☰

讓我們在非標準連接埠上加密嗎？

tag-icon • tag-icon ssl lets-encrypt
讓我們在非標準連接埠上加密嗎？

我有一個無法解釋的奇怪現象。我正在運行帶有 LetsEncrypt 的 nginx 和 Java 應用程式伺服器。 nginx 監聽 443，應用程式伺服器監聽 8008。 Nginx 工作起來很有魅力，但應用程式伺服器很奇怪：

試試這個網址

  • 郵差載入沒有錯誤
  • CURL 載入時沒有錯誤
  • macOS 上的 Safari 載入時沒有錯誤
  • macOS 上的 Chrome 載入頁面，但 JavaScript 取得/openapi.json也失敗直接下載
  • macOS 上的 Firefox 失敗（無法建立安全連線）
  • iOS 上的 Safari 失敗

使用curl -v --http1.1 https://frascati.projectkeep.io:8008/openapi/顯示：

curl -v --http1.1 https://frascati.projectkeep.io:8008/openapi/
*   Trying 18.218.218.93...
* TCP_NODELAY set
* Connected to frascati.projectkeep.io (18.218.218.93) port 8008 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=frascati.projectkeep.io
*  start date: Jan 27 13:46:16 2020 GMT
*  expire date: Apr 26 13:46:16 2020 GMT
*  subjectAltName: host "frascati.projectkeep.io" matched cert's "frascati.projectkeep.io"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> GET /openapi/ HTTP/1.1
> Host: frascati.projectkeep.io:8008
> User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
> Accept: */*
> Referer: 
> 
< HTTP/1.1 200 OK
< accept-ranges: bytes
< content-length: 1394
< cache-control: public, max-age=86400
< last-modified: Mon, 27 Jan 2020 16:05:19 GMT
< date: Mon, 27 Jan 2020 18:11:52 GMT
< content-type: text/html;charset=UTF-8
< 
<!-- HTML for static distribution bundle build -->
<!DOCTYPE html>

更新

為了比較這裡的 nginx 輸出相同內容：

 curl -v https://frascati.projectkeep.io/openapi/
*   Trying 18.218.218.93...
* TCP_NODELAY set
* Connected to frascati.projectkeep.io (18.218.218.93) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=frascati.projectkeep.io
*  start date: Jan 27 13:46:16 2020 GMT
*  expire date: Apr 26 13:46:16 2020 GMT
*  subjectAltName: host "frascati.projectkeep.io" matched cert's "frascati.projectkeep.io"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> GET /openapi/ HTTP/1.1
> Host: frascati.projectkeep.io
> User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
> Accept: */*
> Referer: 
> 
< HTTP/1.1 200 OK
< Server: nginx/1.16.1
< Date: Mon, 27 Jan 2020 18:07:02 GMT
< Content-Type: text/html;charset=UTF-8
< Content-Length: 1394
< Connection: keep-alive
< accept-ranges: bytes
< cache-control: public, max-age=86400
< last-modified: Mon, 27 Jan 2020 16:05:19 GMT
< 
<!-- HTML for static distribution bundle build -->

我想念什麼？

答案1

正如該問題的評論中所指出的：

  1. 您的應用程式伺服器正在使用 Java 8 JSSE，

  2. 它已TLSv1.3配置了可能的 TLS 協定。

所描述的問題是由缺乏對 TLSv1.3 的支持在 Java 的標準 SSLContext 實作中。所以：

  • curl建議TLS最高版本1.3
  • 伺服器接受，然後就卡住了

評論：如果您使用 Tomcat，則底層本機庫OpenSSLImplementation支援。TLSv1.3

相關內容