R
проблема с чтением сертификата.
Он правильно собран?
Он правильно собран?
Да, ничего не ругается больше.
Size: a a a
2020 July 06
k
Добрый день. Подскажите, пожалуйста, с чем может быть связана подобная ошибка?
[info] 28937#28937: *25430874 SSL_read() failed (SSL: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:SSL alert number 10) while waiting for request, client: 10.0.50.14, server: 0.0.0.0:443
[info] 28937#28937: *25430874 SSL_read() failed (SSL: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:SSL alert number 10) while waiting for request, client: 10.0.50.14, server: 0.0.0.0:443
какой-то кривой ssl/tls handshake случился
AN
Добрый день. Подскажите, пожалуйста, с чем может быть связана подобная ошибка?
[info] 28937#28937: *25430874 SSL_read() failed (SSL: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:SSL alert number 10) while waiting for request, client: 10.0.50.14, server: 0.0.0.0:443
[info] 28937#28937: *25430874 SSL_read() failed (SSL: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:SSL alert number 10) while waiting for request, client: 10.0.50.14, server: 0.0.0.0:443
Клиент с кривой ssl-библиотекой.
R
Клиент с кривой ssl-библиотекой.
chrome
AN
Актуальный?
AN
sslv3 в конфиге выключен?
R
sslv3 в конфиге выключен?
ssl_protocols TLSv1.2 TLSv1.3;
AN
Хм. А шифры какие?
AN
Скажем так - у меня примерно на 10к запросов один вот такой прилетает
Я отдебажить не смог, но клиенты там чужие
Тут - шансы есть
Я отдебажить не смог, но клиенты там чужие
Тут - шансы есть
R
что curl пишет?
root@app:(/home/rk)curl -v 'https://<hostname>/sms'
* Hostname was NOT found in DNS cache
* Trying 192.168.51.10...
* Connected to <hostname> (192.168.51.10) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
* subject: CN=*.<hostname>
* start date: 2020-06-17 07:47:11 GMT
* expire date: 2021-06-13 17:04:01 GMT
* subjectAltName: <hostname> matched
* issuer: C=BE; O=GlobalSign nv-sa; CN=AlphaSSL CA - SHA256 - G2
* SSL certificate verify ok.
> GET /sms HTTP/1.1
> User-Agent: curl/7.38.0
> Host: <hostname>
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
* Server nginx/1.14.2 is not blacklisted
< Server: nginx/1.14.2
< Date: Mon, 06 Jul 2020 15:04:15 GMT
< Content-Type: text/html
< Content-Length: 185
< Location: https://<hostname>/sms/
< Connection: close
< Strict-Transport-Security: max-age=63072000;
<
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.13.1</center>
</body>
</html>
* Closing connection 0
* SSLv3, TLS alert, Client hello (1):
* Hostname was NOT found in DNS cache
* Trying 192.168.51.10...
* Connected to <hostname> (192.168.51.10) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
* subject: CN=*.<hostname>
* start date: 2020-06-17 07:47:11 GMT
* expire date: 2021-06-13 17:04:01 GMT
* subjectAltName: <hostname> matched
* issuer: C=BE; O=GlobalSign nv-sa; CN=AlphaSSL CA - SHA256 - G2
* SSL certificate verify ok.
> GET /sms HTTP/1.1
> User-Agent: curl/7.38.0
> Host: <hostname>
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
* Server nginx/1.14.2 is not blacklisted
< Server: nginx/1.14.2
< Date: Mon, 06 Jul 2020 15:04:15 GMT
< Content-Type: text/html
< Content-Length: 185
< Location: https://<hostname>/sms/
< Connection: close
< Strict-Transport-Security: max-age=63072000;
<
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.13.1</center>
</body>
</html>
* Closing connection 0
* SSLv3, TLS alert, Client hello (1):