如何在同一台机器上设置多个nodejs-https-服务器的https反向代理（许多域和证书，一个VPS和IP）
目前，我们在一台 VPS 上有大约 10 个客户网站和网络系统。他们都共享相同的IP。
我们使用node-http-proxy在nodejs中构建了自己的代理逻辑，它匹配域并传递到不同站点的不同端口上的node-http服务器，或者如果没有nodejs-service则传递到apache为特定路径设置。这在安静的一段时间里效果很好。
现在，我们正在为其中一位客户实施信用卡付款，并且需要 https 连接。我重新编码了代理来处理 https 并且它有效。但是，我们不想在代理上使用客户证书。当另一个客户站点需要 https 连接时，我们希望它能够工作。
是否可以设置一个nodejs-reverse-proxy来传递https请求而不“验证”它，以便接收节点https服务器“验证它”？
或者其他一些反向代理，如果它不能在我们之前用nodejs完成？
Currently we have about 10 clients web sites and web systems on one VPS. They all share the same IP.
We've built our own proxy-logic in nodejs, using node-http-proxy, and it matches the domain and passes on to either node-http-servers on different ports for different sites, or to apache if no nodejs-service is setup for a certain path. This has worked fine for quiet some time.
Now we're implementing credit card payment for one of the customers and need an https-connection. I recoded the proxy to handle https and it works. BUT, we don't want to user the customers certificate on the proxy. When another customers site needs https-connections we'll want that to work.
Is it possible to set up a nodejs-reverse-proxy that passes the https-request on without 'certifying' it, so that the receiving node-https-server 'certifies it'?
Or some other reverse-proxy, if it can't be done with nodejs, before ours?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
所以基本上你会希望多个 HTTPS 网站托管在同一个 IP 下、nodejs 下，对吧？
如果是这种情况..您可能首先要考虑兼容性：（据我所知）多个 HTTPS 证书可以驻留在一个 IP 上仅当客户端也支持 SNI （更多信息@https://sni.velox.ch/，我指的是，当然，在不同的域证书，而不是子域的通配符证书）。
“传统”HTTPS 带来的限制是由于一个功能而出现的：加密提前开始（早于向服务器发送您尝试访问的主机名，因此传统服务器（没有 SNI 的服务器）不知道要提供哪个证书）。虽然这是安全的并且在浏览器中得到广泛支持，但它迫使您为每个 HTTPS 托管网站购买/租用新的 IP。
So basically you'd want multiple HTTPS websites hosted under the same IP, under nodejs, right ?
If that's the case.. you might want to consider, first of all, the compatibility: (from what I know) multiple HTTPS certificates can reside on one IP ONLY IF THE CLIENT ALSO SUPPORTS SNI ( more info @ https://sni.velox.ch/, and I was referring, of course at different domains certificates, not wildcards certs for subdomains ).
The limitation raised by "traditional" HTTPS rises because of a feature: encryption starts early (earlier than sending the server what hostname you tried to access, so the traditional server - the one without SNI - doesn't know which cert to provide ). While this is secure and very widely supported among browsers, it forces you to buy/rent a new IP for each of the HTTPS hosted websites.