连接到 example.com 的未知 SSL 协议错误答案

【问题标题】：Unknown SSL protocol error in connection to example.com连接到 example.com 的未知 SSL 协议错误
【发布时间】：2018-02-24 03:34:24
【问题描述】：

更新 letencrypt 证书后，我的网站出现了一个问题。我试图调试 Nginx，但日志很清楚。但它有效。似乎我别无选择重新安装我的服务器。帮助。

curl --no-sessionid  -I -vvvv --tlsv1.2 -qv -3 https://example.com/
*   Trying 176.9.92.134...
* TCP_NODELAY set
* Connected to site.com (999.9.9.999) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /Users/user/anaconda3/ssl/cacert.pem
  CApath: none
* SSLv3 (OUT), TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to example.ru:443
* Curl_http_done: called premature == 1
* Closing connection 0

curl: (35) Unknown SSL protocol error in connection to example.com:443

openssl 的一些检查

`openssl s_client -connect example.com:443 -servername example.com -prexit
CONNECTED(00000003)
140736982107144:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 326 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1519402519
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 326 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1519402519
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---`

Nginx 配置 `服务器{ 听 99.99.99.99:443 ssl； server_name example.com;

    ssl_trusted_certificate /var/www/example/ca.cer;
    ssl_certificate /var/www/example/fullchain.cer;
    ssl_certificate_key /var/www/example/example.com.key;

    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /var/www/example/example_dhparam.pem;

    # modern configuration. tweak to your needs.
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 127.0.0.1 8.8.8.8;


    location /.well-known/ {
       alias /var/www/example/ssl/.well-known/;
    }

    location / {
       alias /var/www/example/index.html;
    }
}`

【问题讨论】：

你能分享一下你在nginx中配置了什么吗？在 https 部分下......或者您可以参考stackoverflow.com/questions/48685830/…中的 nginx 配置
我已经更新了问题
--tlsv1.2 请求 TLS 1.2 -3 请求 SSLv3。它们是互斥的，请下定决心！

标签： curl nginx lets-encrypt

【解决方案1】：

不应该吗

server {
               listen 443 ssl; 
               server_name example.com;
               ...
}

就像来自参考，http://nginx.org/en/docs/http/configuring_https_servers.html

server {
    listen              443 ssl;
    server_name         www.example.com;
    ssl_certificate     www.example.com.crt;
    ssl_certificate_key www.example.com.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ...
}

要配置 HTTPS 服务器，ssl 参数必须是在服务器块中的侦听套接字上启用，并且服务器证书和私钥文件的位置>应该指定..

【讨论】：

有什么区别？