☰

NGINX BoringSSL HTTP3 ERR_CONNECTION_REFUSED

tag-icon • tag-icon nginx ubuntu ubuntu-22.04 quic http3
NGINX BoringSSL HTTP3 ERR_CONNECTION_REFUSED

一個ERR_CONNECTION_REFUSED當嘗試透過 Nginx 1.25.3 + BoringSSL 利用 HTTP/3 時，Google Chrome v.120 中出現錯誤。沒有錯誤，當 nginx-debug 開啟時，日誌中也沒有找到偵錯訊息，http2 與此配置配合良好，且https://cloudflare-quic.com/說瀏覽器可以使用 HTTP/3。

/etc/nginx/nginx.conf:

user  www-data;
worker_processes  1;

pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile       on;
    tcp_nopush     on;
    tcp_nodelay    on;
    types_hash_max_size 2048;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;
    

    ##
    # Access/Error Log Settings
    ##

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    error_log /var/log/nginx/error.log;

    ##
    # SSL Configuration
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;


    ##
    # FastCGI Cache Settings
    ##

    fastcgi_cache_path /etc/nginx-cache levels=1:2 keys_zone=phpcache:100m inactive=60m;
    fastcgi_cache_key "$scheme$request_method$host$request_uri";
    fastcgi_ignore_headers Cache-Control Expires;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

/etc/nginx/sites-enabled/website.conf:

server {
  server_name website.site;

  root /var/www/website/public_html/develop;
  index index.html;

  listen 443 quic reuseport;
  listen 443 ssl;

  http2 on;
  http3 on;

  quic_retry on;
  ssl_early_data on;

  add_header alt-svc 'h3=":443"; quic=":443"; ma=2592000;';

  ssl_protocols TLSv1.3;  

  ssl_certificate /etc/ssl/website.site.pem;
  ssl_certificate_key /etc/ssl/website.site-key.pem;
}

更新：我注意到的另一個有趣的行為是連接被重新導向到另一個可用的 nginx 虛擬主機（如果使用 quiche 服務，看起來監聽會被忽略）

我的解決方案：問題變成，如果憑證不被公開信任，Google Chrome 瀏覽器不會切換到 HTTP/3 協定（解決方案已找到）這裡）。不過，此處描述的可能原因有助於解決其他錯誤

答案1

您的 Web 瀏覽器首先建立 http/1 或 http/2 連線。所以你需要保留 2 個監聽指令。您應該取消註解：

    # listen 443 ssl http2;

並替換為：

    listen 443 ssl;
    http2 on;

因為在listen指令中不再接受http2。這是預設禁用的新指令，請參閱https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2

Syntax: http2 on | off;
Default:    
http2 off;
Context:    http, server
This directive appeared in version 1.25.1.

和https://nginx.org/en/docs/http/ngx_http_core_module.html#listen

"The parameter is deprecated, the http2 directive should be used instead."

另請參閱此工作範例：https://nginx.org/en/docs/quic.html#example

http {
    log_format quic '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" "$http3"';

    access_log logs/access.log quic;

    server {
        # for better compatibility it's recommended
        # to use the same port for quic and https
        listen 8443 quic reuseport;
        listen 8443 ssl;

        ssl_certificate     certs/example.com.crt;
        ssl_certificate_key certs/example.com.key;

        location / {
            # required for browsers to direct them to quic port
            add_header Alt-Svc 'h3=":8443"; ma=86400';
        }
    }
}

答案2

我找到了一個範例配置，您需要在虛擬主機中添加更多內容

server{
    listen 443 http3 quic reuseport;
    listen 443 ssl http2;

    quic_retry on;
    ssl_early_data on;

    http3_max_field_size 5000;
    http3_max_table_capacity 50;
    http3_max_blocked_streams 30;
    http3_max_concurrent_pushes 30;
    http3_push 10;
    http3_push_preload on;

    add_header alt-svc '$quic=":443"; ma=3600';
index index.html index.nginx-debian.html;
    server_name yourdomain.com www.yourdomain.com

    root /var/www/yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; 
}
server{
    if ($host = http3.codefaq.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;

    server_name yourdomain.com;
    return 404; # managed by Certbot


}

看這裡https://codefaq.org/server/how-to-install-http-3-quic-on-nginx-server-for-ubuntu/#adding-boringssl-and-http3

相關內容