主页 / server / 问题 / 1089729
Accepted
x-yuri
Asked: 2022-01-12 14:07:49 +0800 CST

无法通过 HTTPS 连接到站点 (SSL_ERROR_SYSCALL)

  • 772

我有一台运行 Debian 8 的服务器。是的，一个很旧的服务器。但它确实有一些奇怪的地方。我无法通过 HTTPS 连接到它：

$ curl -sSLv https://example.com
*   Trying xx.yyy.xx.yyy:443...
* Connected to example.com (xx.yyy.xx.yyy) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443 

$ sslscan example.com
Version: 2.0.11
OpenSSL 1.1.1m  14 Dec 2021

Connected to xx.yyy.xx.yyy

Testing SSL server example.com on port 443 using SNI name example.com

  SSL/TLS Protocols:
SSLv2     disabled
SSLv3     disabled
TLSv1.0   disabled
TLSv1.1   disabled
TLSv1.2   disabled
TLSv1.3   disabled

  TLS Fallback SCSV:
Connection failed - unable to determine TLS Fallback SCSV support

  TLS renegotiation:
Session renegotiation not supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

  Heartbleed:

  Supported Server Cipher(s):
Certificate information cannot be retrieved.

$ dpkg -l | grep openssl
ii  openssl                             1.0.1t-1+deb8u12             amd64        Secure Sockets Layer toolkit - cryptographic utility

$ cat /etc/nginx/nginx.conf | grep ssl
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

$ dpkg -l | grep nginx
ii  nginx                               1.6.2-5                      all          small, powerful, scalable web/proxy server
ii  nginx-common                        1.6.2-5                      all          small, powerful, scalable web/proxy server - common files
ii  nginx-full                          1.6.2-5                      amd64        nginx web/proxy server (standard version)

要将它与另一个 Debian 8 服务器进行比较：

$ sslscan example2.com
Version: 2.0.11
OpenSSL 1.1.1m  14 Dec 2021

Connected to xx.xxx.xx.xxx

Testing SSL server example2.com on port 443 using SNI name example2.com

  SSL/TLS Protocols:
SSLv2     disabled
SSLv3     disabled
TLSv1.0   enabled
TLSv1.1   enabled
TLSv1.2   enabled
TLSv1.3   disabled

  TLS Fallback SCSV:
Server supports TLS Fallback SCSV

  TLS renegotiation:
Secure session renegotiation supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

  Heartbleed:
TLSv1.2 not vulnerable to heartbleed
TLSv1.1 not vulnerable to heartbleed
TLSv1.0 not vulnerable to heartbleed

  Supported Server Cipher(s):
Preferred TLSv1.2  256 bits  ECDHE-RSA-AES256-GCM-SHA384   Curve P-256 DHE 256
Accepted  TLSv1.2  256 bits  ECDHE-RSA-AES256-SHA384       Curve P-256 DHE 256
Accepted  TLSv1.2  256 bits  ECDHE-RSA-AES256-SHA          Curve P-256 DHE 256
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-GCM-SHA384     DHE 1024 bits
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-SHA256         DHE 1024 bits
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-SHA            DHE 1024 bits
Accepted  TLSv1.2  256 bits  DHE-RSA-CAMELLIA256-SHA       DHE 1024 bits
Accepted  TLSv1.2  256 bits  AES256-GCM-SHA384            
Accepted  TLSv1.2  256 bits  AES256-SHA256                
Accepted  TLSv1.2  256 bits  AES256-SHA                   
Accepted  TLSv1.2  256 bits  CAMELLIA256-SHA              
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-GCM-SHA256   Curve P-256 DHE 256
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-SHA256       Curve P-256 DHE 256
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-SHA          Curve P-256 DHE 256
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-GCM-SHA256     DHE 1024 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-SHA256         DHE 1024 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-SHA            DHE 1024 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-CAMELLIA128-SHA       DHE 1024 bits
Accepted  TLSv1.2  128 bits  AES128-GCM-SHA256            
Accepted  TLSv1.2  128 bits  AES128-SHA256                
Accepted  TLSv1.2  128 bits  AES128-SHA                   
Accepted  TLSv1.2  128 bits  CAMELLIA128-SHA              
Preferred TLSv1.1  256 bits  ECDHE-RSA-AES256-SHA          Curve P-256 DHE 256
Accepted  TLSv1.1  256 bits  DHE-RSA-AES256-SHA            DHE 1024 bits
Accepted  TLSv1.1  256 bits  DHE-RSA-CAMELLIA256-SHA       DHE 1024 bits
Accepted  TLSv1.1  256 bits  AES256-SHA                   
Accepted  TLSv1.1  256 bits  CAMELLIA256-SHA              
Accepted  TLSv1.1  128 bits  ECDHE-RSA-AES128-SHA          Curve P-256 DHE 256
Accepted  TLSv1.1  128 bits  DHE-RSA-AES128-SHA            DHE 1024 bits
Accepted  TLSv1.1  128 bits  DHE-RSA-CAMELLIA128-SHA       DHE 1024 bits
Accepted  TLSv1.1  128 bits  AES128-SHA                   
Accepted  TLSv1.1  128 bits  CAMELLIA128-SHA              
Preferred TLSv1.0  256 bits  ECDHE-RSA-AES256-SHA          Curve P-256 DHE 256
Accepted  TLSv1.0  256 bits  DHE-RSA-AES256-SHA            DHE 1024 bits
Accepted  TLSv1.0  256 bits  DHE-RSA-CAMELLIA256-SHA       DHE 1024 bits
Accepted  TLSv1.0  256 bits  AES256-SHA                   
Accepted  TLSv1.0  256 bits  CAMELLIA256-SHA              
Accepted  TLSv1.0  128 bits  ECDHE-RSA-AES128-SHA          Curve P-256 DHE 256
Accepted  TLSv1.0  128 bits  DHE-RSA-AES128-SHA            DHE 1024 bits
Accepted  TLSv1.0  128 bits  DHE-RSA-CAMELLIA128-SHA       DHE 1024 bits
Accepted  TLSv1.0  128 bits  AES128-SHA                   
Accepted  TLSv1.0  128 bits  CAMELLIA128-SHA              

  Server Key Exchange Group(s):
TLSv1.2  128 bits  secp256r1 (NIST P-256)

  SSL Certificate:
Signature Algorithm: sha256WithRSAEncryption
RSA Key Strength:    4096

Subject:  example2.com
Altnames: DNS:example2.com
Issuer:   R3

Not valid before: Dec 17 21:00:13 2021 GMT
Not valid after:  Mar 17 21:00:12 2022 GMT

$ dpkg -l | grep openssl
ii  openssl                          1.0.1k-3+deb8u2                                amd64        Secure Sockets Layer toolkit - cryptographic utility

$ cat /etc/nginx/nginx.conf | grep ssl
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

$ dpkg -l | grep nginx
ii  nginx                            1.6.2-5                                        all          small, powerful, scalable web/proxy server
ii  nginx-common                     1.6.2-5                                        all          small, powerful, scalable web/proxy server - common files
ii  nginx-full                       1.6.2-5                                        amd64        nginx web/proxy server (standard version)

第一个服务器有什么问题？如何使 https 工作？

ssl nginx openssl

1 个回答

  1. Best Answer

    其中一台服务器（就 而言nginx）有listen 443 ssl，但没有ssl_*指令。在这种情况下，您会出现问题中描述的症状。也就是说，一台服务器（虚拟主机）的问题正在影响另一台服务器（其余的）。

    在故障服务器的错误日志中，您将看到：

    2022/01/12 02:44:46 [错误] 445#0: *23 在 SSL 握手时侦听 SSL 端口的服务器中未定义“ssl_certificate”，客户端：xx.xxx.xx.xxx，服务器：0.0.0.0 :443

    • 2

相关问题