☰

未知的 SSL 协议错误

tag-icon • tag-icon 15.10 ssl curl
未知的 SSL 协议错误

升级到 15.10 后，当我尝试使用 PHP 脚本 (PHP5-fpm) 中的 CURL 访问 SSL 安全服务器时，出现错误 35“连接到...时出现未知 SSL 协议错误”。升级前一切正常。有什么办法可以解决这个问题吗？

apt-cache policy curl
curl:
  Installed: 7.43.0-1ubuntu2
  Candidate: 7.43.0-1ubuntu2
  Version table:
 *** 7.43.0-1ubuntu2 0
        500 http://ua.archive.ubuntu.com/ubuntu/ wily/main amd64 Packages
        100 /var/lib/dpkg/status

访问https://w3s.webmoney.ru:443

答案1

服务器 https://w3s.webmoney.ru:443不值得信任。

% curl https://w3s.webmoney.ru:443
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

跑步

curl --insecure https://w3s.webmoney.ru:443

并且它有效。

从man curl

-k, --insecure
    (SSL) This option explicitly allows curl to perform "insecure" SSL
    connections and transfers. All SSL connections are attempted to be
    made secure by using the CA certificate  bundle  installed  by
    default. This makes all connections considered "insecure" fail unless
    -k, --insecure is used.

添加值得信赖证书

  1. 将证书路径添加到

    /etc/ca-certificates.conf

    使用相对于的路径/usr/share/ca-certificates

  2. 跑步sudo update-ca-certificates

如需进一步说明，请阅读man update-ca-certificates

摘自评论：

仅供参考：同一个网站启用了 SSLv3 和 SSLv2 - 这很糟糕，因此根本不可信

相关内容