【发布时间】：2019-12-31 18:45:09
【问题描述】：
我们能够从 Linux 桌面使用 cURL 将数据发布到 AWS IoT Core，但是当我们从 Windows 桌面尝试时，我们会收到响应“curl: (52) Empty reply from server”。我们确信问题出在默认的 Windows 配置上，但该错误似乎表明存在服务器端问题？
我在某处看到它可能是由于 WinSSL，我们应该尝试切换到 OpenSSL，尽管我找不到任何关于如何实现的信息。
作为我们调试过程的一部分：
- 我们没有代理
- 主机防火墙作为测试被禁用
- 没有网络防火墙（家庭工作者）
Windows 上的 cURL 版本（不工作）：
curl 7.55.1 (Windows) libcurl/7.55.1 WinSSL
Release-Date: [unreleased]
Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL
Linux 上的 cURL 版本（工作）：
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL
Windows 上 cURL 的详细输出（导致空回复）：
C:\dev\agent\aws-test>curl --tlsv1.2 --cacert root-CA.pem --cert aaaaaaaaa-certificate.pem --key aaaaaaaaa-private.pem -X POST -d "{ \"message\": \"Hello, world\" }" "https://aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com:8443/topics/test/1" --verbose
Note: Unnecessary use of -X or --request, POST is already inferred.
5. Trying 52.208.99.5...
6. TCP_NODELAY set
7. Connected to aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com (52.208.99.5) port 8443 (#0)
8. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 1/3)
9. schannel: checking server certificate revocation
10. schannel: sending initial handshake data: sending 211 bytes...
11. schannel: sent initial handshake data: sent 211 bytes
12. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 2/3)
13. schannel: failed to receive handshake, need more data
14. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 2/3)
15. schannel: encrypted data got 4096
16. schannel: encrypted data buffer: offset 4096 length 4096
17. schannel: received incomplete message, need more data
18. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 2/3)
19. schannel: encrypted data got 1024
20. schannel: encrypted data buffer: offset 5120 length 5120
21. schannel: received incomplete message, need more data
22. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 2/3)
23. schannel: encrypted data got 229
24. schannel: encrypted data buffer: offset 5349 length 6144
25. schannel: sending next handshake data: sending 1414 bytes...
26. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 2/3)
27. schannel: encrypted data got 51
28. schannel: encrypted data buffer: offset 51 length 6144
29. schannel: SSL/TLS handshake complete
30. schannel: SSL/TLS connection with aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com port 8443 (step 3/3)
31. schannel: stored credential handle in session cache
> POST /topics/testmmcdonald/1 HTTP/1.1
> Host: aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com:8443
> User-Agent: curl/7.55.1
> Accept: */*
> Content-Length: 29
> Content-Type: application/x-www-form-urlencoded
>
32. upload completely sent off: 29 out of 29 bytes
33. schannel: client wants to read 102400 bytes
34. schannel: encdata_buffer resized 103424
35. schannel: encrypted data buffer: offset 0 length 103424
36. schannel: encrypted data got 31
37. schannel: encrypted data buffer: offset 31 length 103424
38. schannel: server closed the connection
39. schannel: schannel_recv cleanup
40. Empty reply from server
41. Connection #0 to host aaaaaaaaaaaaaa-ats.iot.eu-west-1.amazonaws.com left intact
curl: (52) Empty reply from server
Linux 桌面上正常运行的 cURL 的详细输出：
curl --tlsv1.2 --cacert root-CA.crt --cert aaaaaaaaa-certificate.pem.crt --key aaaaaaaaa-private.pem.key -X POST -d "{ \"message\": \"Now?\" }" "https://aaaaaaaaa-ats.iot.eu-west-1.amazonaws.com:8443/topics/test/1" --verbose
Note: Unnecessary use of -X or --request, POST is already inferred.
* Trying 52.213.138.243...
* TCP_NODELAY set
* Connected to aaaaaaaaa-ats.iot.eu-west-1.amazonaws.com (52.213.138.243) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: root-CA.crt
CApath: /etc/ssl/certs
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: CN=*.iot.eu-west-1.amazonaws.com
* start date: Jul 2 00:00:00 2019 GMT
* expire date: Jun 28 12:00:00 2020 GMT
* subjectAltName: host "aaaaaaaaa-ats.iot.eu-west-1.amazonaws.com" matched cert's "*.iot.eu-west-1.amazonaws.com"
* issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
* SSL certificate verify ok.
> POST /topics/test/1 HTTP/1.1
> Host: aaaaaaaaa-ats.iot.eu-west-1.amazonaws.com:8443
> User-Agent: curl/7.58.0
> Accept: */*
> Content-Length: 21
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 21 out of 21 bytes
< HTTP/1.1 200 OK
< content-type: application/json
< content-length: 65
< date: Tue, 27 Aug 2019 14:39:59 GMT
< x-amzn-RequestId: 903a3d180147
< connection: keep-alive
<
* Connection #0 to host aaaaaaaaa-ats.iot.eu-west-1.amazonaws.com left intact
{"message":"OK","traceId":"903a3d180147"}
【问题讨论】：