☰

Apache2：SSLv2/v3 读取服务器 hello A 时出错

tag-icon • tag-icon ssl apache-2.4 apache2 lets-encrypt
Apache2：SSLv2/v3 读取服务器 hello A 时出错

我的 Ubuntu 上的 Apache2 Webserver 莫名其妙地停止工作了。我想打开的每个 HTTPS 站点都收到“SSL_ERROR_RX_RECORD_TOO_LONG”消息。当我在服务器上调用“openssl s_client -connect www.kosa-strick.com:443 -state -debug”时，我收到：

SSL_connect:error in SSLv2/v3 read server hello A
140122828576408:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:

VHOST-Config 是：

<VirtualHost *:80>
        ServerName www.kosa-strick.com
        ServerAdmin [email protected]
        Redirect / https://www.kosa-strick.com/
        ErrorLog ${APACHE_LOG_DIR}/kosa_error.log
        CustomLog ${APACHE_LOG_DIR}/kosa_access.log combined
</VirtualHost>

<VirtualHost *:443>
        ServerName www.kosa-strick.com
        ServerAdmin [email protected]

        <Directory /var/www/kosa/kosa-strick-website/public_html>
                AllowOverride All
        </Directory>
        DocumentRoot /var/www/kosa/kosa-strick-website/public_html

        ErrorLog ${APACHE_LOG_DIR}/kosa_error.log
        CustomLog ${APACHE_LOG_DIR}/kosa_access.log combined

        SSLCertificateFile /etc/letsencrypt/live/www.kosa-strick.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/www.kosa-strick.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

SSL 配置文件是：

# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder     on
SSLCompression          off

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

#CustomLog /var/log/apache2/access.log vhost_combined
#LogLevel warn
#ErrorLog /var/log/apache2/error.log

# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"

我没有更改配置或更新任何内容。它只是停止工作。重新启动服务器没有帮助。

日志文件显示：

[Thu May 16 12:44:42.444514 2019] [ssl:warn] [pid 10992] AH01916: Init: (yewsvr1.yewstone.io:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Thu May 16 12:44:42.494285 2019] [ssl:warn] [pid 10993] AH01916: Init: (yewsvr1.yewstone.io:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Thu May 16 12:44:42.495892 2019] [mpm_prefork:notice] [pid 10993] AH00163: Apache/2.4.18 (Ubuntu) OpenSSL/1.0.2g configured -- resuming normal operations
[Thu May 16 12:44:42.495922 2019] [core:notice] [pid 10993] AH00094: Command line: '/usr/sbin/apache2'

但这完全是胡扯。端口配置已经工作多年，从未改变过，ports.conf 是正确的：

Listen 80

<IfModule ssl_module>
        Listen 443
</IfModule>

<IfModule mod_gnutls.c>
        Listen 443
</IfModule>

答案1

   yewsvr1.yewstone.io:443... You configured HTTP(80) on the standard HTTPS(443) port! ...

但这是胡说八道

如果 Apache 这么说，那么这就是它看到的您的配置，而且很可能不是胡说八道。我猜错误出现在您未显示的配置部分，即 yewsvr1.yewstone.io 的配置中。如果同一 IP 和端口上的某个 vhost 配置不正确，就足以导致您看到的问题。

相关内容