云耀斑 SSL 握手上的“SSL 握手中的对等关闭连接”失败

Question

最近，我在 Cloudflare 网站上收到“SSL 握手失败”错误。 当我查看我的 nginx 日志时，我发现了以下错误：

2021/05/23 02:35:52 [info] 10528#0: *124920510 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.147, server: 0.0.0.0:443
2021/05/23 02:42:57 [info] 10528#0: *124925310 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.147, server: 0.0.0.0:443
2021/05/23 02:50:19 [info] 11633#0: *124929231 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.165, server: 0.0.0.0:443
2021/05/23 02:50:27 [info] 11632#0: *124929281 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.165, server: 0.0.0.0:443
2021/05/23 02:54:18 [info] 11633#0: *124930616 peer closed connection in SSL handshake (104: Connection reset by peer) while SSL handshaking, client: 172.68.155.161, server: 0.0.0.0:443

每次发生 SSL 握手错误时，都会在日志中添加“对等关闭 SSL 握手中的连接”行。

你能告诉我如何解决这个问题吗？

Nginx 配置

server {
listen 443 ssl http2;
listen [::]:443 ssl http2; 

server_name mydomain.in;
set $base /home/username/websites/mydomain.in;
root $base/;

# SSL
 
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_certificate /etc/letsencrypt/live/mydomain.in/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.in/privkey.pem;

# logging
access_log /home/username/nginx/logs/mydomain.in.access.log;
error_log /home/username/nginx/logs/mydomain.in.error.log debug;

# index.php
index index.php;

# index.php fallback
location / {
    try_files $uri $uri/ /index.php?$query_string;
}

# handle .php
location ~ \.php$ {
    include nginxconfig.io/php7.4_fastcgi.conf;
}

#include nginxconfig.io/general.conf;

# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline' worker-src blob:" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires 7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires 7d;
    access_log off;
}

# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

}

服务器 Ubuntu 18.04 Nginx 1.16

Answer 1

仅根据提供的有关这些特定客户端为何放弃 TLS 握手的信息，无法提取任何信息。可能是一些测试，也可能是其他东西。

如果这些是正常的浏览器，一个常见的原因是服务器提供的证书无法被客户端验证。例如，这可能发生在自签名证书、非公共 CA 颁发的证书、缺少中间证书、主机名不匹配...

鉴于这些 IP 似乎属于 Cloudflare，它可能仍然是证书设置混乱——不过，仅提供文件名而不提供实际内容将无济于事。

但同样，仅基于提供的日志条目和配置，只能进行有根据的猜测和推测。