☰

问题

tag-icon • tag-icon openssl
问题

在我的旧 GNU/Linux 安装（Debian Stretch）上，我曾经启动一个虚拟 openssl 服务器openssl s_server并在 stdout 上打印 SSL 会话参数。

输出结果如下，并且没有问题：

user@machine:~$ openssl s_server -port 7777 -cert zertifikat-with-pass.pem
Enter pass phrase for zertifikat-with-pass.pem:
Using default temp DH parameters
ACCEPT
-----BEGIN SSL SESSION PARAMETERS-----
MGwCAQECAgMDBALAMxxxxDAjDcg5OEgtjf/KPjKlg4uoVzKJ8tXA1mWpJa8iMuxU
JTrQHFYKCvkAY5KodwontqihBgIEWxka06IEAgIcIKQGBAQBAAAAphAEDjE5Mi4x
NjguNDIuMTQ1rQMCAQE= (mangled for confidentiality)
-----END SSL SESSION PARAMETERS-----
Shared ciphers:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA
Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Supported Elliptic Curve Point Formats: uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2
Supported Elliptic Curves: brainpoolP384r1:P-384:brainpoolP256r1:P-256
Shared Elliptic curves: P-384:P-256
CIPHER is ECDHE-RSA-AES256-GCM-SHA384
Secure Renegotiation IS supported
CETP<?xml version="1.0" encoding="UTF-8" standalone="yes"?><Event xmlns="http://domain.tld/v13.4"><Topic>DONE</Topic><Type>Operation</Type><Severity>Info</Severity><SubscriptionID>977ef239-459c-41ba-87e7-e5811aef9637</SubscriptionID><Message/></Event>DONE
shutting down SSL
CONNECTION CLOSED
ACCEPT

在我的新机器 (Xubuntu 18.04) 上，openssl s_server输出结果少了很多。除此之外，还缺少 SSL 会话参数：

user@machine:~$ openssl s_server -port 7777 -cert umgewandelt 
Enter pass phrase for umgewandelt:
Using default temp DH parameters
ACCEPT

CETP<?xml version="1.0" encoding="UTF-8" standalone="yes"?><Event xmlns="http://domain.tld/13.4"><Topic>DONE</Topic><Type>Operation</Type><Severity>Info</Severity><SubscriptionID>2dea3d71-4902-4775-9684-ad9dffe193c0</SubscriptionID><Message/></Event>DONE
shutting down SSL
CONNECTION CLOSED
ACCEPT

问题

我怎样才能openssl s_server像以前一样打印 SSL 会话参数？

答案1

我在写上述问题时找到了原因。我想发布我的发现，因为它可能会对其他人有所帮助。

当您看到以下提示时：

user@machine:~$ openssl s_server -port 7777 -cert zertifikat-with-pass.pem
Enter pass phrase for zertifikat-with-pass.pem:
Using default temp DH parameters
ACCEPT

重要的是不要按下任何键，因为只有这样，当客户端连接时，您才会看到 SSL 会话参数。

如果您按下某个键（在我的情况下是输入键），则会缺少以下输出：（SSL 会话参数因保密性而被破坏）

-----BEGIN SSL SESSION PARAMETERS-----
MGwCAQECAgMDBALAMxxxxDAjDcg5OEgtjf/KPjKlg4uoVzKJ8tXA1mWpJa8iMuxU
JTrQHFYKCvkAY5KodwontqihBgIEWxka06IEAgIcIKQGBAQBAAAAphAEDjE5Mi4x
NjguNDIuMTQ1rQMCAQE=
-----END SSL SESSION PARAMETERS-----
Shared ciphers:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA
Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Supported Elliptic Curve Point Formats: uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2
Supported Elliptic Curves: brainpoolP384r1:P-384:brainpoolP256r1:P-256
Shared Elliptic curves: P-384:P-256
CIPHER is ECDHE-RSA-AES256-GCM-SHA384
Secure Renegotiation IS supported

相关内容