summary: [通過Nginx實作NCC的https訪問，并解決UClient應用的問題]

1 概述

通過Nginx 安裝配置反向代理，實作NC、NCC的https訪問，

本文以NCC2005為例，說明如何配置Nginx、NCC，以及解決UClient無法訪問https代理的問題，

其他版本的NC可以以此類推，

2 實作需求

NCC2005應用地址：http://10.16.51.147:2005

Nginx_1.22.0服務地址：10.16.51.147

最終實作代理訪問：

https://10.16.51.147 -> http://10.16.51.147:2005

https://10.16.51.147:4433 -> http://10.16.51.147:2005

http://10.16.51.147 -> http://10.16.51.147:2005

3 解決方案

3.1 Nginx配置

nginx.conf檔案配置如下：

# Generated by nginxconfig.io
# See nginxconfig.txt for the configuration share link

user                 root;
pid                  /run/nginx.pid;
worker_processes     auto;
worker_rlimit_nofile 65535;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

# Load modules
include              /usr/local/nginx/conf/modules-enabled/*.conf;

events {
    multi_accept       on;
    worker_connections 65535;
}

http {
    charset                utf-8;
    sendfile               on;
    tcp_nopush             on;
    tcp_nodelay            on;
    server_tokens          off;
    log_not_found          off;
    types_hash_max_size    2048;
    types_hash_bucket_size 64;
    client_max_body_size   2048M;

    # MIME
    include                mime.types;
    default_type           application/octet-stream;

    # Logging
    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';
    access_log             logs/access.log;
    error_log              logs/error.log warn;

    # SSL
    ssl_session_timeout    1d;
    ssl_session_cache      shared:SSL:10m;
    ssl_session_tickets    off;

    # Diffie-Hellman parameter for DHE ciphersuites
    # ssl_dhparam            /usr/local/nginx/conf/dhparam.pem;

    # Mozilla Old configuration
    ssl_protocols             SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;
    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    # ssl_stapling           on;
    # ssl_stapling_verify    on;
    # resolver               1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    # resolver_timeout       2s;
    # ssl_trusted_certificate /usr/local/nginx/conf/ssl/ncc2005.cxjk.com.crt;

    # Connection header for WebSocket reverse proxy
    # map $http_upgrade $connection_upgrade {
    #     default upgrade;
    #     ""      close;
    # }

    # map $remote_addr $proxy_forwarded_elem {

    #     # IPv4 addresses can be sent as-is
    #     ~^[0-9.]+$        "for=$remote_addr";

    #     # IPv6 addresses need to be bracketed and quoted
    #     ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";

    #     # Unix domain socket names cannot be represented in RFC 7239 syntax
    #     default           "for=unknown";
    # }

    # map $http_forwarded $proxy_add_forwarded {

    #     # If the incoming Forwarded header is syntactically valid, append to it
    #     "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";

    #     # Otherwise, replace it
    #     default "$proxy_forwarded_elem";
    # }

    # Load configs
    include /usr/local/nginx/conf/conf.d/*.conf;

    # ncc2005.cxjk.com
    server {
        listen                             443 ssl;
        listen                             [::]:443 ssl;
        server_name                        10.16.51.147;

        # SSL
        ssl_certificate                    /usr/local/nginx/ssl/server.crt;
        ssl_certificate_key                /usr/local/nginx/ssl/server.key;
        
        # security headers
        # add_header X-XSS-Protection        "1; mode=block" always;
        # add_header X-Content-Type-Options  "nosniff" always;
        # add_header Referrer-Policy         "no-referrer-when-downgrade" always;
        # add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
        # add_header Permissions-Policy      "interest-cohort=()" always;
        
        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        # . files
        location ~ /\.(?!well-known) {
            deny all;
        }

        # logging
        access_log logs/ncc2005.cxjk.com.access.log;
        error_log  logs/ncc2005.cxjk.com.error.log warn;

        # reverse proxy
        location / {
            proxy_pass                         http://10.16.51.147:2005;
            proxy_set_header Host              $http_host; # ncc必須設定
            proxy_http_version                 1.1; # 定義用于代理的HTTP協議版本，默認情況下將其設定為1.0，對于Websocket和 keepalive 連接，需要使用1.1版
            
            # proxy_cache_bypass                 $http_upgrade; # 設定不從快取中獲取回應的條件

            # Proxy SSL
            proxy_ssl_server_name              on;

            # Proxy headers
            # 如果應用程式使用Websockets，則這些Upgrade、Connection欄位是必填欄位
            # proxy_set_header Upgrade           $http_upgrade;
            # proxy_set_header Connection        $connection_upgrade;
            proxy_set_header Connection		   "";
            proxy_set_header X-Real-IP         $remote_addr; # 將真實的訪客遠程IP地址轉發到代理服務器
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for; # ncc必須設定（包含客戶端被代理的每個服務器的IP地址的串列）
            # proxy_set_header X-Forwarded-Proto $scheme; # ncc不可設定此引數（在HTTPS服務器塊中使用時，來自代理服務器的每個HTTP回應都會重寫為HTTPS）
            proxy_set_header X-Forwarded-Host  $host; # 定義客戶端請求的原始主機
            proxy_set_header X-Forwarded-Port  $server_port; # 定義客戶端請求的原始埠

            # Proxy timeouts 超時設定不宜過短，否則類似匯入資料這樣的長業務場景會發生upstream time out錯誤
            proxy_connect_timeout              7200s;
            proxy_send_timeout                 7200s;
            proxy_read_timeout                 7200s;

            proxy_redirect http:// $scheme://; # ncc必須設定，否則輕量端訪問例外（將后端回應header location內容中的http://替換成用戶端協議https://），如果做了http強轉https，且都是采用默認埠（80,443），則可不設定此引數，因為重定向后的http:80會轉為https:443，

            proxy_headers_hash_max_size 512;
            proxy_headers_hash_bucket_size 128; 
        }

        # favicon.ico
        location = /favicon.ico {
            log_not_found off;
            access_log    off;
        }

        # robots.txt
        location = /robots.txt {
            log_not_found off;
            access_log    off;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # gzip
        gzip            on;
        gzip_vary       on;
        gzip_proxied    any;
        gzip_comp_level 6;
        gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
        gzip_min_length 10k;
        gzip_disable "MSIE [1-6]\.";
    }

    # 4433 埠
    server {
        listen                             4433 ssl;
        listen                             [::]:4433 ssl;
        server_name                        10.16.51.147;

        # SSL
        ssl_certificate                    /usr/local/nginx/ssl/server.crt;
        ssl_certificate_key                /usr/local/nginx/ssl/server.key;
            
        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        # . files
        location ~ /\.(?!well-known) {
            deny all;
        }

        # logging
        access_log logs/ncc2005.cxjk.com.access.log;
        error_log  logs/ncc2005.cxjk.com.error.log warn;

        # reverse proxy
        location / {
            proxy_pass                         http://10.16.51.147:2005;
            proxy_set_header Host              $http_host; # ncc必須設定
            proxy_http_version                 1.1; # 定義用于代理的HTTP協議版本，默認情況下將其設定為1.0，對于Websocket和 keepalive 連接，需要使用1.1版

            # Proxy SSL
            proxy_ssl_server_name              on;

            # Proxy headers

            proxy_set_header X-Real-IP         $remote_addr; # 將真實的訪客遠程IP地址轉發到代理服務器
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for; # ncc必須設定（包含客戶端被代理的每個服務器的IP地址的串列）
            proxy_set_header X-Forwarded-Host  $host; # 定義客戶端請求的原始主機
            proxy_set_header X-Forwarded-Port  $server_port; # 定義客戶端請求的原始埠

            # Proxy timeouts 超時設定不宜過短，否則類似匯入資料這樣的長業務場景會發生upstream time out錯誤
            proxy_connect_timeout              7200s;
            proxy_send_timeout                 7200s;
            proxy_read_timeout                 7200s;

            proxy_redirect http:// $scheme://; # ncc必須設定，否則輕量端訪問例外（將后端回應header location內容中的http://替換成用戶端協議https://）

            proxy_headers_hash_max_size 512;
            proxy_headers_hash_bucket_size 128; 
        }

        # favicon.ico
        location = /favicon.ico {
            log_not_found off;
            access_log    off;
        }

        # robots.txt
        location = /robots.txt {
            log_not_found off;
            access_log    off;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # gzip
        gzip            on;
        gzip_vary       on;
        gzip_proxied    any;
        gzip_comp_level 6;
        gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
        gzip_min_length 10k;
        gzip_disable "MSIE [1-6]\.";
    }

    # HTTP redirect http轉為https
    server {
        listen      80;
        listen      [::]:80;
        server_name 10.16.51.147;
        # 兩種方式均可
        return      301 https://10.16.51.147$request_uri;
        # rewrite ^(.*) https://10.16.51.147$1 permanent; 
    }
}

3.2 NCC配置

完成Nginx配置后，輕量端就可以訪問了，如果還需要使用UClient訪問輕量端及重量端，則需要執行以下步驟：

安裝補丁《patch_ncc2005_20221017_Uclient無法正確下載https應用問題_v1.1_liyas》

組態檔

配置https應用，在以下檔案中加入引數設定：scheme=https （該引數不為空時，優先使用該引數設定的協議，否則使用UClient傳入的protocol）

輕量端https協議配置：ncchome\hotwebs\nccloud\WEB-INF\config\uclient_appconfig.properties

重量端https協議配置：ncchome\webapps\nc_web\Client\uclient_appconfig.properties

4 常見問題

4.1 瀏覽器無法訪問應用

https://10.16.51.147/nccloud可以正常訪問，而非443埠https://10.16.51.147:4433/nccloud無法訪問，需要在Nginx中加入配置proxy_redirect http:// $scheme://;

4.2 UClient無法正常下載和訪問輕量端及重量端的ncc應用

因為當前版本的UClient在搜索下載應用時，會將https協議變更為http，導致無法正確下載應用，該問題需要通過上述的補丁解決，

相關問題具體表現如下：

4.2.1 下載應用錯誤

搜索https://10.16.51.147，下載的重量端應用為http://host:80，點擊無法方法應用，
搜索https://10.16.51.147，下載的輕量端應用為http://host:80/nccloud，點擊無法訪問
搜索https://10.16.51.147:4433，無法下載重量端，無法下載輕量端

4.2.2 80埠通過Nginx強轉后無法在Uclient訪問

通過https://10.16.51.147 下載的輕量端應用實際訪問地址是http://host:80/nccloud，Nginx已經做了強轉，但是點擊應用后提示頁面錯誤，無法訪問URLhttps://10.16.51.147/nccloud,
再次點擊該URL，則可正常進入系統，

該問題需要UClient修復，

4.2.3 手工修復本地app.esc的應用下載地址，安裝應用后訪問例外

手工修改輕量端應用的app.esc下載地址為https://10.16.51.147:4433/nccloud，安裝輕量應用，點擊應用訪問地址欄訪問的是http://10.16.51.147:4433/nccloud，頁面提示400錯誤：The plain HTTP request was sent to HTTPS por，

問題現象及方案同問題1，

5 延伸閱讀

NC-UClient下載安裝應用詳解

轉載請註明出處，本文鏈接：https://www.uj5u.com/qiye/526896.html

標籤：其他

上一篇：NC 使用Nginx實作https的反向代理

下一篇：CGCS2000坐標系和WGS84坐標系的區別與聯系