ssl - 在 nginx 中记录 SSL 握手失败原因以及客户端 IP

Question

我有一个nginx.conf如下所示的配置文件：

user vagrant;
worker_processes auto;


error_log /var/log/nginx/error.log debug;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 1024;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        # defining log format
        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$ssl_protocol '
                          '$status $body_bytes_sent "$host" "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';


        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;


        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log main;


##
        # Gzip Settings
        ##
    gzip on;

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

以及我的个人服务器配置，如下所示：

server {

    # listen on port 443 (https)

    listen 443 ssl;
    server_name www.domain.org domain.org;

    # location of the self-signed SSL certificate

    ssl_certificate /home/vagrant/certs/domain.org.crt;
    ssl_certificate_key /home/vagrant/domain.org.key;

    #log SSL errors

    error_log /var/log/nginx/error_tls_2.log debug;

    location / {

        # forward application requests to the gunicorn server

        proxy_pass http://localhost:8000;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

}

我希望能够记录带有特定请求客户端 IP 的 SSL 握手失败错误以及 SSL 握手失败的原因。更具体地说，我正在测试服务器证书过期时收到的错误类型。但是，在我记录错误的日志文件中，日志格式是这种形式：

2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN supported by client: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN selected: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL handshake handler: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL: TLSv1.2, cipher: "ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD"
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 5
2019/04/11 22:43:02 [debug] 3086#3086: *27 peer shutdown SSL cleanly
2019/04/11 22:43:02 [info] 3086#3086: *27 client closed connection while waiting for request, client: 192.168.33.1, server: 0.0.0.0:443
2019/04/11 22:43:02 [debug] 3086#3086: *27 close http connection: 4
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_shutdown: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 event timer del: 4: 2302465
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0A855C0, unused: 24

可以看出，这些行都不允许我区分客户端的 IP 或 SSL 握手失败的原因。谁能帮助我如何做到这一点？

标签： sslnginx