诡异的问题：和朋友共用一台服务器，在访问我的网站时， nginx 同时发送了他的证书

我们的服务器用 Docker 建立 nginx 环境，所以 ssl 直接丢在了 root 下，也没有太大关系。

服务端软件为： nginx-1.11.8 ， openssl-1.1.0c （已排除软件版本因素）

我的域名为 a.com ，他的域名为 b.com

以下是我能提供的所有信息，症状如标题，请大神赐教，谢谢！

Dockerfile 如下：

FROM ubuntu:latest COPY crontabs /root RUN apt update && \ apt-get install -y -q libpcre3 libpcre3-dev zlib1g zlib1g-dev git wget gcc make cmake cpp autoconf automake cron && \ cd /usr/local/src && \ wget http://nginx.org/download/nginx-1.11.8.tar.gz && \ tar xzf nginx-1.11.8.tar.gz && \ wget https://www.openssl.org/source/openssl-1.1.0d.tar.gz && \ tar xzf openssl-1.1.0d.tar.gz && \ groupadd www && \ useradd www -g www -s /sbin/nologin && \ git clone https://github.com/grahamedgecombe/nginx-ct && \ cd /usr/local/src/nginx-1.11.8 && \ ./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module --with-http_v2_module --with-openssl=../openssl-1.1.0d --add-module=../nginx-ct && \ make -j2 && make install && \ ln -s /usr/local/nginx/sbin/nginx /usr/local/bin/nginx && \ rm -rf /usr/local/src/* && \ apt remove -y -q git wget gcc make cmake cpp autoconf automake && \ apt autoremove -y && \ apt purge -y -q git wget gcc make cmake cpp autoconf automake && \ mkdir -p /usr/local/nginx/conf/vhost && \ mkdir -p /home/wwwroot && \ crontab /root/crontabs COPY ["nginx.conf","fastcgi.conf","/usr/local/nginx/conf/"] COPY ["a.com.conf","b.com.conf","/usr/local/nginx/conf/vhost/"] ADD ssl.tar.gz /root EXPOSE 80 EXPOSE 443 CMD ["nginx","-g","daemon off;"] 

a.com.conf:

server { server_name a.com www.a.com; listen 80; location ^~ /.well-known/acme-challenge/ { alias /home/wwwroot/challenges/; try_files $uri =404; } location / { rewrite ^/(.*)$ https://a.com/$1 permanent; } } server { server_name a.com www.a.com; listen 443 ssl http2 reuseport fastopen=3; root /home/wwwroot/hexo; server_tokens off; ssl_ct on; ssl_certificate /root/ssl/a/a.com.rsa.pem; ssl_certificate_key /root/ssl/a/a.com.rsa.key; ssl_ct_static_scts /root/ssl/a/scts/rsa; ssl_certificate /root/ssl/a/a.ecc.pem; ssl_certificate_key /root/ssl/a/a.ecc.key; ssl_ct_static_scts /root/ssl/a/scts/ecc; ssl_dhparam /root/ssl/a/dhparams.pem; ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5; ssl_prefer_server_ciphers on; ssl_ecdh_curve secp384r1; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:50m; ssl_session_timeout 1d; ssl_session_tickets on; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 10s; add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload'; add_header Public-Key-Pins 'pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=";pin-sha256="Fbs+o+IxVNTHBpjNQYfX/TBnxPC+OWLYxQLEtqkrAfM=";max-age=2592000; includeSubDomains'; index index.html; location / { expires 120s; } location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|ico)$ { expires 30d; access_log off; } location ~ .*\.(js|css)?$ { expires 7d; access_log off; } } 

b.conf:

server { server_name b.com,www.b.com; location ^~ /.well-known/acme-challenge/ { alias /home/wwwroot/challenges/; try_files $uri =404; } location / { rewrite ^/(.*)$ https://b.com/$1 permanent; } } server { server_name b.com,www.b.com; listen 443 ssl http2; index index.php; root /home/wwwroot/b; if (!-e $request_filename) { rewrite ^(.*)$ /index.php$1 last; } location ~ .*\.php(\/.*)*$ { include fastcgi.conf; fastcgi_pass cgi:9001; } server_tokens off; ssl_ct on; ssl_certificate /root/ssl/b/b.com.rsa.pem; ssl_certificate_key /root/ssl/b/b.com.rsa.key; ssl_ct_static_scts /root/ssl/b/scts/rsa; ssl_certificate /root/ssl/b/b.com.ecc.pem; ssl_certificate_key /root/ssl/b/b.com.ecc.key; ssl_ct_static_scts /root/ssl/b/scts/ecc; ssl_dhparam /root/ssl/b/dhparams.pem; ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:RSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:RSA+AES256:EECDH+ECDSA+3DES:EECDH+aRSA+3DES:RSA+3DES:!MD5; ssl_prefer_server_ciphers on; ssl_ecdh_curve secp384r1; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:50m; ssl_session_timeout 1d; ssl_session_tickets on; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 10s; add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload'; add_header Public-Key-Pins 'pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=";pin-sha256="Fbs+o+IxVNTHBpjNQYfX/TBnxPC+OWLYxQLEtqkrAfM=";max-age=2592000; includeSubDomains'; } error_log /root/b_error.log crit; 

/root/ssl 目录的结构图：

/root/ssl |-- b.com.ecc.pem |-- a | |-- account.key | |-- acme_tiny.py | |-- ct-submit-1.0.0 | | |-- LICENSE | | |-- README.markdown | | |-- ct-submit | | `-- ct-submit.go | |-- ct-submit.zip | |-- dhparams.pem | |-- intermediate.pem | |-- renew_ecc.sh | |-- renew_rsa.sh | |-- root.pem | |-- scts | | |-- ecc | | | |-- b.com.ecc.sct | | | `-- a.com.ecc.sct | | `-- rsa | | `-- a.com.rsa.sct | |-- signed_ecc.crt | |-- signed_rsa.crt | |-- a.com.ecc.csr | |-- a.com.ecc.key | |-- a.com.ecc.pem | |-- a.com.rsa.csr | |-- a.com.rsa.key | `-- a.com.rsa.pem |-- intermediate.pem |-- root.pem |-- signed_ecc.crt `-- b |-- account.key |-- acme_tiny.py |-- b.com.ecc.csr |-- b.com.ecc.key |-- b.com.ecc.pem |-- b.com.rsa.csr |-- b.com.rsa.key |-- b.com.rsa.pem |-- ct-submit-1.0.0 | |-- LICENSE | |-- README.markdown | |-- ct-submit | `-- ct-submit.go |-- dhparams.pem |-- intermediate.pem |-- renew_ecc.sh |-- renew_rsa.sh |-- root.pem |-- scts | |-- ecc | | `-- b.com.ecc.sct | `-- rsa | `-- b.com.rsa.sct |-- signed_ecc.crt `-- signed_rsa.crt 

*.ecc.pem表示该域名的 ECC 证书，*.rsa.pem表示该域名的 RSA 证书，signed_*.crt表示 Let ‘ s encrypt 签发但还未进行证书链合并的证书；*.ecc.key表示对应域名 ECC 证书私钥，*.rsa.key表示对应域名 RSA 证书私钥；*.ecc.sct表示该域名 ECC 证书的 SCT 文件，*.rsa.sct表示该域名 RSA 证书的 SCT 文件。account.key为用户密钥。

renew_*.sh为对应证书更新脚本。 renew_ecc.sh:

#!/bin/bash cd /root/ssl/a python acme_tiny.py --account-key ./account.key --csr ./a.com.ecc.csr --acme-dir /home/wwwroot/challenges/ > ./signed_ecc.crt wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem wget -O - https://letsencrypt.org/certs/isrgrootx1.pem > root.pem cat signed_ecc.crt intermediate.pem > a.com.ecc.pem ./ct-submit-1.0.0/ct-submit ct.googleapis.com/pilot </root/ssl/a/a.com.ecc.pem >/root/ssl/a/scts/ecc/a.com.ecc.sct kill -HUP `cat /usr/local/nginx/logs/nginx.pid` 

renew_rsa.sh:

#!/bin/bash cd /root/ssl/a python acme_tiny.py --account-key ./account.key --csr ./a.com.rsa.csr --acme-dir /home/wwwroot/challenges/ > ./signed_rsa.crt wget -O - https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem > intermediate.pem wget -O - https://letsencrypt.org/certs/isrgrootx1.pem > root.pem cat signed_rsa.crt intermediate.pem > a.com.rsa.pem ./ct-submit-1.0.0/ct-submit ct.googleapis.com/pilot </root/ssl/a/a.com.rsa.pem >/root/ssl/a/scts/rsa/a.com.rsa.sct kill -HUP `cat /usr/local/nginx/logs/nginx.pid`