[Bug] OpenResty HTTPS 反向代理下载速度慢 #8823

WANG-Guangxin · 2025-05-25T11:21:37Z

WANG-Guangxin
May 25, 2025

Contact Information

2401881997@qq.com

1Panel Version

v1.10.29-lts

Problem Description

[OpenResty 版本]
1.21.4.3-3-3-focal

Steps to Reproduce

[环境]
本机使用 Caddy 部署了一个静态文件服务器，使用 OpenResty 加一层反向代理。

[问题描述]
通过 OpenResty HTTPS 下载静态文件速度很慢 50KB/s
直接通过 HTTP 协议下载速度正常（可接受） 5M/s
测试链接：
https://share.wgxls.eu.org:8443/%E7%94%B5%E5%AD%90%E4%B9%A6/c++/C++%20Primer%20%28%E7%AC%AC5%E7%89%88%E4%B8%AD%E6%96%87%E7%89%88%29%20%28Stanley%20B.%20Lippman%EF%BC%8CJosee%20Lajoie%EF%BC%8CBarbara%20E.%20Moo%29%20%28Z-Library%29.pdf

http://share.wgxls.eu.org:8880/%E7%94%B5%E5%AD%90%E4%B9%A6/c++/C++%20Primer%20%28%E7%AC%AC5%E7%89%88%E4%B8%AD%E6%96%87%E7%89%88%29%20%28Stanley%20B.%20Lippman%EF%BC%8CJosee%20Lajoie%EF%BC%8CBarbara%20E.%20Moo%29%20%28Z-Library%29.pdf

The expected correct result

No response

Related log output

[网站配置文件]

server {
    listen 8880 ; 
    listen 8443 ssl http2 ; 
    server_name share.wgxls.eu.org; 
    index index.php index.html index.htm default.php default.htm default.html; 
    proxy_set_header Host $http_host; 
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
    proxy_set_header X-Forwarded-Host $server_name; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_http_version 1.1; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    access_log /www/sites/share.wgxls.eu.org/log/access.log main; 
    error_log /www/sites/share.wgxls.eu.org/log/error.log; 
    location ^~ /.well-known/acme-challenge {
        allow all; 
        root /usr/share/nginx/html; 
    }
    include /www/sites/share.wgxls.eu.org/proxy/*.conf; 
    ssl_certificate /www/sites/share.wgxls.eu.org/ssl/fullchain.pem; 
    ssl_certificate_key /www/sites/share.wgxls.eu.org/ssl/privkey.pem; 
    ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1; 
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!SRP:!CAMELLIA:!SEED; 
    ssl_prefer_server_ciphers on; 
    ssl_session_cache shared:SSL:10m; 
    ssl_session_timeout 10m; 
    error_page 497 https://$host$request_uri; 
    proxy_set_header X-Forwarded-Proto https; 
}


[OpenResty 配置文件]

user root; 
worker_processes auto; 
error_log /var/log/nginx/error.log notice; 
error_log /dev/stdout notice; 
pid /var/run/nginx.pid; 
events {
    worker_connections 4096; 
}
http {
    include mime.types; 
    default_type application/octet-stream; 
    log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; 
    server_tokens off; 
    access_log /var/log/nginx/access.log main; 
    access_log /dev/stdout main; 
    sendfile on; 
    server_names_hash_bucket_size 512; 
    client_header_buffer_size 32k; 
    client_max_body_size 102400m; 
    keepalive_timeout 60; 
    keepalive_requests 100000; 
    gzip on; 
    gzip_min_length 1k; 
    gzip_buffers 4 16k; 
    gzip_http_version 1.1; 
    gzip_comp_level 2; 
    gzip_types text/plain application/javascript application/x-javascript text/javascript text/css application/xml; 
    gzip_vary on; 
    gzip_proxied expired no-cache no-store private auth; 
    gzip_disable "MSIE [1-6]\."; 
    limit_conn_zone $binary_remote_addr zone=perip:10m; 
    limit_conn_zone $server_name zone=perserver:10m; 
    include /usr/local/openresty/nginx/conf/conf.d/*.conf; 
    proxy_temp_path /www/common/proxy/proxy_temp_dir; 
    proxy_cache_path /www/common/proxy/proxy_cache_dir levels=1:2 keys_zone=proxy_cache_panel:20m inactive=1d max_size=5g; 
    client_body_buffer_size 512k; 
    proxy_connect_timeout 60; 
    proxy_read_timeout 60; 
    proxy_send_timeout 60; 
    proxy_buffer_size 32k; 
    proxy_buffers 4 64k; 
    proxy_busy_buffers_size 128k; 
    proxy_temp_file_write_size 128k; 
    proxy_next_upstream error timeout invalid_header http_500 http_503 http_404; 
    proxy_cache proxy_cache_panel; 
}


[日志]
这是使用 HTTPS 下载时的日志，其他日志不知道从哪里看。

2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/alist.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/alist.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/api.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/api.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/bitwarden.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/bitwarden.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/blog.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/blog.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/code.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/code.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/opengork.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/opengork.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/pdf.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/pdf.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/ubuntu.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/ubuntu.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/vnc.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/vnc.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [warn] 1#1: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/windows.wgxls.eu.org/ssl/fullchain.pem"
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/www/sites/windows.wgxls.eu.org/ssl/fullchain.pem"
2025/05/25 19:17:12 [notice] 1#1: using the "epoll" event method
2025/05/25 19:17:12 [notice] 1#1: openresty/1.21.4.3
2025/05/25 19:17:12 [notice] 1#1: built by gcc 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2) 
2025/05/25 19:17:12 [notice] 1#1: OS: Linux 6.11.0-26-generic
2025/05/25 19:17:12 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2025/05/25 19:17:12 [notice] 1#1: start worker processes
2025/05/25 19:17:12 [notice] 1#1: start worker process 7
2025/05/25 19:17:12 [notice] 1#1: start worker process 8
2025/05/25 19:17:12 [notice] 1#1: start worker process 9
2025/05/25 19:17:12 [notice] 1#1: start worker process 10
2025/05/25 19:17:12 [notice] 1#1: start worker process 11
2025/05/25 19:17:12 [notice] 1#1: start worker process 12
2025/05/25 19:17:12 [notice] 1#1: start worker process 13
2025/05/25 19:17:12 [notice] 1#1: start worker process 14
2025/05/25 19:17:12 [notice] 1#1: start worker process 15
2025/05/25 19:17:12 [notice] 1#1: start worker process 16
2025/05/25 19:17:12 [notice] 1#1: start worker process 17
2025/05/25 19:17:12 [notice] 1#1: start worker process 18
2025/05/25 19:17:12 [notice] 1#1: start worker process 19
2025/05/25 19:17:12 [notice] 1#1: start worker process 20
2025/05/25 19:17:12 [notice] 1#1: start worker process 21
2025/05/25 19:17:12 [notice] 1#1: start worker process 22
2025/05/25 19:17:12 [notice] 1#1: start cache manager process 23
2025/05/25 19:17:12 [notice] 1#1: start cache loader process 24


[其他]
1. 我反向代理的 Alist 也有同样的问题。
2. 这应该是一个降级，但不确定从哪个版本开始。
3. 局域网内使用 HTTPS 下载没有速度问题。

Additional Information

No response

zhengkunwang223 · 2025-05-25T12:38:56Z

zhengkunwang223
May 25, 2025
Collaborator

1Panel标准的https配置并不会影响下载速度，还是要考虑其他因素

0 replies

wanghe-fit2cloud · 2025-05-25T12:39:04Z

wanghe-fit2cloud
May 25, 2025
Maintainer

转为 Discussion.

0 replies

WANG-Guangxin · 2025-06-10T13:47:33Z

WANG-Guangxin
Jun 10, 2025
Author

运营商限速。
用FakeHTTP解决。
https://github.com/MikeWang000000/FakeHTTP/wiki

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Bug] OpenResty HTTPS 反向代理下载速度慢 #8823

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

[Bug] OpenResty HTTPS 反向代理下载速度慢 #8823

Uh oh!

WANG-Guangxin May 25, 2025

Contact Information

1Panel Version

Problem Description

Steps to Reproduce

The expected correct result

Related log output

Additional Information

Replies: 3 comments

Uh oh!

zhengkunwang223 May 25, 2025 Collaborator

Uh oh!

Uh oh!

wanghe-fit2cloud May 25, 2025 Maintainer

Uh oh!

WANG-Guangxin Jun 10, 2025 Author

WANG-Guangxin
May 25, 2025

zhengkunwang223
May 25, 2025
Collaborator

wanghe-fit2cloud
May 25, 2025
Maintainer

WANG-Guangxin
Jun 10, 2025
Author