![从新闻阅读器连接时出现 stunnel 错误:SSL3_READ_BYTES:tlsv1 alert unknown ca](https://linux22.com/image/610137/%E4%BB%8E%E6%96%B0%E9%97%BB%E9%98%85%E8%AF%BB%E5%99%A8%E8%BF%9E%E6%8E%A5%E6%97%B6%E5%87%BA%E7%8E%B0%20stunnel%20%E9%94%99%E8%AF%AF%EF%BC%9ASSL3_READ_BYTES%EF%BC%9Atlsv1%20alert%20unknown%20ca.png)
我正在尝试设置 stunnel 以提供对 nntp 服务器的安全访问。按照说明这里我创建了一个自签名密钥和证书。我运行的命令是:
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
我的 stunnel 配置有以下选项:
; A copy of some devices and system files is needed within the chroot jail
; Chroot conflicts with configuration file reload and many other features
chroot = /usr/local/var/lib/stunnel/
; Chroot jail can be escaped if setuid option is not used
setuid = nobody
setgid = nogroup
; PID is created inside the chroot jail
pid = /stunnel.pid
; Debugging stuff (may useful for troubleshooting)
;debug = 7
output = /stunnel.log
; Certificate/key is needed in server mode and optional in client mode
cert = /usr/local/var/lib/stunnel/server.crt
key = /usr/local/var/lib/stunnel/server.key
; Disable support for insecure SSLv2 protocol
options = NO_SSLv2
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
[nntps]
accept = 563
connect = 119
当我启动 stunnel(提供我的密码)并尝试连接 Thunderbird 时,Thunderbird 显示“正在连接...”,并且我收到以下错误消息stunnel.log
:
2013.04.17 13:40:36 LOG5[30290:3074012864]: stunnel 4.56 on i686-pc-linux-gnu platform
2013.04.17 13:40:36 LOG5[30290:3074012864]: Compiled/running with OpenSSL 1.0.1 14 Mar 2012
2013.04.17 13:40:36 LOG5[30290:3074012864]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS
2013.04.17 13:40:36 LOG5[30290:3074012864]: Reading configuration from file /etc/stunnel/news.conf
2013.04.17 13:40:36 LOG5[30290:3074012864]: FIPS mode is disabled
2013.04.17 13:40:39 LOG5[30290:3074012864]: Configuration successful
2013.04.17 13:40:51 LOG5[30291:3073764160]: Service [nntps] accepted connection from 97.79.58.17:57054
2013.04.17 13:40:51 LOG5[30291:3073764160]: connect_blocking: connected 127.0.0.1:119
2013.04.17 13:40:51 LOG5[30291:3073764160]: Service [nntps] connected remote server from 127.0.0.1:46866
2013.04.17 13:40:51 LOG3[30291:3073764160]: SSL_read: 14094418: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
2013.04.17 13:40:51 LOG5[30291:3073764160]: Connection reset: 95 byte(s) sent to SSL, 0 byte(s) sent to socket
我被难住了。能帮忙吗?
编辑:其他地方有人建议我添加sslVersion=SSLv3
到我的 stunnel 配置中,但这似乎没有任何效果。
答案1
“tlsv1 alert unknown ca” 对我来说听起来很清楚。stunnel 无法检查对方的证书,因为配置的 CA 与签署证书的 CA 不匹配。或者根本没有配置 CA。您需要一个这样的条目:
CAfile = /etc/stunnel/CA.crt
或者CApath
相反(更复杂;只是如果您需要多个 CA)。