主页 / ubuntu / 问题

问题[tls](ubuntu)

Martin Hope
UbuntuUser
Asked: 2020-09-03 13:05:41 +0800 CST
  • 3

我正在使用 Ubuntu 20.04 运行本地服务器，并且需要做一件应该很简单的事情 - 告诉它使用 ISP 的 DNS 服务器以外的其他东西来解析 DNS。但是由于我不会深入讨论的原因，它确实需要使用 DHCP 获取其 IP 地址，因此没有静态 IP 地址。这在以前的 Ubuntu 版本中很容易实现，如果您正在运行桌面，显然仍然不是太难，但我还没有看到关于如何在 Ubuntu Server 中执行此操作的明确说明。

我尝试过的以及现在似乎可行的方法是：

sudo apt update
sudo apt install resolvconf
sudo nano /etc/resolv.conf

（例如，在注释掉的行下方，我添加了两个指向首选 DNS 的名称服务器行

nameserver 8.8.8.8
nameserver 8.8.4.4

然后保存并退出纳米）

sudo systemctl start resolvconf.service

现在这似乎奏效了，但让我烦恼的是出现在 resolv.conf 中的这段文本：

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.

尽管如此，我看到很多人告诉你继续编辑这个文件，但我想知道的是，这个文件是否会在某个时候被覆盖，如果是这样，那么现在被认为是“正确的" 在 Ubuntu 20.04 中指定名称服务器的方法，请记住我不能使用静态 IP 地址并且系统上没有桌面？您会认为现在有人会在网页或视频中介绍此内容，但如果是这样，我找不到它。

编辑：我确实意识到“正确”的方式应该涉及修改 /etc/netplan/00-installer-config.yaml 文件以使用特定的名称服务器，但问题在于，如果您不将 dhcp4: 设置为false或不，它会将您指定的 DNS 服务器添加到已经包含从 DHCP 获得的服务器的列表中。因此，如果 DHCP 请求指定使用 ISP 的名称服务器，它将始终首先检查，并且仅在 DNS 无法响应时才转到您首选的名称服务器。显然这不是我们想要的行为，而这正是促使我首先安装 resolvconf 的原因。

但是继续这个主题，如果不是太难的话，我真正想要实现的是 DNS 加密，我猜它被称为 DNS over TLS。我想知道的是这个功能是否内置在 Ubuntu Server 中，如果是，你如何启用它。我已经看到几个页面建议安装一个名为 stubby 的软件包，但我发现几乎所有的说明都是为早期 Ubuntu 版本的用户或 Ubuntu 桌面用户编写的。

这一切似乎在 Ubuntu 18.04 中会容易得多，但是在我访问过的所有页面中，试图获得关于这个主题的可靠信息，如果在所有说明中提到 20.04，几乎普遍告诉你使用网络配置工具在桌面版本中。好像没有人知道在不使用基于 GUI 的实用程序的情况下，在 Ubuntu 20.04 中做一些应该非常简单的事情的正确方法。所以我想知道为什么他们让用户更难- 这似乎是在错误的方向！

networking server dns tls 20.04
Martin Hope
Misko Mali
Asked: 2020-06-16 23:45:58 +0800 CST
  • 9

我在我的 VPS 上安装了 Ubuntu 20。这就是我尝试这样做的原因：

curl -v https://imenik.tportal.hr/show?action=pretraga&type=bijeleStranice
[1] 438975
root@vps:/var/www/html/tportal# *   Trying 195.29.166.100:443...
* TCP_NODELAY set
* Connected to imenik.tportal.hr (195.29.166.100) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS alert, protocol version (582):
* error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
* Closing connection 0
curl: (35) error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol

但是当我这样尝试时，它有点工作

curl -v http://imenik.tportal.hr/show?action=pretraga&type=bijeleStranice
[1] 438977
root@vps:/var/www/html/tportal# *   Trying 195.29.166.100:80...
* TCP_NODELAY set
* Connected to imenik.tportal.hr (195.29.166.100) port 80 (#0)
> GET /show?action=pretraga HTTP/1.1
> Host: imenik.tportal.hr
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Date: Tue, 16 Jun 2020 07:44:32 GMT
< Server: Apache/2.2.3 (CentOS)
< Location: https://imenik.tportal.hr/show?action=pretraga
< Content-Length: 336
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://imenik.tportal.hr/show?action=pretraga">here</a>.</p>
<hr>
<address>Apache/2.2.3 (CentOS) Server at imenik.tportal.hr Port 80</address>
</body></html>
* Closing connection 0

我找不到此 SSL 问题的解决方案

ssl openssl tls curl
Martin Hope
Greelan
Asked: 2020-02-15 19:32:00 +0800 CST
  • 0

我在这里发疯了，想弄清楚如何在我的 nginx 服务器上启用 TLSv1.3。

根据我的研究，我的设置应该支持它：

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:        18.04
Codename:       bionic

# uname -a
Linux server 5.3.0-28-generic #30~18.04.1-Ubuntu SMP Fri Jan 17 06:14:09 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

# nginx -V
nginx version: nginx/1.14.0 (Ubuntu)
built with OpenSSL 1.1.1  11 Sep 2018
TLS SNI support enabled
...

# openssl version
OpenSSL 1.1.1  11 Sep 2018

# dpkg -s openssl | grep Version
Version: 1.1.1-1ubuntu2.1~18.04.5

我已经包含了 TLSv1.3 协议，甚至（尽管我理解它是可选的）在我的 nginx 配置中特别列出了 TLSv1.3 密码：

...
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256;
ssl_ecdh_curve X25519:secp384r1;
...

但是我无法使用 TLSv1.3 连接到服务器，无论是通过浏览器（可以通过 TLSv1.3 连接到其他网站）还是curl：

# curl -I -v --tlsv1.3 --tls-max 1.3 https://mydomain.com
* Rebuilt URL to: https://mydomain.com/
*   Trying xxx.xxx.xxx.xxx...
* TCP_NODELAY set
* Connected to mydomain.com (xxx.xxx.xxx.xxx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, Server hello (2):
* error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

TLSv1.2 工作正常。

请问我错过了什么？！

编辑

一些额外的故障排除信息：

# openssl s_client -tls1_3 -connect mydomain.com:443
CONNECTED(00000005)
140179247497664:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:../ssl/record/rec_layer_s3.c:1528:SSL alert number 70
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 244 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

同样，使用 TLSv1.2 作为选项运行它时我没有问题。

nginx openssl tls
Martin Hope
lilylily
Asked: 2020-02-14 11:53:32 +0800 CST
  • 1

我的机构想要使用 OpenLDAP 配置我们的一台 Ubuntu 服务器，以便与我们的 SSO 提供商 Okta 交互，使用他们拥有的服务器端代理将用户从他们的云服务配置到 LDAP。我一直在努力让我们的 LDAP 服务器与 Okta 对话，最近 Okta 的一名支持人员告知我的配置失败，因为我的服务器正在发送 TLSv1.1 数据包，而他们的服务器正在响应 TLSv1.2 数据包。出于这个原因，以及为了我们用户的安全，我想强制 LDAP 至少使用 TLSv1.2，但是，当我尝试将 ldap_modify 与以下 ldif 文件一起使用时：

dn: cn=config
add: olcTLSCipherSuite
olcTLSCipherSuite: ALL:!TLSv1:TLSv1.2:TLSv1.3:!NULL

LDAP 抛出错误：

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

即使使用更简单的密码列表，我也会遇到相同的错误，例如：

olcTLSCipherSuite: ALL

我相信我的 SSL 配置正确并且似乎正在运行（即我可以使用 OpenSSL 从外部连接到它）并且我的证书标识如下：

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca-certificates.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/sasl2/my-ldap.crt

replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/sasl2/my-ldap.key

并且 openldap 用户对所有这些都具有读取权限。

我不知道从这里去哪里，并且对 LDAP 的了解几乎不足以对正在发生的事情做出有根据的猜测。对于任何人可以提供的任何建议，我将不胜感激！我在 (-1) 处启用了 LDAP 的日志记录，并将转储下面 ldap_modify 命令的一些输出。

Feb 13 14:47:27 poster slapd[20666]: #011#011one value, length 32
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 MOD dn="cn=config"
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 MOD attr=olcTLSCipherSuite
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: result not in cache (olcTLSCipherSuite)
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: add access to "cn=config" "olcTLSCipherSuite" requested
Feb 13 14:47:27 poster slapd[20666]: => acl_get: [1] attr olcTLSCipherSuite
Feb 13 14:47:27 poster slapd[20666]: => acl_mask: access to entry "cn=config", attr "olcTLSCipherSuite" requested
Feb 13 14:47:27 poster slapd[20666]: => acl_mask: to value by "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", (=0)
Feb 13 14:47:27 poster slapd[20666]: <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
Feb 13 14:47:27 poster slapd[20666]: <= acl_mask: [1] applying manage(=mwrscxd) (stop)
Feb 13 14:47:27 poster slapd[20666]: <= acl_mask: [1] mask: manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: => slap_access_allowed: add access granted by manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: add access granted by manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: slap_queue_csn: queueing 0x7f58dc103a30 20200213194727.142704Z#000000#000#000000
Feb 13 14:47:27 poster slapd[20666]: oc_check_required entry (cn=config), objectClass "olcGlobal"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "objectClass"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "cn"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcArgsFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcPidFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCACertificateFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCertificateFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCertificateKeyFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcToolThreads"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "structuralObjectClass"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "entryUUID"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "creatorsName"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "createTimestamp"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcLogLevel"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCipherSuite"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "entryCSN"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "modifiersName"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "modifyTimestamp"
Feb 13 14:47:27 poster slapd[20666]: send_ldap_result: conn=1017 op=1 p=3
Feb 13 14:47:27 poster slapd[20666]: send_ldap_result: err=80 matched="" text=""
Feb 13 14:47:27 poster slapd[20666]: send_ldap_response: msgid=2 tag=103 err=80
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 RESULT tag=103 err=80 text=
Feb 13 14:47:27 poster slapd[20666]: slap_graduate_commit_csn: removing 0x7f58dc103a30 20200213194727.142704Z#000000#000#000000
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 1 descriptor
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]:  12r
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: daemon: read active on 12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_get(12)
Feb 13 14:47:27 poster slapd[20666]: connection_get(12): got connid=1017
Feb 13 14:47:27 poster slapd[20666]: connection_read(12): checking for input on id=1017
Feb 13 14:47:27 poster slapd[20666]: op tag 0x42, time 1581623247
Feb 13 14:47:27 poster slapd[20666]: ber_get_next on fd 12 failed errno=0 (Success)
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_read(12): input error=-2 id=1017, closing.
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_closing: readying conn=1017 sd=12 for close
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 1 descriptor
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]: connection_close: deferring conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=2 do_unbind
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=2 UNBIND
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_resched: attempting closing conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_close: conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: removing 12
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 2 descriptors
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: conn=1017 fd=12 closed
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
ssl ldap openldap tls
Martin Hope
Marzii
Asked: 2019-10-16 10:18:15 +0800 CST
  • 1

我在 Ubuntu 16.04 服务器上设置了 vsftpd。我添加了一个用户，并通过用户列表给他 FTP 访问权限，并将他 chroot 到他的主目录。它工作得很好。为了使文件传输更安全，我想添加一个 TLS 连接。

我使用 OpenSSL 创建了一个新证书：

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

并改编了我的vsftpd.conf：

ssl_enable=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH

重新启动 vsftpd 并尝试通过 FileZilla 或 WinSCP 连接后，我收到了接受证书的提示。但是这两个程序实际上并没有将我连接到服务器。他们“停止”在“检索目录列表”。这是我尝试使用 FileZilla 登录时发生的情况：

Status: Resolving address of **
Status: Connecting to [**]:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    EPSV
Response:   229 Entering Extended Passive Mode (|||13468|)
Command:    LIST
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing
Status: Disconnected from server
server ftp vsftpd openssl tls
Martin Hope
wouter205
Asked: 2019-03-16 00:25:02 +0800 CST
  • 0

我正在尝试启动并运行 Onlyoffice 的 docker 容器。

我按照GitHub 上提供的说明进行操作，但收到连接被拒绝错误。

这是我的码头工人命令：

docker run -i -t -d -p 443:443 --restart=always -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql onlyoffice/documentserver

当我在浏览器中打开该页面时，我收到一条 ERR_CONNECTION_REFUSED 消息。

使用lsofI see docker 已在端口 443 上建立连接：

$lsof -i :443
COMMAND    PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
docker-pr 2967 root    4u  IPv4 13839915      0t0  TCP 192.168.218.10:https (LISTEN)

什么可能是错的？在 http（端口 80）上运行时，docker 映像工作正常。

主机操作系统：Xubuntu 16.04.6 LTS Docker 版本：Docker-ce 5.18

https docker tls
Martin Hope
icc97
Asked: 2018-09-22 03:40:28 +0800 CST
  • 6

尝试通过 https 连接到 github.com、google.com、dropbox.com 时出现以下错误，但 stackoverflow.com、askubuntu.com 和大多数 https 网站都可以正常工作。

相关细节：

  • 我在工作代理后面，但是在使用 Fedora 28 时我可以正常连接，只是在 Ubuntu 16.04 上我遇到了问题。办公室里没有其他人有这个问题，但他们大多使用 Mac。
  • 这是在我自己的桌面上，而不是在服务器/VM/Docker 等上。
  • 我可以通过我的移动热点或其他 WiFi 网络连接到这些网站
  • 编辑：我在另一台装有 Ubuntu 16.04 的 Thinkpad 笔记本电脑上进行了测试，没有问题。所以这是这台机器特有的东西（戴尔 XPS 13 9370）。

错误信息：

$ openssl s_client -connect github.com:443
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 311 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1537527929
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

我已将OpenSSL 升级到最新版本，但这没有什么区别：

$ openssl version
OpenSSL 1.0.2p  14 Aug 2018

运行 CURL 时出现以下错误：

$ curl -v https://google.com
* Rebuilt URL to: https://google.com/
*   Trying 172.217.17.46...
* Connected to google.com (172.217.17.46) port 443 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 597 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Error in the pull function.
* Closing connection 0
curl: (35) gnutls_handshake() failed: Error in the pull function.

还有许多其他有类似问题的答案，但我找不到任何可以解决我的情况的答案：

这是与 stackoverflow.com 一起使用的示例：

$ openssl s_client -connect stackoverflow.com:443
CONNECTED(00000003)
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:/C=US/ST=NY/L=New York/O=Stack Exchange, Inc./CN=*.stackexchange.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHHjCCBgagAwIBAgIQDhG71w1UtxDQxvVAtrUspDANBgkqhkiG9w0BAQsFADBw
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
dXJhbmNlIFNlcnZlciBDQTAeFw0xNjA1MjEwMDAwMDBaFw0xOTA4MTQxMjAwMDBa
MGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJOWTERMA8GA1UEBxMITmV3IFlvcmsx
HTAbBgNVBAoTFFN0YWNrIEV4Y2hhbmdlLCBJbmMuMRwwGgYDVQQDDBMqLnN0YWNr
ZXhjaGFuZ2UuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr0YD
zscT5i6T2FaRsTGNCiLB8OtPXu8N9iAyuaROh/nS0kRRsN8wUMk1TmgZhPuYM6oF
S377V8W2LqhLBMrPXi7lnhvKt2DFWCyw38RrDbEsM5dzVGErmhux3F0QqcTI92zj
VW61DmE7NSQLiR4yonVpTpdAaO4jSPJxn8d+4p1sIlU2JGSk8LZSWFqaROc7KtXt
lWP4HahNRZtdwvL5dIEGGNWx+7B+XVAfY1ygc/UisldkA+a3D2+3WAtXgFZRZZ/1
CWFjKWJNMAI6ZBAtlbgSNgRYxdcdleIhPLCzkzWysfltfiBmsmgz6VCoFR4KgJo8
Gd3MeTWojBthM10SLwIDAQABo4IDuDCCA7QwHwYDVR0jBBgwFoAUUWj/kK8CB3U8
zNllZGKiErhZcjswHQYDVR0OBBYEFFrBQmPCYhOznZSEqjIeF8tto4Z7MIIB6AYD
VR0RBIIB3zCCAduCEyouc3RhY2tleGNoYW5nZS5jb22CEXN0YWNrb3ZlcmZsb3cu
Y29tghMqLnN0YWNrb3ZlcmZsb3cuY29tgg1zdGFja2F1dGguY29tggtzc3RhdGlj
Lm5ldIINKi5zc3RhdGljLm5ldIIPc2VydmVyZmF1bHQuY29tghEqLnNlcnZlcmZh
dWx0LmNvbYINc3VwZXJ1c2VyLmNvbYIPKi5zdXBlcnVzZXIuY29tgg1zdGFja2Fw
cHMuY29tghRvcGVuaWQuc3RhY2thdXRoLmNvbYIRc3RhY2tleGNoYW5nZS5jb22C
GCoubWV0YS5zdGFja2V4Y2hhbmdlLmNvbYIWbWV0YS5zdGFja2V4Y2hhbmdlLmNv
bYIQbWF0aG92ZXJmbG93Lm5ldIISKi5tYXRob3ZlcmZsb3cubmV0gg1hc2t1YnVu
dHUuY29tgg8qLmFza3VidW50dS5jb22CEXN0YWNrc25pcHBldHMubmV0ghIqLmJs
b2dvdmVyZmxvdy5jb22CEGJsb2dvdmVyZmxvdy5jb22CGCoubWV0YS5zdGFja292
ZXJmbG93LmNvbYIVKi5zdGFja292ZXJmbG93LmVtYWlsghNzdGFja292ZXJmbG93
LmVtYWlsMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
BQUHAwIwdQYDVR0fBG4wbDA0oDKgMIYuaHR0cDovL2NybDMuZGlnaWNlcnQuY29t
L3NoYTItaGEtc2VydmVyLWc1LmNybDA0oDKgMIYuaHR0cDovL2NybDQuZGlnaWNl
cnQuY29tL3NoYTItaGEtc2VydmVyLWc1LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG
/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BT
MAgGBmeBDAECAjCBgwYIKwYBBQUHAQEEdzB1MCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5kaWdpY2VydC5jb20wTQYIKwYBBQUHMAKGQWh0dHA6Ly9jYWNlcnRzLmRp
Z2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJIaWdoQXNzdXJhbmNlU2VydmVyQ0EuY3J0
MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAAzJAMGSdKoX1frdqNlN
iXu8Gcbsm/DxWMXpcTXlZn8s+/qQQoc+/3o0CK3C8/j9n5DmsYa88P6Ntt5ysDs+
b0ynXFva4CAEyKaoPM4SIpOjwfWBRSUOqAIkQO2/LhKBwT/EnpaIHIKGnI0UdXLQ
oDfkMDg6mgJsEBsKdKF5EfEX7iU3NO5xVJPJE8/R0btLAdYwxB9S6fSpCXGe2HqQ
D101O/7/4MWNdFSbfdDSFcn5oEm+idimrqiNrF5knmuJy4qPBkL7thNuGK6rvYCF
ZJM03ZEZhkQmn2jG/7LgjfwZmvfcITeADCpylf88bL+lf+vxe6cCl9CyqWgBDpsI
xpE=
-----END CERTIFICATE-----
subject=/C=US/ST=NY/L=New York/O=Stack Exchange, Inc./CN=*.stackexchange.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3688 bytes and written 437 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 6108011C279498322CD465101770BB0F5B33BB71138CBC79FCDF8CAD77595F29
    Session-ID-ctx: 
    Master-Key: CC8F5FD8CC5197DA6C57E6BF13A47954A8045202DAD80C9C74C26A358613CFDE4430C27F8347FFC9F38F34AF789AF511
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 77 0d 86 c9 22 54 0f 4b-97 9a 3e 46 78 cc 14 46   w..."T.K..>Fx..F
    0010 - 2d 82 e9 5f 63 b7 4c ae-de 3e c8 08 4e 35 4b e5   -.._c.L..>..N5K.
    0020 - 65 89 ef fa b6 83 a6 25-b6 77 c2 c9 a7 35 a7 95   e......%.w...5..
    0030 - c8 2c f1 98 81 19 20 11-84 10 a1 c6 0d 95 61 6d   .,.... .......am
    0040 - 68 76 2c fc d2 d1 1e 98-1f b2 36 84 3a 83 e0 20   hv,.......6.:.. 
    0050 - 75 98 9a ef 53 76 23 e1-03 f1 ef a2 e5 9a de 6f   u...Sv#........o
    0060 - e8 69 8e a4 9a 57 db 82-3f 19 e4 1b a0 85 19 54   .i...W..?......T
    0070 - ba e3 4c 0a f7 30 0f 68-16 6b 40 f2 65 81 db 6f   [email protected]
    0080 - aa 41 4f 75 79 dd 75 1a-aa b3 66 3f 6c dd 19 70   .AOuy.u...f?l..p
    0090 - cf b5 87 72 61 40 cb 1e-73 1a bd 69 92 a3 16 66   [email protected]

    Start Time: 1537529712
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

这是ifconfig代理连接的相关详细信息：

wlp2s0    Link encap:Ethernet  HWaddr 9c:b6:d0:8e:76:8f  
          inet addr:10.1.64.58  Bcast:10.1.79.255  Mask:255.255.240.0
          inet6 addr: fe80::75a:cefe:ae7f:73f1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:24463 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25120 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:13605579 (13.6 MB)  TX bytes:5419669 (5.4 MB)

编辑：输出ldd $(which curl)：

$ ldd $(which curl)
    linux-vdso.so.1 =>  (0x00007ffd885fc000)
    libcurl-gnutls.so.4 => /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 (0x00007fd8d24f7000)
    libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fd8d22dd000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fd8d20c0000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fd8d1cf6000)
    libidn.so.11 => /usr/lib/x86_64-linux-gnu/libidn.so.11 (0x00007fd8d1ac3000)
    librtmp.so.1 => /usr/lib/x86_64-linux-gnu/librtmp.so.1 (0x00007fd8d18a7000)
    libnettle.so.6 => /usr/lib/x86_64-linux-gnu/libnettle.so.6 (0x00007fd8d1671000)
    libgnutls.so.30 => /usr/lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007fd8d1341000)
    libgssapi_krb5.so.2 => /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007fd8d10f7000)
    liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007fd8d0ee8000)
    libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007fd8d0c97000)
    /lib64/ld-linux-x86-64.so.2 (0x00007fd8d2993000)
    libhogweed.so.4 => /usr/lib/x86_64-linux-gnu/libhogweed.so.4 (0x00007fd8d0a64000)
    libgmp.so.10 => /usr/lib/x86_64-linux-gnu/libgmp.so.10 (0x00007fd8d07e4000)
    libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007fd8d0580000)
    libtasn1.so.6 => /usr/lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007fd8d036d000)
    libkrb5.so.3 => /usr/lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007fd8d009b000)
    libk5crypto.so.3 => /usr/lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007fd8cfe6c000)
    libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007fd8cfc68000)
    libkrb5support.so.0 => /usr/lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007fd8cfa5d000)
    libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007fd8cf842000)
    libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007fd8cf627000)
    libgssapi.so.3 => /usr/lib/x86_64-linux-gnu/libgssapi.so.3 (0x00007fd8cf3e6000)
    libffi.so.6 => /usr/lib/x86_64-linux-gnu/libffi.so.6 (0x00007fd8cf1de000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fd8cefda000)
    libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007fd8cedd6000)
    libheimntlm.so.0 => /usr/lib/x86_64-linux-gnu/libheimntlm.so.0 (0x00007fd8cebcd000)
    libkrb5.so.26 => /usr/lib/x86_64-linux-gnu/libkrb5.so.26 (0x00007fd8ce943000)
    libasn1.so.8 => /usr/lib/x86_64-linux-gnu/libasn1.so.8 (0x00007fd8ce6a1000)
    libhcrypto.so.4 => /usr/lib/x86_64-linux-gnu/libhcrypto.so.4 (0x00007fd8ce46e000)
    libroken.so.18 => /usr/lib/x86_64-linux-gnu/libroken.so.18 (0x00007fd8ce258000)
    libwind.so.0 => /usr/lib/x86_64-linux-gnu/libwind.so.0 (0x00007fd8ce02f000)
    libheimbase.so.1 => /usr/lib/x86_64-linux-gnu/libheimbase.so.1 (0x00007fd8cde20000)
    libhx509.so.5 => /usr/lib/x86_64-linux-gnu/libhx509.so.5 (0x00007fd8cdbd5000)
    libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 (0x00007fd8cd900000)
    libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007fd8cd6c8000)

编辑 2：感谢 Simon Sutter 的评论。我已经更新到 Ubuntu 18.04 试图解决它，但仍然存在类似的问题。

实际上 curl 错误现在略有不同，这很有用：

$ curl -v https://google.com
* Rebuilt URL to: https://google.com/
*   Trying 172.217.19.206...
* TCP_NODELAY set
* Connected to google.com (172.217.19.206) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to google.com:443 
* stopped the pause stream!
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to google.com:443

搜索SSL_ERROR_SYSCALL错误时我遇到了一个SO 答案，该答案表明它可能与 IPv6 有关，并建议尝试wget. 这就是我得到的wget：

$ wget https://stackoverflow.com
--2018-09-26 09:33:12--  https://stackoverflow.com/
Resolving stackoverflow.com (stackoverflow.com)... 151.101.129.69, 151.101.193.69, 151.101.1.69, ...
Connecting to stackoverflow.com (stackoverflow.com)|151.101.129.69|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 263668 (257K) [text/html]
Saving to: ‘index.html’

index.html        100%[=============>] 257.49K   864KB/s    in 0.3s    

2018-09-26 09:33:13 (864 KB/s) - ‘index.html’ saved [263668/263668]

$ wget https://google.com
--2018-09-26 09:33:25--  https://google.com/
Resolving google.com (google.com)... 172.217.20.110, 2a00:1450:400e:80a::200e
Connecting to google.com (google.com)|172.217.20.110|:443... connected.
Unable to establish SSL connection.

有趣的是，谷歌发出了 IPv6 请求，但 stackoverflow 没有。然而，进一步的检查表明我对 bitbucket.org 也有问题，并且没有表明 IPv6 连接：

$ wget https://bitbucket.org/
--2018-09-26 10:03:40--  https://bitbucket.org/
Resolving bitbucket.org (bitbucket.org)... 18.205.93.2, 18.205.93.1, 18.205.93.0, ...
Connecting to bitbucket.org (bitbucket.org)|18.205.93.2|:443... connected.
Unable to establish SSL connection.

我通过禁用 IPv6对此进行了进一步检查，但这没有任何区别 - 因为我在运行curl或wget.

现在因为我在 Ubuntu 18.04 上，所以这里有一组更新的检查。

$ curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.0g zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL

相关ifconfig细节：

wlp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.1.64.53  netmask 255.255.240.0  broadcast 10.1.79.255
        inet6 fe80::75a:cefe:ae7f:73f1  prefixlen 64  scopeid 0x20<link>
        ether 9c:b6:d0:8e:76:8f  txqueuelen 1000  (Ethernet)
        RX packets 1203608  bytes 1323281319 (1.3 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 434207  bytes 63876155 (63.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

卷曲库：

$ ldd $(which curl)
    linux-vdso.so.1 (0x00007ffcba0bb000)
    libcurl.so.4 => /usr/lib/x86_64-linux-gnu/libcurl.so.4 (0x00007ff5cba6b000)
    libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007ff5cb84e000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007ff5cb62f000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff5cb23e000)
    libnghttp2.so.14 => /usr/lib/x86_64-linux-gnu/libnghttp2.so.14 (0x00007ff5cb019000)
    libidn2.so.0 => /usr/lib/x86_64-linux-gnu/libidn2.so.0 (0x00007ff5cadfc000)
    librtmp.so.1 => /usr/lib/x86_64-linux-gnu/librtmp.so.1 (0x00007ff5cabe0000)
    libpsl.so.5 => /usr/lib/x86_64-linux-gnu/libpsl.so.5 (0x00007ff5ca9d2000)
    libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007ff5ca768000)
    libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007ff5ca2f0000)
    libgssapi_krb5.so.2 => /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007ff5ca0a5000)
    libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007ff5c9e53000)
    liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007ff5c9c45000)
    /lib64/ld-linux-x86-64.so.2 (0x00007ff5cbf21000)
    libunistring.so.2 => /usr/lib/x86_64-linux-gnu/libunistring.so.2 (0x00007ff5c98c7000)
    libgnutls.so.30 => /usr/lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007ff5c9562000)
    libhogweed.so.4 => /usr/lib/x86_64-linux-gnu/libhogweed.so.4 (0x00007ff5c932e000)
    libnettle.so.6 => /usr/lib/x86_64-linux-gnu/libnettle.so.6 (0x00007ff5c90f8000)
    libgmp.so.10 => /usr/lib/x86_64-linux-gnu/libgmp.so.10 (0x00007ff5c8e77000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007ff5c8c73000)
    libkrb5.so.3 => /usr/lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007ff5c899d000)
    libk5crypto.so.3 => /usr/lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007ff5c876b000)
    libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007ff5c8567000)
    libkrb5support.so.0 => /usr/lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007ff5c835c000)
    libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007ff5c8141000)
    libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007ff5c7f26000)
    libgssapi.so.3 => /usr/lib/x86_64-linux-gnu/libgssapi.so.3 (0x00007ff5c7ce5000)
    libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007ff5c79b6000)
    libtasn1.so.6 => /usr/lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007ff5c77a3000)
    libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007ff5c759f000)
    libheimntlm.so.0 => /usr/lib/x86_64-linux-gnu/libheimntlm.so.0 (0x00007ff5c7396000)
    libkrb5.so.26 => /usr/lib/x86_64-linux-gnu/libkrb5.so.26 (0x00007ff5c7109000)
    libasn1.so.8 => /usr/lib/x86_64-linux-gnu/libasn1.so.8 (0x00007ff5c6e67000)
    libhcrypto.so.4 => /usr/lib/x86_64-linux-gnu/libhcrypto.so.4 (0x00007ff5c6c31000)
    libroken.so.18 => /usr/lib/x86_64-linux-gnu/libroken.so.18 (0x00007ff5c6a1b000)
    libffi.so.6 => /usr/lib/x86_64-linux-gnu/libffi.so.6 (0x00007ff5c6813000)
    libwind.so.0 => /usr/lib/x86_64-linux-gnu/libwind.so.0 (0x00007ff5c65ea000)
    libheimbase.so.1 => /usr/lib/x86_64-linux-gnu/libheimbase.so.1 (0x00007ff5c63db000)
    libhx509.so.5 => /usr/lib/x86_64-linux-gnu/libhx509.so.5 (0x00007ff5c6191000)
    libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 (0x00007ff5c5e88000)
    libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007ff5c5c50000)
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007ff5c58b2000)

env | grep -i proxy什么都不返回。

包裹状态：

$ dpkg -l curl ca-certificates
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                           Version              Architecture         Description
+++-==============================-====================-====================-==================================================================
ii  ca-certificates                20180409             all                  Common CA certificates
ii  curl                           7.58.0-2ubuntu3.3    amd64                command line tool for transferring data with URL syntax

如果它是链中某处的证书错误，我知道我在第一次设置计算机时确实安装了工作 CA 证书。

编辑3：

以下是有效的网站列表：

  • https://duckduckgo.com
  • https://*.stackexchange.com
  • https://stackoverflow.com
  • https://www.getharvest.com/
  • https://www.bbc.com/news
  • https://egghead.io
  • https://news.ycombinator.com
  • https://www.speedtest.net/
  • https://ipleak.net/- 表示我没有 IPv6 连接
  • https://*.atlassian.net（但 bitbucket.org 失败）

失败的站点列表：

  • https://google.com
  • https://dropbox.com
  • https://outlook.live.com/owa/
  • https://bitbucket.org
  • https://www.facebook.com/
  • https://www.slack.com
  • https://twitter.com
  • https://github.com

一半作品：

  • https://outlook.office.com/owa/

https://outlook.office.com/owa/?bO=1上的站点遇到了无法修复的网络协议冲突。

编辑4：

我想我在 Ubuntu 问题上取得了一些进展。它适用于我尝试过的单独的 Ubuntu 16 笔记本电脑。此外，我认为我已将其归结为防火墙问题（通过此Security.SE 答案）以及 TLS v1.1 与 TLS v1.2 的处理。

我追踪了哪些网站我可以访问和哪些不能访问（上图）。一个有趣的例子是 bitbucket.org (fails) vs atlassian.net (works)。

然后，如果我尝试使用 openssl（强制 TLS v1.1）：

​openssl s_client -connect bitbucket.org:443 -tls1_1 # this fails
openssl s_client -connect atlassian.net:443 -tls1_1 # this works

所以我认为防火墙可能会以某种方式阻止 TLS v1.2 流量。

当我运行时，在我的另一台 Ubuntu 机器上：

openssl s_client -connect bitbucket.org:443 -tls1_1 # this works!

在我尝试过的 Mac 上也是如此。

ssl openssl tls curl gnutls
Martin Hope
tardis
Asked: 2018-03-02 00:01:20 +0800 CST
  • 0

我有网站空间并在本地开发。当我完成本地更改后，我想使用带有 SSL/TLS 的 FTP（我不是指 openssh 的 sftp/scp）与我的 webhoster（没有 ssh 访问，所以也没有 rsync 或类似的）使用一个简单的命令进行同步；也就是说它应该只上传/删除更改。我不想打开带或不带 GUI 的 FTP 客户端并手动上传和删除远程站点上的文件。

我知道 sitecopy 可以做到这一点，但不能通过 SSL 进行 FTP（它通过 Webdav 进行 SSL）。

你对这个（特殊的？）用例有提示，因为我没有找到任何工具。

sync ftp ssl tls