![Apache2:SSLv2/v3 读取服务器 hello A 时出错](https://linux22.com/image/737895/Apache2%EF%BC%9ASSLv2%2Fv3%20%E8%AF%BB%E5%8F%96%E6%9C%8D%E5%8A%A1%E5%99%A8%20hello%20A%20%E6%97%B6%E5%87%BA%E9%94%99.png)
我的 Ubuntu 上的 Apache2 Webserver 莫名其妙地停止工作了。我想打开的每个 HTTPS 站点都收到“SSL_ERROR_RX_RECORD_TOO_LONG”消息。当我在服务器上调用“openssl s_client -connect www.kosa-strick.com:443 -state -debug”时,我收到:
SSL_connect:error in SSLv2/v3 read server hello A
140122828576408:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:
VHOST-Config 是:
<VirtualHost *:80>
ServerName www.kosa-strick.com
ServerAdmin [email protected]
Redirect / https://www.kosa-strick.com/
ErrorLog ${APACHE_LOG_DIR}/kosa_error.log
CustomLog ${APACHE_LOG_DIR}/kosa_access.log combined
</VirtualHost>
<VirtualHost *:443>
ServerName www.kosa-strick.com
ServerAdmin [email protected]
<Directory /var/www/kosa/kosa-strick-website/public_html>
AllowOverride All
</Directory>
DocumentRoot /var/www/kosa/kosa-strick-website/public_html
ErrorLog ${APACHE_LOG_DIR}/kosa_error.log
CustomLog ${APACHE_LOG_DIR}/kosa_access.log combined
SSLCertificateFile /etc/letsencrypt/live/www.kosa-strick.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.kosa-strick.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
SSL 配置文件是:
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.
SSLEngine on
# Intermediate configuration, tweak to your needs
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder on
SSLCompression off
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
#CustomLog /var/log/apache2/access.log vhost_combined
#LogLevel warn
#ErrorLog /var/log/apache2/error.log
# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"
我没有更改配置或更新任何内容。它只是停止工作。重新启动服务器没有帮助。
日志文件显示:
[Thu May 16 12:44:42.444514 2019] [ssl:warn] [pid 10992] AH01916: Init: (yewsvr1.yewstone.io:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Thu May 16 12:44:42.494285 2019] [ssl:warn] [pid 10993] AH01916: Init: (yewsvr1.yewstone.io:443) You configured HTTP(80) on the standard HTTPS(443) port!
[Thu May 16 12:44:42.495892 2019] [mpm_prefork:notice] [pid 10993] AH00163: Apache/2.4.18 (Ubuntu) OpenSSL/1.0.2g configured -- resuming normal operations
[Thu May 16 12:44:42.495922 2019] [core:notice] [pid 10993] AH00094: Command line: '/usr/sbin/apache2'
但这完全是胡扯。端口配置已经工作多年,从未改变过,ports.conf 是正确的:
Listen 80
<IfModule ssl_module>
Listen 443
</IfModule>
<IfModule mod_gnutls.c>
Listen 443
</IfModule>
答案1
yewsvr1.yewstone.io:443... You configured HTTP(80) on the standard HTTPS(443) port! ...
但这是胡说八道
如果 Apache 这么说,那么这就是它看到的您的配置,而且很可能不是胡说八道。我猜错误出现在您未显示的配置部分,即 yewsvr1.yewstone.io 的配置中。如果同一 IP 和端口上的某个 vhost 配置不正确,就足以导致您看到的问题。