![如何修复 Gentoo 上的curl sslv3警报握手失败?](https://linux22.com/image/83738/%E5%A6%82%E4%BD%95%E4%BF%AE%E5%A4%8D%20Gentoo%20%E4%B8%8A%E7%9A%84curl%20sslv3%E8%AD%A6%E6%8A%A5%E6%8F%A1%E6%89%8B%E5%A4%B1%E8%B4%A5%EF%BC%9F.png)
我正在尝试使用 cURL 打开一个网站,如下所示:
$ curl -vH "Accept: application/json" https://www.rocketleaguereplays.com/api/replays/-1/
输出是:
* Trying 104.24.114.83...
* Connected to www.rocketleaguereplays.com (104.24.114.83) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Unknown (21):
* TLSv1.2 (IN), TLS alert, Server hello (2):
* error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
我安装了 Linux 内核 4.4.0 和最新的 cURL 版本:
$ curl -V
curl 7.47.1 (x86_64-pc-linux-gnu) libcurl/7.47.1 OpenSSL/1.0.2f zlib/1.2.8 c-ares/1.10.0 nghttp2/1.6.0
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile NTLM SSL libz TLS-SRP HTTP2 UnixSockets
我怎样才能解决这个问题?在 Ubuntu 上,它可以与 cURL 和相同的 URL 配合使用。
答案1
基本上,https://www.rocketleaguereplays.com使用过时的加密 (SSL3),您可以使用 -k (--insecure) 开关强制curl 连接到像这样的不安全站点。
尝试这个:
curl -kvH "Accept: application/json" https://www.rocketleaguereplays.com/api/replays/-1/
您也可以尝试使用-3
aka--sslv3
开关,但是,如果在构建时不支持 SSL3,那么您需要编译自己的curl 版本,以启用 SSL3。
编辑:操作人员发现了问题。
我对错误消息感到困惑。
这是gentoo 中的一个错误:
https://bugs.gentoo.org/show_bug.cgi?id=531540
基本上,当您使用bindist标志构建openssl时,椭圆曲线加密被禁用。该网站需要椭圆曲线加密。
当我运行这个时,我得到以下信息:
$ curl -vH "Accept: application/json" https://www.rocketleaguereplays.com/api/replays/-1/ * STATE: INIT => CONNECT handle 0x6000572d0; line 1090 (connection #-5000) * Added connection 0. The cache now contains 1 members * Trying 2400:cb00:2048:1::6818:7353... * STATE: CONNECT => WAITCONNECT handle 0x6000572d0; line 1143 (connection #0) * Connected to www.rocketleaguereplays.com (2400:cb00:2048:1::6818:7353) port 443 (#0) * STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x6000572d0; line 1240 (connection #0) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * TLSv1.2 (OUT), TLS header, Certificate Status (22): * TLSv1.2 (OUT), TLS handshake, Client hello (1): * STATE: SENDPROTOCONNECT => PROTOCONNECT handle 0x6000572d0; line 1254 (connection #0) * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Client hello (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256 <---- [...]
所以我的卷曲在这个网站上使用了椭圆曲线。