我无法连接到似乎可以通过其他计算机/互联网连接运行的 SSL 站点（自签名证书）。我尝试使用 wget 访问该站点：
wget https://example.com --no-check-certificate
--2018-02-06 17:07:50-- https://example.com
Resolving example.com... xx.xx.xx.xx
Connecting to example.com|xx.xx.xx.xx|:443... connected.
Unable to establish SSL connection.
然后我使用 Python3 和请求模块另一次尝试：
>>> r = requests.get("https://example.com", verify=False)
Traceback (most recent call last):
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 601, in urlopen
chunked=chunked)
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 346, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
conn.connect()
File "/usr/lib/python3.5/site-packages/urllib3/connection.py", line 326, in connect
ssl_context=context)
File "/usr/lib/python3.5/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 377, in wrap_socket
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 752, in __init__
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 988, in do_handshake
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 633, in do_handshake
ConnectionResetError: [Errno 104] Connection reset by peer
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3.5/site-packages/requests/adapters.py", line 440, in send
timeout=timeout
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 639, in urlopen
_stacktrace=sys.exc_info()[2])
File "/usr/lib/python3.5/site-packages/urllib3/util/retry.py", line 357, in increment
raise six.reraise(type(error), error, _stacktrace)
File "/usr/lib/python3.5/site-packages/urllib3/packages/six.py", line 685, in reraise
raise value.with_traceback(tb)
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 601, in urlopen
chunked=chunked)
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 346, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3.5/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
conn.connect()
File "/usr/lib/python3.5/site-packages/urllib3/connection.py", line 326, in connect
ssl_context=context)
File "/usr/lib/python3.5/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 377, in wrap_socket
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 752, in __init__
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 988, in do_handshake
File "/home/linux-dev/target/usr/lib/python3.5/ssl.py", line 633, in do_handshake
urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/lib/python3.5/site-packages/requests/api.py", line 72, in get
return request('get', url, params=params, **kwargs)
File "/usr/lib/python3.5/site-packages/requests/api.py", line 58, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/lib/python3.5/site-packages/requests/sessions.py", line 508, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3.5/site-packages/requests/sessions.py", line 618, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3.5/site-packages/requests/adapters.py", line 490, in send
raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
>>>
然后我尝试使用 openssl 查看更详细的信息：
# openssl s_client -connect example.com:443 -servername example.com
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 330 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1517926190
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
从另一台计算机（具有不同的互联网连接）运行相同的 openssl 命令，将产生以下输出：
# openssl s_client -connect example.com:443 -servername example.com
CONNECTED(00000003)
depth=0 CN = example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 CN = example.com
verify return:1
---
Certificate chain
0 s:/CN=example.com
i:/CN=example.com
---
Server certificate
-----BEGIN CERTIFICATE-----
.
.
.
-----END CERTIFICATE-----
subject=/CN=example.com
issuer=/CN=example.com
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 706 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Server public key is 256 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-ECDSA-AES256-GCM-SHA384
Session-ID: xxxxxx
Session-ID-ctx:
Master-Key: xxxxxx
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1517926278
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
closed
什么原因可能导致连接失败？
答案1
由于两个完全不同的连接产生了完全不同的结果，我认为问题出在 DNS 上，请确保您在两个主机上获取相同的 IP。您可能在其中一个主机上也有主机文件条目，因此请检查一下。
答案2
事实证明，问题出在 ISP 阻止了某些顶级域名。访问该域名时，他们的防火墙返回 HTTP 响应 503 和一个 HTML 页面，表明该站点已被阻止。这个问题很难诊断，因为我尝试连接的原始站点使用 SSL，任何错误消息都很简短：“无法建立 SSL 连接”、“对等方重置连接”等。使用 wget 访问页面也无济于事，因为一旦收到 503 错误，它就会直接退出而不保存响应 HTML。
我最终通过使用 Python 3 的http.server 模块在有问题的服务器上，然后尝试使用 Python 请求模块从有问题的设备连接到它。这样我就可以看到响应的内容，并看到 ISP 的“页面被阻止”HTML 页面。