我有一个 NGINX 站点,在 TLS 握手期间随机产生连接失败。我使用调查了这个问题,curl --trace
发现每个其他请求都会超时,因为服务器没有继续执行server certificate
SSLserver hello
握手协议。这是 curl 跟踪日志:
== Info: Trying 123.11.22.109...
== Info: TCP_NODELAY set
== Info: Connected to registry.my-server.com (123.11.22.109) port 443 (#0)
== Info: ALPN, offering h2
== Info: ALPN, offering http/1.1
== Info: successfully set certificate verify locations:
== Info: CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
=> Send SSL data, 5 bytes (0x5)
0000: 16 03 01 00 de .....
== Info: TLSv1.2 (OUT), TLS handshake, Client hello (1):
=> Send SSL data, 222 bytes (0xde)
0000: 01 00 00 da 03 03 fa b3 b2 20 05 26 50 37 c2 4c ......... .&P7.L
0010: 7f e7 8d 3e 87 25 95 43 7f c2 bd 73 b2 1a ea c3 ..>.%.C..s....
(rest omitted...)
<= Recv SSL data, 5 bytes (0x5)
0000: 16 03 03 00 6c ....l
== Info: TLSv1.2 (IN), TLS handshake, Server hello (2):
<= Recv SSL data, 108 bytes (0x6c)
0000: 02 00 00 68 03 03 ab 7f 0e 88 9a b0 00 22 87 a4 ...h........"..
0010: cb f5 c7 64 46 62 e2 6e bc a7 52 2a 4b 26 a2 0f ...dFb.n..R*K&..
0020: d3 f9 e3 7e c5 c0 20 49 e9 89 dd 4b 73 92 21 28 ...~.. I...Ks.!(
0030: 82 24 df e8 dc ac 20 98 fe d0 36 6d 9f 49 7f 36 .$.... ...6m.I6
0040: 8a 8b 2b 54 f8 63 4c c0 30 00 00 20 00 00 00 00 ..+T.cL.0.. ....
0050: ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 10 00 ................
0060: 0b 00 09 08 68 74 74 70 2f 31 2e 31 ....http/1.1
<= Recv SSL data, 5 bytes (0x5)
0000: 16 03 03 15 30 ....0
== Info: Operation timed out after 300869 milliseconds with 0 out of 0 bytes received
这种情况并非每次连接都会发生,可能每 8 个连接才会发生一次。我还没能找出规律。问题突然出现,之前几个月的配置运行都没有问题。
有什么线索吗?