在 Ubuntu 20.04 和 Debian 10 中 ClientHello 后 SSL 握手失败（适用于 Ubuntu 18.04 和 Debian 9）答案

【问题标题】：SSL handshake failure after ClientHello in Ubuntu 20.04 and Debian 10 (works in Ubuntu 18.04 and Debian 9)在 Ubuntu 20.04 和 Debian 10 中 ClientHello 后 SSL 握手失败（适用于 Ubuntu 18.04 和 Debian 9）
【发布时间】：2020-09-15 21:10:21
【问题描述】：

我一直在尝试使用 Oracle 云电子邮件递送服务。配置完成后，它会提供 SMTP 凭据，您可以使用该凭据从批准的发件人那里发送电子邮件。

我被一些有趣的场景所困。它适用于 Ubuntu 18.04，但在同一台机器上运行的 docker 容器（运行 Debian 10）中失败。

我正在使用 openssl s_client 测试握手

echo QUIT | openssl s_client -starttls smtp -crlf -connect smtp.email.ap-mumbai-1.oci.oraclecloud.com:587

此命令在 Ubuntu 18.04 中运行良好，但在运行 Debian 10 的 docker 容器中因握手失败而失败

Docker 容器的输出

root@06369bfe7c16:/var/www/html# echo QUIT | openssl s_client -starttls smtp -crlf -connect smtp.email.ap-mumbai-1.oci.oraclecloud.com:587
CONNECTED(00000003)
140491098481792:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1544:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 199 bytes and written 367 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
root@06369bfe7c16:/var/www/html#

我尝试检查两个中的 openssl 版本。

18.04 有 openssl 版本OpenSSL 1.1.1 11 Sep 2018

Docker 容器的 openssl 版本为 OpenSSL 1.1.1d 10 Sep 2019

会不会和版本有关？

我尝试通过 Wireshark 进行更多调试，以查看 ClientHello 消息是如何发送的 -

Ubuntu 18.04 中的ClientHello（成功返回）

TLSv1.2 Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.0 (0x0301)
    Length: 339
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 335
        Version: TLS 1.2 (0x0303)
        Random: e595f987b8d92387f7114d9dee4df7bc3f00b5b082ba0ec8…
        Session ID Length: 32
        Session ID: 74c873d7894514a047e0763cd14c01fb19a4f238cb9085f2…
        Cipher Suites Length: 62
        Cipher Suites (31 suites)
            Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
            Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)
            Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
            Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
            Cipher Suite: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xccaa)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006b)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
            Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
            Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
            Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
        Compression Methods Length: 1
        Compression Methods (1 method)
            Compression Method: null (0)
        Extensions Length: 200
        Extension: server_name (len=47)
            Type: server_name (0)
            Length: 47
            Server Name Indication extension
        Extension: ec_point_formats (len=4)
            Type: ec_point_formats (11)
            Length: 4
            EC point formats Length: 3
            Elliptic curves point formats (3)
                EC point format: uncompressed (0)
                EC point format: ansiX962_compressed_prime (1)
                EC point format: ansiX962_compressed_char2 (2)
        Extension: supported_groups (len=12)
            Type: supported_groups (10)
            Length: 12
            Supported Groups List Length: 10
            Supported Groups (5 groups)
        Extension: session_ticket (len=0)
            Type: session_ticket (35)
            Length: 0
            Data (0 bytes)
        Extension: encrypt_then_mac (len=0)
            Type: encrypt_then_mac (22)
            Length: 0
        Extension: extended_master_secret (len=0)
            Type: extended_master_secret (23)
            Length: 0
        Extension: signature_algorithms (len=48)
            Type: signature_algorithms (13)
            Length: 48
            Signature Hash Algorithms Length: 46
            Signature Hash Algorithms (23 algorithms)
                Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                Signature Algorithm: ecdsa_secp384r1_sha384 (0x0503)
                Signature Algorithm: ecdsa_secp521r1_sha512 (0x0603)
                Signature Algorithm: ed25519 (0x0807)
                Signature Algorithm: ed448 (0x0808)
                Signature Algorithm: rsa_pss_pss_sha256 (0x0809)
                Signature Algorithm: rsa_pss_pss_sha384 (0x080a)
                Signature Algorithm: rsa_pss_pss_sha512 (0x080b)
                Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
                Signature Algorithm: rsa_pss_rsae_sha384 (0x0805)
                Signature Algorithm: rsa_pss_rsae_sha512 (0x0806)
                Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
                Signature Algorithm: rsa_pkcs1_sha384 (0x0501)
                Signature Algorithm: rsa_pkcs1_sha512 (0x0601)
                Signature Algorithm: SHA224 ECDSA (0x0303)
                Signature Algorithm: ecdsa_sha1 (0x0203)
                Signature Algorithm: SHA224 RSA (0x0301)
                Signature Algorithm: rsa_pkcs1_sha1 (0x0201)
                Signature Algorithm: SHA224 DSA (0x0302)
                Signature Algorithm: SHA1 DSA (0x0202)
                Signature Algorithm: SHA256 DSA (0x0402)
                Signature Algorithm: SHA384 DSA (0x0502)
                Signature Algorithm: SHA512 DSA (0x0602)
        Extension: supported_versions (len=9)
            Type: supported_versions (43)
            Length: 9
            Supported Versions length: 8
            Supported Version: TLS 1.3 (0x0304)
            Supported Version: TLS 1.2 (0x0303)
            Supported Version: TLS 1.1 (0x0302)
            Supported Version: TLS 1.0 (0x0301)
        Extension: psk_key_exchange_modes (len=2)
            Type: psk_key_exchange_modes (45)
            Length: 2
            PSK Key Exchange Modes Length: 1
            PSK Key Exchange Mode: PSK with (EC)DHE key establishment (psk_dhe_ke) (1)
        Extension: key_share (len=38)
            Type: key_share (51)
            Length: 38
            Key Share extension

来自 Docker 容器的 ClientHello 消息（导致握手失败 SSL 警报编号 40）

TLSv1.2 Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.0 (0x0301)
    Length: 234
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 230
        Version: TLS 1.2 (0x0303)
        Random: 20375888f578157f3989533cc8d2c6e5b1db2795dba56ff2…
        Session ID Length: 0
        Cipher Suites Length: 56
        Cipher Suites (28 suites)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
            Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
            Cipher Suite: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xccaa)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006b)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
            Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
            Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
            Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
        Compression Methods Length: 1
        Compression Methods (1 method)
            Compression Method: null (0)
        Extensions Length: 133
        Extension: server_name (len=47)
            Type: server_name (0)
            Length: 47
            Server Name Indication extension
        Extension: ec_point_formats (len=4)
            Type: ec_point_formats (11)
            Length: 4
            EC point formats Length: 3
            Elliptic curves point formats (3)
                EC point format: uncompressed (0)
                EC point format: ansiX962_compressed_prime (1)
                EC point format: ansiX962_compressed_char2 (2)
        Extension: supported_groups (len=12)
            Type: supported_groups (10)
            Length: 12
            Supported Groups List Length: 10
            Supported Groups (5 groups)
        Extension: session_ticket (len=0)
            Type: session_ticket (35)
            Length: 0
            Data (0 bytes)
        Extension: encrypt_then_mac (len=0)
            Type: encrypt_then_mac (22)
            Length: 0
        Extension: extended_master_secret (len=0)
            Type: extended_master_secret (23)
            Length: 0
        Extension: signature_algorithms (len=42)
            Type: signature_algorithms (13)
            Length: 42
            Signature Hash Algorithms Length: 40
            Signature Hash Algorithms (20 algorithms)
                Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                Signature Algorithm: ecdsa_secp384r1_sha384 (0x0503)
                Signature Algorithm: ecdsa_secp521r1_sha512 (0x0603)
                Signature Algorithm: ed25519 (0x0807)
                Signature Algorithm: ed448 (0x0808)
                Signature Algorithm: rsa_pss_pss_sha256 (0x0809)
                Signature Algorithm: rsa_pss_pss_sha384 (0x080a)
                Signature Algorithm: rsa_pss_pss_sha512 (0x080b)
                Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
                Signature Algorithm: rsa_pss_rsae_sha384 (0x0805)
                Signature Algorithm: rsa_pss_rsae_sha512 (0x0806)
                Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
                Signature Algorithm: rsa_pkcs1_sha384 (0x0501)
                Signature Algorithm: rsa_pkcs1_sha512 (0x0601)
                Signature Algorithm: SHA224 ECDSA (0x0303)
                Signature Algorithm: SHA224 RSA (0x0301)
                Signature Algorithm: SHA224 DSA (0x0302)
                Signature Algorithm: SHA256 DSA (0x0402)
                Signature Algorithm: SHA384 DSA (0x0502)
                Signature Algorithm: SHA512 DSA (0x0602)

这是来自 Ubuntu 18.04 的 ServerHello 消息

TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 4345
    Handshake Protocol: Server Hello
        Handshake Type: Server Hello (2)
        Length: 81
        Version: TLS 1.2 (0x0303)
        Random: 5ecea16938ffb32685dee0d46241ab4533820a178f3766e6…
        Session ID Length: 32
        Session ID: 5ecea169972b4c49269218eb6d64fbdeedb76539703d48e5…
        Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
        Compression Method: null (0)
        Extensions Length: 9
        Extension: renegotiation_info (len=1)
        Extension: extended_master_secret (len=0)
    Handshake Protocol: Certificate
    Handshake Protocol: Server Key Exchange
        Handshake Type: Server Key Exchange (12)
        Length: 329
        EC Diffie-Hellman Server Params
            Curve Type: named_curve (0x03)
            Named Curve: secp256r1 (0x0017)
            Pubkey Length: 65
            Pubkey: 048f81fb0fcd06c8f1d50620af144965cae3dd3804df3454…
            Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
            Signature Length: 256
            Signature: 76bf06d1a887440d01be65938a92094510ae52e031463d58…
    Handshake Protocol: Server Hello Done

服务器似乎使用了 CipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256，它恰好也出现在 Docker Container ClientHello 中。

所以我在这种情况下缺少什么。我是 SSL 调试的新手。

如果 Ciphersuites 匹配可能会有所不同，以便服务器返回握手失败？

请告诉我下一步我可以调查什么。

我已经在https://gofile.io/d/ERJXNe上传了wireshark捕获

从运行 Debian-9（openssl 1.1.0l）的 docker 容器中捕获了一个导致握手成功的内容。

更新：我尝试在最新的 Ubuntu 20.04 VM 中使用 openssl s_client，但由于握手失败而失败。

【问题讨论】：

标签： ssl openssl handshake debian-buster ubuntu-20.04

【解决方案1】：

这是 David Benjamin 在此 github 评论中描述的问题之一：

https://github.com/openssl/openssl/issues/11438#issuecomment-606927855

基本上它是一个有问题的服务器。即使它完全能够使用 SHA-2 哈希进行签名，但如果 SHA-1 不在客户端支持的签名算法哈希列表中，它也会失败。

为了测试这个，我首先尝试了这个：

$ openssl s_client -starttls smtp -crlf -connect smtp.email.ap-mumbai-1.oci.oraclecloud.com:587 -no_tls1_3 -trace -sigalgs "RSA+SHA256"

我收到了您收到的握手失败警报。然后我重试了相同的命令，但添加了一个额外的基于 SHA1 的 sigalg：

$ openssl s_client -starttls smtp -crlf -connect smtp.email.ap-mumbai-1.oci.oraclecloud.com:587 -no_tls1_3 -trace -sigalgs "RSA+SHA256:RSA+SHA1"

第二次连接成功。

您会在跟踪中注意到您的 docker 包含的基于 OpenSSL 的版本没有发送任何基于 SHA1 的签名算法。要解决此问题，您需要额外配置这些。

【讨论】：

谢谢。这很有帮助。所以这应该在服务器端修复？最新的 OpenSSL 版本没有在 ClientHello 请求中发送基于 SHA1 的签名算法的原因可能是什么？或者这些正在被弃用？
是的。这是一个服务器端问题——尽管（正如我所说）它可以通过发送基于 SHA1 的信号在客户端解决。普遍不鼓励使用 SHA1（例如，参见 shattered.io）。实际上，从 OpenSSL 项目获得的最新 OpenSSL 版本仍然会发送基于 SHA1 的信号。但是，某些平台的一些 OpenSSL 下游打包程序将默认配置设置为不发送它们。

【解决方案2】：

仅供参考，服务器已更新为使用 SHA-2 根证书来解决此问题。但这里是对问题和基本标准的分析：

实际问题是该服务器的证书链有一个 SHA-1 根证书，并且客户端声明它不支持在证书链中验证 SHA-1 证书。阅读 TLS 1.2 规范（https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1），合理解释下服务器的行为是正确的：

   The client uses the "signature_algorithms" extension to indicate to
   the server which signature/hash algorithm pairs may be used in   
   digital signatures.

TLS 1.3 规范对这种情况有更多说法（https://www.rfc-editor.org/rfc/rfc8446#section-4.4.2.2）：

   All certificates provided by the server MUST be signed by a signature
   algorithm advertised by the client if it is able to provide such a
   chain (see Section 4.2.3).  Certificates that are self-signed or
   certificates that are expected to be trust anchors are not validated
   as part of the chain and therefore MAY be signed with any algorithm.

   If the server cannot produce a certificate chain that is signed only
   via the indicated supported algorithms, then it SHOULD continue the
   handshake by sending the client a certificate chain of its choice
   that may include algorithms that are not known to be supported by the
   client.  This fallback chain SHOULD NOT use the deprecated SHA-1 hash
   algorithm in general, but MAY do so if the client's advertisement
   permits it, and MUST NOT do so otherwise.

对于此文本，解释取决于“使用”一词。如果它的意思是“在证书链中使用”，那么服务器的行为是正确的，并且 TLS 1.3 规范是自相矛盾的。如果它的意思是“用于验证证书链”，那么服务器的行为是错误的（在 TLS 1.3 规则下）并且 TLS 1.3 规范是一致的。我假设后者是更好的解释。

因此服务器遵循 TLS 1.2 规则，但尚未更新为遵循 TLS 1.3 规则。作为在相关服务器上工作的工程师之一，我认为这是一个错误，因为 TLS 1.3 取代了 TLS 1.2，但由于它是标准的两个版本之间的行为变化，所以它并不是一个特别严重的错误。

【讨论】：

您引用的规范非常清楚，本地根证书（即信任锚）的签名算法并不重要，因为无论如何都不会检查签名：“自预计是信任锚的签名或证书未作为链的一部分进行验证，因此可以使用任何算法进行签名。”。因此，根证书是否使用 SHA-1 签名并不重要。
Steffen，请重新阅读我写的内容。我说 TLS 1.2 规则服务器在合理解释下是有效的，通过对我引用的 TLS 1.3 规则的合理解释，你也用粗体引用我相信这是一个服务器错误。但是 TLS 版本之间的规则发生了变化。
鉴于根证书的签名一开始没有经过验证，因此检查此签名的签名算法是没有意义的。服务器实现可能只是简单地检查发送到客户端的所有证书上的签名算法，基于这样的假设，即服务器不会首先发送根证书，因为这样做没有意义（即这也是服务器端的错误配置）。
@steffen-ullrich 当有证据表明验证超出“最低可行要求”时，我会避免假设配置错误；您可能还记得几十年来汽车没有安全带，因为它们不是驾驶汽车的必要条件，但今天我们决定在世界大部分地区都需要安全带，否则驾驶汽车是不合适的。有些人的安全标准高于基本安全标准，没有任何理由或证据表明这是错误配置
使用 AKI/SKI 构建链的根 CA 证书（路径 0）也不是“信任锚”。我向不熟悉用于 TLS 目的的信任锚的具体含义的读者提及这一点。您可以在对话中通俗地称其为信任锚，因为这对您有意义，但是对于 TLS，信任锚超出链，超出注册域，超出权威域，超出 TLD，身份验证链根锚，又名信任锚;签名非常公开，可以在这里找到data.iana.org/root-anchors