On 6/2/20 8:27 AM, Francis Daly wrote:
> That suggests that if you choose to use "proxy_ssl_server_name on;",
> then you almost certainly do not want to add your own "proxy_set_header
> Host" value.
>
> The nginx code probably should not try to check for (and reject) that
> combination of directives-and-values; but might it be worth adding a
> note to http://nginx.org/r/proxy_ssl_server_name to say that that other
> directive is probably a bad idea, especially if you get a http 421 response
> from your upstream?

trying to simplify/repeat, i've

vhost config,

upstream test-upstream {
server test.example.com:11111;
}

server {
listen 10.10.10.1:443 ssl http2;
server_name example.com;

...
location /app1 {

proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
proxy_ssl_certificate "/etc/ssl/nginx/test.client.crt";
proxy_ssl_certificate_key "/etc/ssl/nginx/test.client.key";
proxy_ssl_trusted_certificate "/etc/ssl/nginx/ca_int.crt";

proxy_pass https://test-upstream/;
proxy_ssl_server_name on;
proxy_ssl_name test.example.com;

}
}

and, upstream config

server {
listen 127.0.0.1:11111 ssl http2;
server_name test.example.com;

root /srv/www/test;
index index.php;
expires -1;

ssl_certificate "/etc/ssl/nginx/test.server.crt";
ssl_certificate_key "/etc/ssl/nginx/test.server.key";
ssl_trusted_certificate "/etc/ssl/nginx/ca_int.crt";

ssl_verify_client off;
ssl_verify_depth 2;
ssl_client_certificate "/etc/ssl/nginx/ca_int.crt";

location ~ \.php {
try_files $uri =404;
fastcgi_pass phpfpm;
fastcgi_index index.php;
fastcgi_param PATH_INFO $fastcgi_script_name;
include includes/fastcgi/fastcgi_params;
}

error_log /var/log/nginx/test.error.log info;
}

on access to

https://example.com/app1

still get

421 Misdirected Request

in log

==> /var/log/nginx/test.error.log <==
2020/06/02 11:52:13 [info] 8713#8713: *18 client attempted to request the server name different from the one that was negotiated while reading client request headers, client: 127.0.0.1, server: test.example.com, request: "GET / HTTP/1.0", host: "test-upstream"

Is that

host: "test-upstream"

to be expected? it's an upstream name, not an actual host.

Still unable to wrap my head around where this mis-match is coming from ... I have a nagging suspicion I'm missing something *really* obvious :-/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx