Docker Nginx 配置 SSL 证书完整教程

本文讲解使用 Docker Compose 部署 Nginx 反向代理并配置 SSL 证书的完整流程。

目录结构

project/
├── compose.yaml
└── nginx/
    ├── conf.d/
    │   └── default.conf
    └── certs/
        ├── fullchain.pem
        └── privkey.pem

不要把私钥通过 COPY 写入 Docker 镜像，也不要提交到 Git。

Nginx 配置

nginx/conf.d/default.conf：

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    return 308 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

    server_name example.com www.example.com;

    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://app:3000;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

较旧版本 Nginx 如果不支持 http2 on;，可改为：

listen 443 ssl http2;

Compose 配置

compose.yaml：

services:
  nginx:
    image: nginx:1.27-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/certs:/etc/nginx/certs:ro
    depends_on:
      - app

  app:
    image: your-app-image:latest
    restart: unless-stopped
    expose:
      - "3000"

app 是 Compose 服务名，Nginx 可以通过 Docker 内置 DNS 解析它。后端不需要把 3000 端口发布到公网。

启动和检查

docker compose config
docker compose up -d
docker compose exec nginx nginx -t
docker compose logs --tail=100 nginx

验证：

curl -I http://example.com
curl -I https://example.com

openssl s_client \
  -connect example.com:443 \
  -servername example.com \
  -showcerts

证书续期

更新宿主机证书后：

docker compose exec nginx nginx -t
docker compose exec nginx nginx -s reload

建议挂载整个证书目录，而不是单独挂载证书文件。Certbot 更新证书时经常会替换符号链接或 inode，单文件挂载可能导致容器仍然看到旧文件。

通用检查重点

• •证书 SAN 包含实际域名
• •fullchain.pem 包含中间证书
• •私钥与证书匹配
• •TCP 443 已在云安全组和系统防火墙中开放