☰

以某种方式搞砸了 /etc/pki（我认为）

tag-icon • tag-icon tls openssl
以某种方式搞砸了 /etc/pki（我认为）

我无法再使用我的某台机器上的任何浏览器访问某些安全网站： 

> curl -vvv https://order.subway.com/ > /dev/null
* About to connect() to order.subway.com port 443 (#0)
*   Trying 205.210.145.54... connected
* Connected to order.subway.com (205.210.145.54) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -5961
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error

但它可以在同一网络上的另一台机器上运行良好（见下文）。

当我进入 Firefox 中的“编辑/首选项/高级/加密/查看证书/权限”并做了一些事情时，这种情况就开始发生了，尽管我不记得具体做了什么。

我该如何修复这个问题？我尝试了很多方法，包括重新安装“openssl”和“ca-certificates”软件包，甚至将 /etc/pki 从正常工作的机器复制到不正常工作的机器，但都无济于事。

更新证书的正确/规范方法是什么？或者问题与证书无关？

工作机器上的 curl 输出： 

$ curl -vvv https://order.subway.com/ > /dev/null
* STATE: INIT => CONNECT handle 0x20048280; line 1090 (connection #-5000)
* Added connection 0. The cache now contains 1 members
*   Trying 205.210.145.54...
* STATE: CONNECT => WAITCONNECT handle 0x20048280; line 1143 (connection #0)
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*
Connected to order.subway.com (205.210.145.54) port 443 (#0)
* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x20048280; line 1240 (connection #0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* STATE: SENDPROTOCONNECT => PROTOCONNECT handle 0x20048280; line 1254 (connection #0)
{ [5 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [81 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4514 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [262 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / DES-CBC3-SHA
* ALPN, server did not agree to a protocol
* Server certificate:
*        subject: jurisdictionC=US; jurisdictionST=Connecticut; businessCategory
=Private Organization; serialNumber=0972970; C=US; ST=Connecticut; L=Milford; O=
Franchise World Headquarters, LLC; OU=Info Systems; CN=order.subway.com
*        start date: Jun 11 00:00:00 2015 GMT
*        expire date: Jun  4 23:59:59 2017 GMT
*        subjectAltName: order.subway.com matched
*        issuer: C=US; O=Symantec Corporation; OU=Symantec Trust Network; CN=Sym
antec Class 3 EV SSL CA - G3
*        SSL certificate verify ok.
* STATE: PROTOCONNECT => DO handle 0x20048280; line 1275 (connection #0)
} [5 bytes data]
> GET / HTTP/1.1
> Host: order.subway.com
> User-Agent: curl/7.45.0
> Accept: /
>
* STATE: DO => DO_DONE handle 0x20048280; line 1337 (connection #0)
* STATE: DO_DONE => WAITPERFORM handle 0x20048280; line 1464 (connection #0)
* STATE: WAITPERFORM => PERFORM handle 0x20048280; line 1474 (connection #0)
{ [5 bytes data]
* HTTP 1.1 or later with persistent connection, pipelining supported
< HTTP/1.1 200 OK
< Cache-Control: no-cache
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
* Server Microsoft-IIS/7.5 is not blacklisted
< Server: Microsoft-IIS/7.5
< Set-Cookie: ASP.NET_SessionId=3ifrpyo3auwuxq3kj0usk2hi; path=/; HttpOnly
< X-Powered-By: ASP.NET
< Date: Wed, 23 Dec 2015 22:17:40 GMT
< Content-Length: 51049
<
{ [6960 bytes data]
* STATE: PERFORM => DONE handle 0x20048280; line 1632 (connection #0)
* Curl_done
100 51049  100 51049    0     0  86734      0 --:--:-- --:--:-- --:--:-- 88167
* Connection #0 to host order.subway.com left intact

编辑：@Chloe，我尝试了你的建议：


> openssl s_client -connect order.subway.com:443 -msg

CONNECTED(00000003)
>>> SSL 2.0 [length 0092], CLIENT-HELLO
    01 03 01 00 69 00 00 00 20 00 00 39 00 00 38 00
    00 35 00 00 88 00 00 87 00 00 84 00 00 16 00 00
    13 00 00 0a 07 00 c0 00 00 33 00 00 32 00 00 2f
    00 00 9a 00 00 99 00 00 96 00 00 45 00 00 44 00
    00 41 03 00 80 00 00 05 00 00 04 01 00 80 00 00
    15 00 00 12 00 00 09 06 00 40 00 00 14 00 00 11
    00 00 08 00 00 06 04 00 80 00 00 03 02 00 80 00
    00 ff 81 7b 8a 1d a2 8a 91 d5 59 9c 1c 65 dd 5c
    52 51 c1 9c 4d 06 33 97 66 bb 03 9d f1 86 96 c2
    48 0d
write:errno=104

谷歌搜索显示这是关于“对等证书”的内容，但我不确定具体是什么。

答案1

尝试

openssl s_client -connect order.subway.com:443 -msg

看看是否有效。还可以尝试重置路由器、关闭和打开 wifi 以及重新启动计算机。这可能是网络问题。

相关内容