nginx反向代理到谷歌云function？

到目前为止，尝试，但不能从他们的端点得到有效的响应（SSL握手失败）

server { listen 443 ssl; server_name xxx; ssl on; ssl_certificate /etc/letsencrypt/live/xxx/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/xxx/privkey.pem; ssl_session_timeout 24h; ssl_session_cache shared:SSL:10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'xxx'; ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; resolver 127.0.0.1; add_header Strict-Transport-Security max-age=31536000; ssl_dhparam /xxx/dhparam.pem; location / { proxy_pass https://us-central1-project_id.cloudfunctions.net; } } 

获取以下内容：

 ... peer closed connection in SSL handshake while SSL handshaking to upstream... 

使用openssl（ openssl s_client -connect us-central1-project_id.cloudfunctions.net:443 ）获取enpoint返回以下内容：

 CONNECTED(00000003) 139669452420760:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 305 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1493734932 Timeout : 300 (sec) Verify return code: 0 (ok) --- 

我真的不知道如何分析这样的反应

• Google Cloud VPN不允许出站HTTP或SSH到Office Network
• 谷歌应用程序引擎 – 突然开始获取警告：PHP启动：无法加载dynamic库“/base/php_runtime/modules/curl.so”
• 从Google Cloud Instance下载公钥和私钥
• 在谷歌云平台上附有nvme的实例组
• 边疆互联网 – 不能连接到谷歌云

一般来说（对于ssl端点）设置这样的反向代理是否需要特定的设置？ 还是只是谷歌阻止用户从这种使用？

 server { ... # Server ssl directives ... # Avoid sending invalid headers underscores_in_headers on; ... location / { proxy_pass https://us-central1-project_id.cloudfunctions.net/; # Client SSL certificate proxy_ssl_certificate /etc/nginx/my_client.pem; proxy_ssl_certificate_key /etc/nginx/my_client.key; # Header configurations for google API proxy_pass_request_headers on; proxy_set_header Authorization: Bearer [bearer-id]; } } 

  proxy_ssl_server_name on; proxy_ssl_name $proxy_host;