且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

OpenSSL::SSL::SSLError: SSL_connect SYSCALL 返回=5 errno=0 state=SSLv3 read server hello A

更新时间:2022-11-06 22:15:22

这是服务器站点的问题.看起来服务器只接受 TLS 1.2,并且当客户端请求较少的内容(例如降级或发送 SSL 警报)而只是关闭连接时,它不会显示通常的行为.

This is a problem at the server site. It looks like the server is exclusively accepting TLS 1.2 and does not show the usual behavior when the client requests something lesser (like downgrading or sending SSL alert) but instead just closes the connection.

OpenSSL 0.9.8 不支持 TLS 1.2,此外您的代码强制执行 SSLv3.只有在升级到 OpenSSL 1.0.1 时才能获得 TLS 1.2.

TLS 1.2 is not supported by OpenSSL 0.9.8 and additionally your code enforces SSLv3. You get TLS 1.2 only when upgrading to OpenSSL 1.0.1.

某些浏览器也将无法连接到此服务器,即使它们有办法绕过此类损坏的服务器.但是,虽然 Firefox 只会尝试将连接降级到较低的 SSL 版本(这通常有帮助),但 Chrome 设法与 TLS 1.2 连接.

Some browsers will also fail to connect to this server, even if they have ways to work around such broken servers. But while Firefox will only try to downgrade the connection to lesser SSL version (which often helps) Chrome manages to connect with TLS 1.2.

我已经进一步分析了这个问题,现在我无法再与 TLS1.2 建立连接,但我可以与 TLS1.0 或 SSL3.0 建立连接,但前提是密码被硬编码为 RC4-沙.我试过 AES128-SHA 或 DES-CBC3-SHA 之类的其他方法,但它们不起作用.因此,虽然它看起来像是一个非常混乱的系统,但明确设置

I've analyzed the issue further and now I cannot get a connection with TLS1.2 anymore but I can get a connection with TLS1.0 or SSL3.0, but only if the ciphers is hard coded to RC4-SHA. I've tried others like AES128-SHA or DES-CBC3-SHA and they don't work. So while it looks like a really messed up system explicitly setting

http.ssl_version = 'TLSv1'       -- or SSLv3, but TLSv1 is better
http.ssl_cipher = 'rc4-sha'

应该可以.我不是 ruby​​ 用户,所以确切的语法可能会有所不同,但我已经使用 OpenSSL s_client 进行了测试.

should work. I'm not a ruby user so the exact syntax might differ, but I've tested with OpenSSL s_client.