 /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
localhost:/etc/nginx$ sudo namei -l /tmp/exported-certs/[DOMAIN NAME REDACTED]/fullchain.pem
f: /tmp/exported-certs/[DOMAIN NAME REDACTED]/fullchain.pem
drwxr-xr-x root root     /
drwxrwxrwt root root     tmp
drwxr-x--- root www-data exported-certs
drwxr-xr-x root root     [DOMAIN NAME REDACTED]
-rw-r--r-- root www-data fullchain.pem
localhost:/etc/nginx$ sudo vim nginx.conf
localhost:/etc/nginx$ cat nginx.conf | grep -B 3 -A 6 '$ssl_server_name'
  server {
    listen 443 ssl http2 default_server;

    ssl_certificate /tmp/exported-certs/$ssl_server_name/fullchain.pem;
    ssl_certificate_key /tmp/exported-certs/$ssl_server_name/privkey.pem;

    location / {
      include /etc/nginx/snippets/set-headers.conf;
      proxy_pass http://localhost:8080;
    }
  }
localhost:/etc/nginx$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
localhost:/etc/nginx$ sudo nginx -s reload
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/20 10:52:48 [notice] 6250#6250: signal process started
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/error.log
2019/06/20 10:53:08 [error] 6251#6251: *67 cannot load certificate key "/tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem": BIO_new_file() failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib) while SSL handshaking, client: [IP ADDRESS REDACTED], server: 0.0.0.0:443

然后决定再次以www-data用户的身份进行检查，因为上一次我检查它是当certs位于letsencrypt文件夹中时，这一次我还记得检查cert和key：

代码语言：javascript
复制
localhost:/etc/nginx$ cat /etc/passwd | grep www-data
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
localhost:/etc/nginx$ sudo vim /etc/passwd
localhost:/etc/nginx$ cat /etc/passwd | grep www-data
www-data:x:33:33:www-data:/var/www:/bin/bash
localhost:/etc/nginx$ sudo su - www-data
No directory, logging in with HOME=/
localhost:/$ cat /tmp/exported-certs/[DOMAIN NAME REDACTED]/fullchain.pem
-----BEGIN CERTIFICATE-----
[CERT REDACTED]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[CERT REDACTED]
-----END CERTIFICATE-----
localhost:/$ cat /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
cat: /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem: Permission denied   <---- THERE IT IS!
localhost:/$ ls -l /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
-rw------- 1 root www-data 1704 Apr 17 18:53 /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
localhost:/$ exit
logout
localhost:/etc/nginx$ sudo chmod g+r /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
localhost:/etc/nginx$ sudo su - www-data
No directory, logging in with HOME=/
localhost:/$ cat /tmp/exported-certs/[DOMAIN NAME REDACTED]/privkey.pem
-----BEGIN PRIVATE KEY-----
[CERT REDACTED]
-----END PRIVATE KEY-----
localhost:/$ exit
logout
localhost:/etc/nginx$ sudo tail -n 1 /var/log/nginx/access.log
139.162.202.226 - [DOMAIN NAME REDACTED]:443 - [20/Jun/2019:11:04:08 +0100] "GET / HTTP/2.0" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15"

一旦我将www-data的组读权限添加到privkey.pem中，浏览器就能够加载该页。:)

感谢所有对这个问题的评论。

ssl
ssl-certificate
openssl
lets-encrypt
nginx
EN

回答 1

Server Fault用户

发布于 2019-06-20 07:40:55

好的，谢谢评论中的反馈。让我分享两个想法--不是直接解决你提到的问题，而是可能的解决办法.

准备而不是链接

我在某些特定情况下使用certbot (我猜和您一样)和haproxy。我有cron作业，只运行certbot，如果发出证书，它是连接证书和密钥(首选一个文件)，然后复制到haproxy在配置中期望它的位置。haproxy随后将重新启动。如果您无法解决这个问题，并且需要让它正常工作，可以尝试在某个地方为nginx“准备”证书，而不是链接到“原始”位置.

以www-数据用户

的身份运行certbot

您可以以运行nginx (www-data)的用户的身份运行certbot，因此从权限的角度来看，输出将适合于此目的。在这种情况下，您需要首先更改结构的所有权，例如/etc/letsencrypt/account...。

票数 0
EN
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://serverfault.com/questions/972146

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2024 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档