![https 连接,TLS 挂起并最终失败 SSL_ERROR_SYSCALL](https://linux22.com/image/734188/https%20%E8%BF%9E%E6%8E%A5%EF%BC%8CTLS%20%E6%8C%82%E8%B5%B7%E5%B9%B6%E6%9C%80%E7%BB%88%E5%A4%B1%E8%B4%A5%20SSL_ERROR_SYSCALL.png)
我正在尝试正确诊断一个问题,我有权访问的服务器似乎无法通过端口 443 联系互联网上的另一台服务器:
~$ curl https://mydomain.co.uk -vvv
* Rebuilt URL to: https://mydomain.co.uk/
* Trying 1.2.3.4...
* TCP_NODELAY set
* Connected to mydomain.co.uk (1.2.3.4) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mydomain.co.uk:443
* stopped the pause stream!
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mydomain.co.uk:443
我读到过这可能是由于密码不兼容造成的。所以我尝试在不同网络上的不同服务器上进行操作,但这次连接成功了:
~$ curl https://mydomain.co.uk -vvv
* Rebuilt URL to: https://mydomain.co.uk/
* Trying 1.2.3.4...
* TCP_NODELAY set
* Connected to mydomain.co.uk (1.2.3.4) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=NA; ST=Some Place; L=Some City; O=MyCompany; OU=Technology; CN=*.mydomain.co.uk
* start date: Mar 15 00:00:00 2018 GMT
* expire date: Nov 13 12:00:00 2019 GMT
* subjectAltName: host "mydomain.co.uk" matched cert's "mydomain.co.uk"
* issuer: C=US; O=AniCert Inc; OU=www.anicert.com; CN=NioTrust RSA CA 2019
* SSL certificate verify ok.
> GET / HTTP/1.1
> Host: mydomain.co.uk
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 302 Moved Temporarily
< Server: nginx
< Date: Mon, 25 Feb 2019 17:30:02 GMT
< Content-Type: text/html
< Content-Length: 154
< Connection: keep-alive
< Location: https://www.mydomain.co.uk
<
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host mydomain.co.uk left intact
我尝试执行命令的两台服务器curl
都是相同的,但它们所在的网络不同。我可以访问的两台服务器运行的是 Ubuntu 18.04。我无法访问它们都尝试连接的远程服务器。我需要能够准确指出问题是什么/可能是什么。
所以这不是密码的问题。还有什么原因会导致 TLS 握手像这样挂起?
欢呼吧,安库尔
答案1
这个问题已经解决了。这是因为 IP 被列入了黑名单。一旦将其删除,连接即可成功建立。
答案2
可能只是巧合,但我今天也遇到了类似的错误。服务器进程不知怎么地连接了一半。有时它能顺利连接,有时它会让客户端无限期地等待,就像您在这里遇到的情况一样。不得不 kill -9 这个服务器进程。