问题
我正在尝试使用 curl 向部署在 tomcat 上的 Web 服务发送 POST 请求，需要进行主机和客户端验证（双向身份验证），但我总是得到响应404 Not Found。使用 openssl s_client 可获得相同的结果。我不知道我做错了什么。
我使用的 cURL 命令以下是我使用过的、根据 curl 手册页以及在互联网上搜索到的命令。
curl 'https://hostURL:<port>/webservice/' -d '{"someRequest": {"name": "lol"}}' -v --cert webserver-cert.pem --key webserver-key.pem --cacert root-ca.pem
上述命令的输出是：
* Trying <ip>...
* Connected to <host> port <port> (#0)
* found 1 certificates in root-ca.pem
* found 872 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: <common-name> (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* <data>
* compression: NULL
* ALPN, server did not agree to a protocol
> POST /webservice/ HTTP/1.1
> Host: host:port
> User-Agent: curl/7.47.0
> Accept: */*
> Content-Length: 32
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 32 out of 32 bytes
< HTTP/1.1 404 Not Found
< Server: Apache-Coyote/1.1
< Content-Type: text/html;charset=utf-8
< Content-Language: en
< Content-Length: 1034
< Date: Tue, 19 Sep 2017 05:42:56 GMT
<
<!DOCTYPE html><html><head><title>Apache Tomcat/8.0.14 - Error report</title><style type="text/css">H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}.line {height: 1px; background-color: #525D76; border: none;}</style> </head><body><h1>HTTP Status 404 - /webservice/</h1><div class="line"></div><p><b>type</b> Status report</p><p><b>message</b> <u>/webservice/</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><hr class="line"><h3>Apache Tomcat/8.0.14</h3></bo* Connection #0 to host host left intact
dy></html>
我使用的 openssl s_client 命令以下是我通过阅读手册页和搜索互联网构建的 openssl 命令：
openssl s_client -connect host:port -cert webserver-cert.pem -key webserver-key.pem -CAfile root-ca.pem -msg -state
输出如下：
CONNECTED(00000003)
SSL_connect:before/connect initialization
>>> TLS 1.2 [length 0005]
16 03 01 01 2c
>>> TLS 1.2 Handshake [length 012c], ClientHello
<data>
SSL_connect:SSLv2/v3 write client hello A
<<< ??? [length 0005]
16 03 03 0c 65
<<< TLS 1.2 Handshake [length 0051], ServerHello
<data>
SSL_connect:unknown state
<<< TLS 1.2 Handshake [length 0ac3], Certificate
<data>
depth=1 C = FR, ST = state, L = name, O = name, CN = name CA
verify return:1
depth=0 C = FR, ST = country, L = state, O = host, OU = Web server, CN = host
verify return:1
SSL_connect:unknown state
<<< TLS 1.2 Handshake [length 014d], ServerKeyExchange
<data>
SSL_connect:unknown state
<<< TLS 1.2 Handshake [length 0004], ServerHelloDone
0e 00 00 00
SSL_connect:unknown state
>>> ??? [length 0005]
16 03 03 00 46
>>> TLS 1.2 Handshake [length 0046], ClientKeyExchange
<data>
SSL_connect:unknown state
>>> ??? [length 0005]
14 03 03 00 01
>>> TLS 1.2 ChangeCipherSpec [length 0001]
01
SSL_connect:unknown state
>>> ??? [length 0005]
16 03 03 00 28
>>> TLS 1.2 Handshake [length 0010], Finished
14 00 00 0c 86 20 94 8c f1 d2 32 1d 95 10 40 7c
SSL_connect:unknown state
SSL_connect:unknown state
<<< ??? [length 0005]
14 03 03 00 01
<<< TLS 1.2 ChangeCipherSpec [length 0001]
01
<<< ??? [length 0005]
16 03 03 00 28
<<< TLS 1.2 Handshake [length 0010], Finished
14 00 00 0c 04 c9 ef 15 6e cf 7f 28 2b 8f b3 4e
SSL_connect:unknown state
---
Certificate chain
0 s:/C=FR/ST=country/L=state/O=host/OU=Web server/CN=host
i:/C=FR/ST=state/L=name/O=name/CN=name CA
1 s:/C=FR/ST=state/L=name/O=name/CN=name CA
i:/C=FR/ST=state/L=name/O=name/CN=name CA
---
Server certificate
-----BEGIN CERTIFICATE-----
<data>
-----END CERTIFICATE-----
subject=<data>
issuer=<data>
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3229 bytes and written 431 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure RenFRotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN nFRotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: <data>
Session-ID-ctx:
Master-Key: <data>
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1505765192
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
然后我输入post请求如下：
POST /webservice/ HTTP/1.1
Host: <host>:<port>
Accept: */*
Content-Length: 86
Content-Type: application/json
{request:{"username":"lol"}}
之后我也遇到了同样的 404 错误。
更多细节
我确信 Web 服务的路径是存在的。事实上，我有一个用 Java 构建的客户端，可以成功与 Web 服务通信。（这也意味着 tomcat 配置正确）
我确信 URL 和端口以及 CA 证书都是正确的。使用它们与不需要客户端身份验证的另一个 Web 服务进行通信，它们工作得很好。
以下是curl和openssl版本。
卷曲
curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
openssl
OpenSSL 1.0.2g 1 Mar 2016
built on: reproducible build, date unspecified
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/usr/lib/ssl"
我快疯了，因为我一直在检查命令以确保我输入的每个字符都是正确的。已经这样做了好几次。搜索互联网并了解到我使用的命令是正确的（至少到目前为止我是这么认为的）。
另外，为什么我ALPN, server did not agree to a protocol从 curl 和SSL_connect:unknown stateopenssl 中获取信息？
任何有关此问题的帮助都将非常感激。
提前致谢。