【发布时间】：2020-09-18 06:58:26
【问题描述】：
我们在亚马逊 ec2 上运行 2 个应用程序（backend.abc.com 和 frontend.abc.com）。对于该应用程序，我们使用了付费 SSL 证书。该证书的到期日期为 2021 年 6 月。但是今天，我们遇到了一个错误-
cURL error 60: SSL certificate problem: certificate has expired (see http://curl.haxx.se/libcurl/c/libcurl-errors.html)
我们检查证书到期日期，但没有问题（2021 年 6 月）。然后我们关注这个帖子 - curl: (60) SSL certificate problem: unable to get local issuer certificate（@Dahomz 回答）
之后，当我们通过 - curl -v --url https://backend.abc.com --cacert /etc/ssl/ssl.cert/cacert.pem 卷曲 abc.com 时，它工作正常。回复喜欢 -
* Rebuilt URL to: https://backend.abc.com/
* Trying 127.0.0.1...
* Connected to backend.abc.com (127.0.0.1) port 443 (#0)
* found 139 certificates in /etc/ssl/ssl.cert/cacert.pem
* found 600 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ******_RSA_***_***_GCM_*****
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: *.abc.com (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.abc.xyz
* start date: Mon, 04 May 2019 00:00:00 GMT
* expire date: Wed, 07 June 2021 23:59:59 GMT
* issuer: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo RSA Domain Validation Secure Server CA
* compression: NULL
* ALPN, server accepted to use http/1.1
但是当我们通过 curl 从 frontend.abc.com 到 backend.abc.com 时，它会抛出这个错误 -
* Rebuilt URL to: https://backend.abc.com/
* Trying 127.0.0.1...
* Connected to backend.abc.com (127.0.0.1) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/ssl.cert/cacert.pem
CApath: /etc/ssl/certs
* SSL connection using TLSv1.2 / *****-RSA-*****-GCM-******
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.abc.com
* start date: Mar 4 00:00:00 2019 GMT
* expire date: Apr 7 23:59:59 2021 GMT
* issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
* SSL certificate verify result: certificate has expired (10), continuing anyway.
我的 curl 代码 -
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://backend.abc.com");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_STDERR, fopen(public_path("c.log"), 'w'));
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
$output = curl_exec($ch);
$error = curl_error($ch);
$info = curl_getinfo($ch);
curl_close($ch);
【问题讨论】：
-
检查整个链条而不仅仅是叶子。 Sectigo-was-Comodo，在根存储接受 USERTrust 根之前，也从 AddTrust 链接，并且如果您在“后端”上的 curl 仍在使用已过期的 AddTrust 链。见support.sectigo.com/Com_KnowledgeDetailPage?Id=kA03l00000117LT。
-
你能给我们任何提示如何解决这个问题吗？