mirror of
https://github.com/0xJacky/nginx-ui.git
synced 2026-04-25 08:45:58 +03:00
[GH-ISSUE #1243] 证书申请报错 #6457
Labels
No labels
Q/A
bug
casdoor
dependencies
docker
documentation
duplicate
enhancement
help wanted
invalid
lego
platform:openwrt
platform:windows
pull-request
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/nginx-ui#6457
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @liuhd92 on GitHub (Jul 19, 2025).
Original GitHub issue: https://github.com/0xJacky/nginx-ui/issues/1243
申请证书的时候报错如下
正在获取证书，请稍等...
2025/07/19 17:45:30 [INFO] [Nginx UI] 正在准备 Lego 的配置
2025/07/19 17:45:30 [INFO] [Nginx UI] ACME User: System Initial User, Email: liuhd92@163.com, CA Dir: https://acme-v02.api.letsencrypt.org/directory
2025/07/19 17:45:30 [INFO] [Nginx UI] 正在创建客户端用于与 CA 服务器通信
2025/07/19 17:45:35 [INFO] [Nginx UI] 使用 HTTP01 challenge provider
2025/07/19 17:45:35 [INFO] [Nginx UI] 正在获取证书
2025/07/19 17:45:35 [INFO] [www.yujianfengkong.cn] acme: Obtaining bundled SAN certificate
2025/07/19 17:45:37 [INFO] [www.yujianfengkong.cn] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/2071784517/555484105331
2025/07/19 17:45:37 [INFO] [www.yujianfengkong.cn] acme: Could not find solver for: tls-alpn-01
2025/07/19 17:45:37 [INFO] [www.yujianfengkong.cn] acme: use http-01 solver
2025/07/19 17:45:37 [INFO] [www.yujianfengkong.cn] acme: Trying to solve HTTP-01
2025/07/19 17:45:43 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/2071784517/555484105331
2025/07/19 17:45:44 [INFO] [Nginx UI] 正在重载 Nginx
obtain certificate error: error: one or more domains had a problem: [www.yujianfengkong.cn] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 14.215.41.169: Invalid response from http://www.yujianfengkong.cn/.well-known/acme-challenge/xTv-zQ2PJdW35quzkHfI_MJvt0yawezgbquJ17AgnFA: 403
@0xJacky commented on GitHub (Jul 19, 2025):
可以手动添加一下
@liuhd92 commented on GitHub (Jul 19, 2025):
您的这个入口是从哪点进去的，整个找下来没找到，另外设置模板就可以解决这个问题吗？
@0xJacky commented on GitHub (Jul 19, 2025):
一般来说是会自动添加的，但是偶尔可能因为配置文件解析的问题导致无法添加，这个时候就需要手动添加一下并保存配置文件，再签发就可以了
@liuhd92 commented on GitHub (Jul 19, 2025):
@0xJacky commented on GitHub (Jul 19, 2025):
更新一下到最新的版本
@liuhd92 commented on GitHub (Jul 19, 2025):
国内的ecs无法访问到github的资源下载地址，有国内的地址代替吗
@0xJacky commented on GitHub (Jul 19, 2025):
安装最新稳定版本
bash -c "$(curl -L https://cloud.nginxui.com/install.sh)" @ install -r https://cloud.nginxui.com/
@0xJacky commented on GitHub (Jul 19, 2025):
这个应该是可以在大陆 ECS 高速下载的
@0xJacky commented on GitHub (Jul 19, 2025):
更新到最新版之后，后续的 OTA 都会通过 cloud.nginxui.com 代理而不是直接从 github 下载
@liuhd92 commented on GitHub (Jul 19, 2025):
版本已更新，但是没有，还是报错
正在获取证书，请稍等...
[Nginx UI] 正在准备 lego 配置
[Nginx UI] ACME 用户：System Initial User，邮箱：liuhd92@163.com，CA 目录：https://acme-v02.api.letsencrypt.org/directory
[Nginx UI] 正在创建客户端用于与 CA 服务器通信
[Nginx UI] 正在设置 HTTP01 验证提供程序
[Nginx UI] 正在获取证书
2025/07/19 19:03:12 [INFO] [www.yujianfengkong.cn] acme: Obtaining bundled SAN certificate
2025/07/19 19:03:13 [INFO] [www.yujianfengkong.cn] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/2071784517/555511550371
2025/07/19 19:03:13 [INFO] [www.yujianfengkong.cn] acme: Could not find solver for: tls-alpn-01
2025/07/19 19:03:13 [INFO] [www.yujianfengkong.cn] acme: use http-01 solver
2025/07/19 19:03:13 [INFO] [www.yujianfengkong.cn] acme: Trying to solve HTTP-01
2025/07/19 19:03:21 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/2071784517/555511550371
obtain cert error: error: one or more domains had a problem: [www.yujianfengkong.cn] invalid authorization: acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 222.210.35.11: Invalid response from http://www.yujianfengkong.cn/.well-known/acme-challenge/IIng3QcCNig2RpPR3FtvwrDuiunrmnEVLN3kWGjUZxE: 403
@liuhd92 commented on GitHub (Jul 19, 2025):
也设置模版了
@0xJacky commented on GitHub (Jul 19, 2025):
噢 我知道了，你是不是现有的配置文件里设置了 .well-known deny
@liuhd92 commented on GitHub (Jul 19, 2025):
@0xJacky commented on GitHub (Jul 19, 2025):
要看 www. 的不是 t.
@liuhd92 commented on GitHub (Jul 19, 2025):
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name www.yujianfengkong.cn;
root /home/projects/php/yjfk-gw-service/public;
index index.php index.html;
# 详细的错误日志
error_log /var/log/nginx/yjgw_error.log debug;
access_log /var/log/nginx/yjgw_access.log combined;
location / {
index index.php index.html;
if (!-e $request_filename) {
rewrite ^(.+?.php)(/.+)$ /$1?s=$2 last;
rewrite ^/(.)$ /index.php?s=$1 last;
}
autoindex off;
}
# 注册落地页
location ^~ /landing {
alias /home/projects/web/yjfk-landing-release/;
index index.html;
try_files $uri $uri/ /landing/index.html =404;
}
# h5进件
location ^~ /h5 {
alias /home/projects/web/yjfk-h5-release/;
index index.html;
try_files $uri $uri/ /h5/index.html =404;
}
location ~ .php(.)$ {
#location ~ [^/].php(/|$) {
# PHP-FPM 配置
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
fastcgi_index index.php;
fastcgi_split_path_info ^((?U).+.php)(/?.+)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
include fastcgi_params;
}
# 静态文件缓存
location
* .(js|css|png|jpg|jpeg|gif|ico|svg)$ {/chrome-extension/ {expires max;
log_not_found off;
access_log off;
try_files $uri =404;
}
# favicon.ico
location = /favicon.ico {
access_log off;
log_not_found off;
try_files $uri =404;
}
# robots.txt
location = /robots.txt {
access_log off;
log_not_found off;
}
# 阻止直接访问 chrome-extension
location ^
return 404;
}
# 禁止访问隐藏文件
location ~ /. {
deny all;
}
# 禁止访问 PHP 文件备份
location ~ .*.(php~|php#|php.bak|php.old)$ {
deny all;
}
location ~ /.well-known/acme-challenge {
proxy_set_header Host $host;
proxy_set_header X-Real_IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
proxy_pass http://127.0.0.1:9180;
}
}
@liuhd92 commented on GitHub (Jul 19, 2025):
@0xJacky commented on GitHub (Jul 19, 2025):
把这个移除吧
@0xJacky commented on GitHub (Jul 19, 2025):
你当前的配置中：
禁止访问隐藏文件
location ~ /..* {
deny all;
}
这条规则会 拦截所有以 . 开头的路径，包括 /.well-known/acme-challenge/...，从而导致 Let’s Encrypt 的 ACME 验证失败。
而你又在后面配置了：
location ~ /.well-known/acme-challenge {
proxy_set_header Host $host;
proxy_set_header X-Real_IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
proxy_pass http://127.0.0.1:9180;
}
但因为 location ~ /..* 匹配到了 .well-known，它的优先级更高，所以不会走到你设定的 .well-known 代理逻辑。
⸻
✅ 正确做法：将 .well-known/acme-challenge 的配置提前，放在 deny all 之前
Nginx 的 location 匹配顺序对正则是“先写的优先”，所以你应该将 .well-known 的规则提前到 deny all 之前：
放在 deny all 前面！
location ~ ^/.well-known/acme-challenge/ {
proxy_set_header Host $host;
proxy_set_header X-Real_IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
proxy_pass http://127.0.0.1:9180;
}
禁止访问隐藏文件（拦截 .git、.env 等）
location ~ /.(?!well-known) {
deny all;
}
⸻
🔒 解读改法的意义
• ~ ^/.well-known/acme-challenge/：匹配 ACME 验证路径，必须在最前面，确保能被命中。
• ~ /.(?!well-known)：使用负向前瞻（negative lookahead），表示不匹配 .well-known 目录，其余所有以点开头的路径仍然被 deny all。
⸻
✅ 测试是否生效
你可以创建一个测试文件：
mkdir -p /home/projects/php/yjfk-gw-service/public/.well-known/acme-challenge/
echo "test" > /home/projects/php/yjfk-gw-service/public/.well-known/acme-challenge/test123
然后访问：
http://www.yujianfengkong.cn/.well-known/acme-challenge/test123
应返回 test 或走你的代理逻辑。否则就说明 .well-known 仍被 deny 拦住了。