/etc/nginx/
├── ssl/                     # 所有證書根目錄（禁止直接放 .pem?。?
│   ├── example.com/         # 每域名獨立子目錄
│   │   ├── fullchain.pem    # 證書鏈（含根+中間CA）
│   │   ├── privkey.pem      # 私鑰（必須 600 權(quán)限?。?
│   │   └── README.md        # 記錄簽發(fā)時間、CA、到期日、負責人
│   ├── api.example.com/
│   │   ├── fullchain.pem
│   │   ├── privkey.pem
│   │   └── README.md
│   └── client-b.com/
│       ├── fullchain.pem    # 第三方提供證書
│       ├── privkey.pem
│       └── README.md
├── conf.d/
│   ├── ssl-mapping.conf     # map 證書路徑的核心配置
│   ├── sites-enabled/
│   │   ├── example.com.conf
│   │   ├── api.example.com.conf
│   │   └── client-b.com.conf
└── nginx.conf               # 主配置，include ssl-mapping.conf

#!/bin/bash
# secure-certs.sh - 運行于 certbot/acme.sh hook 中
CERT_DIR="/etc/nginx/ssl"
NGINX_USER="www-data"  # Ubuntu/Debian 默認用戶

find "$CERT_DIR" -name "privkey.pem" -exec chmod 600 {} \;
find "$CERT_DIR" -name "fullchain.pem" -exec chmod 644 {} \;
chown -R "$NGINX_USER":"$NGINX_USER" "$CERT_DIR"

# === SSL Certificate Mapping by SNI ===
# 使用 map 指令將域名映射到證書路徑
# 注意：map 必須在 http{} 塊頂層定義，不可在 server{} 內(nèi)

map $ssl_server_name $upstream_cert {
    # 默認兜底證書（可選，用于未匹配域名的友好提示）
    default                          "/etc/nginx/ssl/_default/fullchain.pem";

    # 主站
    example.com                        "/etc/nginx/ssl/example.com/fullchain.pem";
    www.example.com                    "/etc/nginx/ssl/example.com/fullchain.pem";

    # API 服務(wù)
    api.example.com                    "/etc/nginx/ssl/api.example.com/fullchain.pem";
    staging-api.example.com            "/etc/nginx/ssl/api.example.com/fullchain.pem";

    # 運營后臺
    admin.example.com                  "/etc/nginx/ssl/admin.example.com/fullchain.pem";

    # 白標客戶
    client-a.brandpartner.net          "/etc/nginx/ssl/client-a.brandpartner.net/fullchain.pem";
    client-b.brandpartner.net          "/etc/nginx/ssl/client-b.brandpartner.net/fullchain.pem";

    # 國密證書（SM2）站點 —— 需 Nginx with OpenSSL 3.0+ & GMSSL
    sm2.example.com                    "/etc/nginx/ssl/sm2.example.com/fullchain_sm2.pem";
}

map $ssl_server_name $upstream_key {
    default                          "/etc/nginx/ssl/_default/privkey.pem";
    example.com                        "/etc/nginx/ssl/example.com/privkey.pem";
    www.example.com                    "/etc/nginx/ssl/example.com/privkey.pem";
    api.example.com                    "/etc/nginx/ssl/api.example.com/privkey.pem";
    staging-api.example.com            "/etc/nginx/ssl/api.example.com/privkey.pem";
    admin.example.com                  "/etc/nginx/ssl/admin.example.com/privkey.pem";
    client-a.brandpartner.net          "/etc/nginx/ssl/client-a.brandpartner.net/privkey.pem";
    client-b.brandpartner.net          "/etc/nginx/ssl/client-b.brandpartner.net/privkey.pem";
    sm2.example.com                    "/etc/nginx/ssl/sm2.example.com/privkey_sm2.pem";
}

# 可選：根據(jù)域名啟用不同 TLS 版本（如國密站強制 TLSv1.3）
map $ssl_server_name $tls_protocols {
    default                          "TLSv1.2 TLSv1.3";
    sm2.example.com                    "TLSv1.3";
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # 關(guān)鍵：動態(tài)證書路徑
    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;
    ssl_protocols       $tls_protocols;

    # 域名匹配（SNI 已由上層 map 解析，此處僅做路由）
    server_name api.example.com staging-api.example.com;

    # 強制 HSTS（生產(chǎn)環(huán)境必開）
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # OCSP Stapling 加速證書狀態(tài)驗證
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;
    resolver_timeout 5s;

    # 安全頭
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;

    # Java 后端代理（示例：Spring Boot 微服務(wù)）
    location / {
        proxy_pass https://backend-java-cluster;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 傳遞客戶端證書（如需雙向認證）
        proxy_ssl_verify off; # 生產(chǎn)請開啟并配置 ca.crt
    }

    # 健康檢查端點（不走 Java 邏輯，Nginx 直答）
    location /healthz {
        return 200 'OK';
        add_header Content-Type text/plain;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;

    # 客戶提供證書，可能為 OV 或 EV，需特殊 Header
    server_name client-b.brandpartner.net;

    # 客戶要求：暴露證書信息至響應(yīng)頭（合規(guī)審計用）
    ssl_certificate_info on; # Nginx 1.19.7+
    add_header X-Cert-Issuer $ssl_client_i_dn_o;
    add_header X-Cert-Subject $ssl_client_s_dn_cn;

    location / {
        # 代理至客戶指定后端（可能是 Java Tomcat 集群）
        proxy_pass http://client-b-tomcat;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 檢查語法
sudo nginx -t

# 查看當前加載的證書映射（調(diào)試用）
sudo nginx -T 2>/dev/null | grep -A5 "map \$ssl_server_name"

# 測試特定域名證書是否匹配
openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer

server:
  forward-headers-strategy: framework  # 啟用 Spring 對 X-Forwarded-* 的解析

# 若使用 Tomcat（默認）
server:
  tomcat:
    remote-ip-header: x-forwarded-for
    protocol-header: x-forwarded-proto
    internal-proxies: 127\.0\.0\.1|::1|10\.0\.0\.0/8|172\.16\.0\.0/12|192\.168\.0\.0/16

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
        // 開啟 HTTP 重定向到 HTTPS（僅當 Nginx 未做時啟用）
        tomcat.addAdditionalTomcatConnectors(redirectConnector());
        return tomcat;
    }

    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(8080); // Nginx 將 80→443，此端口僅內(nèi)部訪問
        connector.setSecure(false);
        connector.setRedirectPort(8443); // 此端口實際由 Nginx 終結(jié)
        connector.setProperty("proxyPort", "443");
        connector.setProperty("proxyName", "api.example.com");
        return connector;
    }

    // ? 關(guān)鍵：覆蓋默認 ForwardedHeaderFilter，添加 X-Forwarded-Host 支持
    @Bean
    public Filter forwardedHeaderFilter() {
        ForwardedHeaderFilter filter = new ForwardedHeaderFilter();
        filter.setTrustedProxies(Pattern.compile("127\\.0\\.0\\.1|10\\.\\d+\\.\\d+\\.\\d+|172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d+\\.\\d+|192\\.168\\.\\d+\\.\\d+"));
        return filter;
    }
}

@RestController
public class UrlController {

    @GetMapping("/debug/url")
    public Map<String, String> debugUrl(HttpServletRequest request) {
        Map<String, String> info = new HashMap<>();
        info.put("scheme", request.getScheme());                    // ? 返回 "https"
        info.put("serverName", request.getServerName());            // ? 返回 "api.example.com"
        info.put("requestURL", request.getRequestURL().toString()); // ? 返回 "https://api.example.com/debug/url"
        info.put("forwardedProto", request.getHeader("X-Forwarded-Proto")); // "https"
        info.put("forwardedHost", request.getHeader("X-Forwarded-Host"));     // "api.example.com"
        return info;
    }

    // ? 安全重定向：自動使用 HTTPS 協(xié)議
    @GetMapping("/secure-redirect")
    public ResponseEntity<Void> secureRedirect() {
        return ResponseEntity.status(HttpStatus.MOVED_PERMANENTLY)
                .header(HttpHeaders.LOCATION, "/dashboard") // Spring 自動補全 scheme+host
                .build();
    }
}

@Component
public class ClientIpResolver {

    public String getClientIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("X-Real-IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        // 取第一個 IP（XFF 可能為 "a,b,c"）
        if (ip != null && ip.contains(",")) {
            ip = ip.split(",")[0].trim();
        }
        return ip;
    }
}

curl https://get.acme.sh | sh
source ~/.acme.sh/acme.sh.env
acme.sh --set-default-ca --server letsencrypt

# 假設(shè)使用阿里云 DNS
export Ali_Key="your_access_key"
export Ali_Secret="your_access_secret"

acme.sh --issue \
  -d api.example.com \
  -d staging-api.example.com \
  --dns dns_ali \
  --keylength ec-256 \
  --pre-hook "/usr/local/bin/secure-certs.sh" \
  --deploy-hook "/usr/local/bin/reload-nginx.sh"

#!/bin/bash
# /usr/local/bin/reload-nginx.sh

DOMAIN=$1  # acme.sh 傳入的域名
CERT_DIR="/etc/nginx/ssl/$DOMAIN"
NGINX_CONF="/etc/nginx/conf.d/ssl-mapping.conf"

# 創(chuàng)建域名目錄
mkdir -p "$CERT_DIR"

# 復制證書（acme.sh 輸出路徑固定）
cp "$HOME/.acme.sh/$DOMAIN/fullchain.cer" "$CERT_DIR/fullchain.pem"
cp "$HOME/.acme.sh/$DOMAIN/$DOMAIN.key" "$CERT_DIR/privkey.pem"

# 權(quán)限加固
chmod 600 "$CERT_DIR/privkey.pem"
chmod 644 "$CERT_DIR/fullchain.pem"
chown www-data:www-data "$CERT_DIR" "$CERT_DIR/*"

# ? 關(guān)鍵：自動更新 ssl-mapping.conf 中的 map 條目
# 使用 sed 在 map 塊中追加或替換（生產(chǎn)環(huán)境建議用更健壯的 awk/python 腳本）
if ! grep -q "$DOMAIN" "$NGINX_CONF"; then
    sed -i "/default.*;/a \    $DOMAIN                        \"\/etc\/nginx\/ssl\/$DOMAIN\/fullchain.pem\";" "$NGINX_CONF"
    sed -i "/default.*;/a \    $DOMAIN                        \"\/etc\/nginx\/ssl\/$DOMAIN\/privkey.pem\";" "$NGINX_CONF"
fi

# 語法檢查 + 重載
if nginx -t 2>/dev/null; then
    systemctl reload nginx
    echo "? Nginx reloaded for $DOMAIN"
else
    echo "? Nginx config error for $DOMAIN"
    exit 1
fi

# crontab -e
0 3 * * * "/root/.acme.sh/acme.sh" --cron --home "/root/.acme.sh" > /var/log/acme.sh.log 2>&1

# /etc/nginx/conf.d/sm2.example.com.conf
server {
    listen 443 ssl http2;
    listen 4433 ssl http2;  # 國密專用端口

    # 匹配國密證書
    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;

    # 強制國密套件
    ssl_ciphers ECDHE-SM2-WITH-SMS4-SM3:ECDHE-SM2-WITH-SMS4-GCM-SM3;
    ssl_prefer_server_ciphers off;

    # ALPN 聲明（國密客戶端識別）
    ssl_alpn_protocols "sm2";

    server_name sm2.example.com;

    location / {
        proxy_pass https://sm2-java-backend;
        proxy_ssl_protocols TLSv1.3;
        proxy_ssl_ciphers ECDHE-SM2-WITH-SMS4-GCM-SM3;
        proxy_ssl_verify off;
    }
}

<!-- pom.xml -->
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk15on</artifactId>
    <version>1.70</version>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.70</version>
</dependency>

@Configuration
public class Sm2Config {

    @Bean
    public SSLContext sm2SslContext() throws Exception {
        Security.addProvider(new BouncyCastleProvider());
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        try (InputStream is = getClass().getResourceAsStream("/sm2/keystore.p12")) {
            keyStore.load(is, "password".toCharArray());
        }

        KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(keyStore, "password".toCharArray());

        SSLContext context = SSLContext.getInstance("TLSv1.3");
        context.init(kmf.getKeyManagers(), null, new SecureRandom());
        return context;
    }
}

# 在 http{} 塊中定義 log_format
log_format cert_info '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'cert="$ssl_server_name" '
                     'not_after="$ssl_certificate_not_after"';

access_log /var/log/nginx/access.log cert_info;

# alert.rules
groups:
- name: ssl-certificate-alerts
  rules:
  - alert: SSLCertificateExpiringSoon
    expr: (time() - nginx_ssl_certificate_not_after{job="nginx"}) / 3600 < 168
    for: 1h
    labels:
      severity: warning
    annotations:
      summary: "SSL certificate for {{ $labels.cert }} expires in less than 7 days"
      description: "Certificate for {{ $labels.cert }} expires at {{ $value }}"

  - alert: SSLCertificateExpired
    expr: time() > nginx_ssl_certificate_not_after{job="nginx"}
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "SSL certificate for {{ $labels.cert }} has expired"

@Component
public class CertificateHealthIndicator implements HealthIndicator {

    private final String CERT_PATH = "/etc/nginx/ssl/example.com/fullchain.pem";

    @Override
    public Health health() {
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            try (InputStream is = Files.newInputStream(Paths.get(CERT_PATH))) {
                X509Certificate cert = (X509Certificate) cf.generateCertificate(is);
                Date notAfter = cert.getNotAfter();
                long daysLeft = TimeUnit.MILLISECONDS.toDays(notAfter.getTime() - System.currentTimeMillis());
                if (daysLeft < 7) {
                    return Health.down()
                            .withDetail("certificate", CERT_PATH)
                            .withDetail("expiresInDays", daysLeft)
                            .withDetail("notAfter", notAfter.toString())
                            .build();
                }
            }
            return Health.up().build();
        } catch (Exception e) {
            return Health.down().withException(e).build();
        }
    }
}