Nginx、Https、反向代理、握手错误。需要审查'；nginx/sites enabled/default'；文件

我希望对下面的一些代码进行回顾——它是“nginx/sites enabled/default”文件。我相信它可能有一些明显的陷阱，阻止我的网站在https下重定向。我花了几天时间查看Nginx文档，但未能解决我的问题。谢谢你的帮助

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;
    return 301 https://$host$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mysite.io;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/mysite.io/fullchain.pem; # managed $
    ssl_certificate_key /etc/letsencrypt/live/mysite.io/privkey.pem; # manage$

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:3000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }


}

server {
    return 301 https://$host$request_uri;

    server_name www.mysite.io; # managed by Certbot

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mysite.io/fullchain.pem; # managed $
    ssl_certificate_key /etc/letsencrypt/live/mysite.io/privkey.pem; # manage$
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = www.mysite.io) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80  ;
    server_name www.mysite.io;
    return 404; # managed by Certbot

}

上下文： 我正在尝试设置一个反向代理，将我的域url指向Digital Ocean服务器上的localhost:3000。除了我的https无法解析之外，一切似乎都很好。我大体上遵循了以下两个教程：和

当我转到我的url时，我会得到：“ERR\u CONNECTION\u RESET”。当我在服务器上为运行curl时，我的html将按预期返回。当我在服务器上运行curl时，我收到错误：“curl（35）gnutls_handshake（）失败：pull函数中出错”。我所有的http curl请求都正确地重定向到https，dig+short mysite.io指向我的服务器，nginx-t返回时没有错误

我的直觉是问题出在我的“nginx/sites enabled/default”文件上，更具体地说是处理https的服务器块。前两个服务器块来自第一个教程，第二个服务器块由上述第二个教程中的Certbot自动生成。再次感谢你的帮助

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;
    return 301 https://$host$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mysite.io;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/mysite.io/fullchain.pem; # managed $
    ssl_certificate_key /etc/letsencrypt/live/mysite.io/privkey.pem; # manage$

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:3000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }


}

server {
    return 301 https://$host$request_uri;

    server_name www.mysite.io; # managed by Certbot

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mysite.io/fullchain.pem; # managed $
    ssl_certificate_key /etc/letsencrypt/live/mysite.io/privkey.pem; # manage$
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = www.mysite.io) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80  ;
    server_name www.mysite.io;
    return 404; # managed by Certbot

}

---

前两个块是不必要的，可以删除。然后，我们可以从第二个服务器块获取位置块，并将其添加到第三个服务器块。最后，我们可以从第三个块中删除301，结果如下：

server {
    server_name www.mysite.io; # managed by Certbot

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:3000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    # change the above line to "listen 443 ssl http2" if you want http2
    ssl_certificate /etc/letsencrypt/live/mysite.io/fullchain.pem; # managed $
    ssl_certificate_key /etc/letsencrypt/live/mysite.io/privkey.pem; # manage$
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = www.mysite.io) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80  ;
    server_name www.mysite.io;
    return 404; # managed by Certbot

}

---

如果删除第三个服务器块（先备份！），会发生什么？@RyanZ..什么都没有发生/握手错误相同。我认为前两个服务器块是问题的根源。试着把它们去掉，好的！现在我们有进展了！删除前两个服务器块，将位置块从第二个服务器块添加到第三个块，并从第三个块删除301重定向。我认为它有效！我认为我的npm安装是现在唯一一个被破坏的东西。谢谢你，伙计！令人惊叹的！我用这些信息添加了一个答案，以及如何启用HTTP/2，这是您想要做的事情。