任何想法为什么这不起作用或我如何解决这个问题？
我发现有一个小问题可能会导致该问题。 CA 证书正在链中发送。 CA 证书是下面显示的第三个证书。
您不应该在链中发送 CA。相反，客户端需要已经拥有它并将其用作信任锚。
另一个潜在问题是位于https://developers.facebook.com 的网络应用不使用AddTrust External CA Root证书作为信任锚。如果 Facebook 缺少信任锚，或者不信任 CA，那么您无能为力。
最后一个潜在问题是 SSL/TLS 拦截代理正在工作。但我怀疑 Facebook 是否会拦截离开其网络的流量。
服务器证书还有一个小问题。服务器证书以通用名称 (CN) 提供 DNS 名称。 IETF 和 CA/Browser 论坛均不赞成将 DNS 置于公用名中。虽然它已被弃用，但它并不被禁止。
DNS 名称应放在主题备用名称 (SAN) 中，并且 genesispetaluma.com 和 www.genesispetaluma.com 都在那里。所以看起来没问题。
$ openssl s_client -connect genesispetaluma.com:443 -CAfile addtrustexternalcaroot.crt | openssl x509 -text -noout
depth=2 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = PositiveSSL CA 2
verify return:1
depth=0 OU = Domain Control Validated, OU = Hosted by A Small Orange LLC, OU = PositiveSSL, CN = genesispetaluma.com
verify return:1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
86:c2:2e:29:7b:68:f7:f3:16:5d:18:27:84:1f:e4:98
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=PositiveSSL CA 2
Validity
Not Before: Mar 3 00:00:00 2014 GMT
Not After : Mar 3 23:59:59 2015 GMT
Subject: OU=Domain Control Validated, OU=Hosted by A Small Orange LLC, OU=PositiveSSL, CN=genesispetaluma.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:e1:16:f6:78:f8:10:29:e8:96:e6:3b:f1:2f:36:
3f:da:2f:cf:b8:f3:ab:cb:3b:8c:a6:09:0a:a6:3a:
f3:e9:ad:7f:d7:30:c4:ac:b3:9b:98:e0:ec:f0:2a:
75:31:e4:0b:92:76:cc:a3:49:b6:bc:35:77:29:ed:
aa:51:20:b5:c1:b0:1f:ed:ee:23:84:29:99:d4:a2:
6c:c5:5e:66:dc:7e:cf:b7:9d:88:c8:75:1a:46:ec:
ce:34:db:da:06:4e:b0:8d:21:ec:2c:db:88:8e:1f:
9b:13:76:ca:30:8c:4b:60:d5:02:f4:91:a9:d6:b3:
3b:c8:46:2d:0d:90:04:c5:39:ca:e7:e2:20:fe:57:
95:bc:40:9b:af:52:9b:fd:95:54:a6:82:f9:d7:ea:
ac:e5:08:1a:53:c2:7b:59:2b:23:a2:12:41:58:4c:
6c:f0:fe:56:77:ed:ae:0f:9a:5d:b5:32:1c:51:3b:
46:56:d2:60:a4:ad:91:56:11:a6:f4:fc:1b:94:22:
84:9f:a2:c0:80:92:01:48:58:9a:d1:01:11:5f:99:
95:05:c8:18:23:dc:72:e4:d8:01:24:f0:c6:26:23:
be:b3:09:ea:22:94:f6:04:c4:9a:67:3c:15:b1:25:
24:49:7d:60:31:5c:60:a5:f9:7b:65:9d:45:91:fd:
a4:f3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:99:E4:40:5F:6B:14:5E:3E:05:D9:DD:D3:63:54:FC:62:B8:F7:00:AC
X509v3 Subject Key Identifier:
3E:E8:E1:02:B6:36:96:64:7F:9A:84:2E:DD:17:F9:D9:C5:88:A7:EF
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.2.7
CPS: http://www.positivessl.com/CPS
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca.com/PositiveSSLCA2.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca.com/PositiveSSLCA2.crt
OCSP - URI:http://ocsp.comodoca.com
X509v3 Subject Alternative Name:
DNS:genesispetaluma.com, DNS:www.genesispetaluma.com
Signature Algorithm: sha1WithRSAEncryption
53:20:9f:af:fd:c4:20:78:ed:56:ed:53:8d:29:38:3b:16:00:
ff:7f:39:fd:75:21:b1:d7:af:27:e5:08:d2:c5:77:5e:52:09:
fd:38:ba:03:a3:8c:4d:e9:8f:6e:a7:12:c4:26:b2:1f:02:96:
f8:24:94:0c:c4:74:2a:2d:2e:b4:d6:4c:ee:5f:2d:e1:b6:91:
a3:eb:d0:9a:46:fa:f5:c1:da:a0:13:11:63:56:64:08:e3:f2:
2c:7a:80:19:1f:a1:4e:ae:9e:ab:1e:27:71:ed:55:da:dc:2b:
b0:52:73:ed:e7:1b:c2:2f:5d:6a:17:90:ee:32:b2:36:ee:9c:
8e:57:5b:70:bd:08:55:1c:a2:f4:ca:ee:f4:0b:0e:d7:1a:e3:
e8:de:14:eb:d0:62:24:9a:8b:7c:c6:ab:65:35:e1:5d:a0:2f:
1f:7a:d2:96:e7:0c:12:cc:d8:e7:ff:1c:58:0c:ce:db:6d:cc:
e8:f7:09:17:57:a8:cc:b7:90:4e:f3:0a:2e:d3:56:ad:44:12:
ce:b1:4c:9b:2a:5c:3f:1e:19:95:41:7a:f9:2c:15:c5:48:c6:
bd:49:ad:f6:95:15:21:69:58:a2:0e:c2:9f:9f:c4:a9:d7:83:
a4:6f:5b:07:c5:28:65:8e:fe:fa:83:5f:5f:10:12:36:c8:c9:
f0:55:7a:a0
我试图在我的子域上抓取一个网站：http://blog.genesispetaluma.com，但通过了
这很奇怪。上面的证书不证明 blog.genesispetaluma.com。这应该验证失败。
如果您想使用 OpenSSL 的 s_client 来验证链，请转到 [Root] AddTrust External CA Root 并下载 AddTrust External CA Root 证书。然后使用CAfile 选项，您应该会收到Verify return code: 0 (ok)：
$ openssl s_client -connect genesispetaluma.com:443 -showcerts \
-CAfile addtrustexternalcaroot.crt
...
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: A171C87253621808B164BAA1399B07D776E28EBCB8A5AB3A81D65DD66505E3AF
Session-ID-ctx:
Master-Key: 559289812A3602C49FEC4C6FEDC714D4D7B107BDB4E9AD5A811DD0606EF5114D
4DD2624EE141508E92092CF23D946185
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - f4 67 cf 21 46 b8 f9 ae-ba ec da f4 2a 24 9f 5b .g.!F.......*$.[
...
00b0 - b8 97 35 30 cf c6 83 a6-14 a6 b7 16 b1 6c 50 b6 ..50.........lP.
Start Time: 1408754636
Timeout : 300 (sec)
Verify return code: 0 (ok)
这是带有 CA 证书的证书链：
$ openssl s_client -connect genesispetaluma.com:443 -showcerts -CAfile addtrustexternalcaroot.crt
CONNECTED(00000003)
depth=2 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = PositiveSSL CA 2
verify return:1
depth=0 OU = Domain Control Validated, OU = Hosted by A Small Orange LLC, OU = PositiveSSL, CN = genesispetaluma.com
verify return:1
---
Certificate chain
0 s:/OU=Domain Control Validated/OU=Hosted by A Small Orange LLC/OU=PositiveSSL/CN=genesispetaluma.com
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
-----BEGIN CERTIFICATE-----
MIIFNTCCBB2gAwIBAgIRAIbCLil7aPfzFl0YJ4Qf5JgwDQYJKoZIhvcNAQEFBQAw
czELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxGTAXBgNV
BAMTEFBvc2l0aXZlU1NMIENBIDIwHhcNMTQwMzAzMDAwMDAwWhcNMTUwMzAzMjM1
OTU5WjB+MSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxJTAjBgNV
BAsTHEhvc3RlZCBieSBBIFNtYWxsIE9yYW5nZSBMTEMxFDASBgNVBAsTC1Bvc2l0
aXZlU1NMMRwwGgYDVQQDExNnZW5lc2lzcGV0YWx1bWEuY29tMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Rb2ePgQKeiW5jvxLzY/2i/PuPOryzuMpgkK
pjrz6a1/1zDErLObmODs8Cp1MeQLknbMo0m2vDV3Ke2qUSC1wbAf7e4jhCmZ1KJs
xV5m3H7Pt52IyHUaRuzONNvaBk6wjSHsLNuIjh+bE3bKMIxLYNUC9JGp1rM7yEYt
DZAExTnK5+Ig/leVvECbr1Kb/ZVUpoL51+qs5QgaU8J7WSsjohJBWExs8P5Wd+2u
D5pdtTIcUTtGVtJgpK2RVhGm9PwblCKEn6LAgJIBSFia0QERX5mVBcgYI9xy5NgB
JPDGJiO+swnqIpT2BMSaZzwVsSUkSX1gMVxgpfl7ZZ1Fkf2k8wIDAQABo4IBtzCC
AbMwHwYDVR0jBBgwFoAUmeRAX2sUXj4F2d3TY1T8Yrj3AKwwHQYDVR0OBBYEFD7o
4QK2NpZkf5qELt0X+dnFiKfvMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAA
MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBQBgNVHSAESTBHMDsGCysG
AQQBsjEBAgIHMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cucG9zaXRpdmVzc2wu
Y29tL0NQUzAIBgZngQwBAgEwOwYDVR0fBDQwMjAwoC6gLIYqaHR0cDovL2NybC5j
b21vZG9jYS5jb20vUG9zaXRpdmVTU0xDQTIuY3JsMGwGCCsGAQUFBwEBBGAwXjA2
BggrBgEFBQcwAoYqaHR0cDovL2NydC5jb21vZG9jYS5jb20vUG9zaXRpdmVTU0xD
QTIuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wNwYD
VR0RBDAwLoITZ2VuZXNpc3BldGFsdW1hLmNvbYIXd3d3LmdlbmVzaXNwZXRhbHVt
YS5jb20wDQYJKoZIhvcNAQEFBQADggEBAFMgn6/9xCB47VbtU40pODsWAP9/Of11
IbHXryflCNLFd15SCf04ugOjjE3pj26nEsQmsh8ClvgklAzEdCotLrTWTO5fLeG2
kaPr0JpG+vXB2qATEWNWZAjj8ix6gBkfoU6unqseJ3HtVdrcK7BSc+3nG8IvXWoX
kO4ysjbunI5XW3C9CFUcovTK7vQLDtca4+jeFOvQYiSai3zGq2U14V2gLx960pbn
DBLM2Of/HFgMztttzOj3CRdXqMy3kE7zCi7TVq1EEs6xTJsqXD8eGZVBevksFcVI
xr1JrfaVFSFpWKIOwp+fxKnXg6RvWwfFKGWO/vqDX18QEjbIyfBVeqA=
-----END CERTIFICATE-----
1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
-----BEGIN CERTIFICATE-----
MIIE5TCCA82gAwIBAgIQB28SRoFFnCjVSNaXxA4AGzANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTEyMDIxNjAwMDAwMFoXDTIwMDUzMDEwNDgzOFow
czELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxGTAXBgNV
BAMTEFBvc2l0aXZlU1NMIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDo6jnjIqaqucQA0OeqZztDB71Pkuu8vgGjQK3g70QotdA6voBUF4V6a4Rs
NjbloyTi/igBkLzX3Q+5K05IdwVpr95XMLHo+xoD9jxbUx6hAUlocnPWMytDqTcy
Ug+uJ1YxMGCtyb1zLDnukNh1sCUhYHsqfwL9goUfdE+SNHNcHQCgsMDqmOK+ARRY
FygiinddUCXNmmym5QzlqyjDsiCJ8AckHpXCLsDl6ez2PRIHSD3SwyNWQezT3zVL
yOf2hgVSEEOajBd8i6q8eODwRTusgFX+KJPhChFo9FJXb/5IC1tdGmpnc5mCtJ5D
YD7HWyoSbhruyzmuwzWdqLxdsC/DAgMBAAGjggF3MIIBczAfBgNVHSMEGDAWgBSt
vZh6NLQm9/rEJlTvA73gJMtUGjAdBgNVHQ4EFgQUmeRAX2sUXj4F2d3TY1T8Yrj3
AKwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwEQYDVR0gBAow
CDAGBgRVHSAAMEQGA1UdHwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0
LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDCBswYIKwYBBQUHAQEEgaYw
gaMwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9BZGRUcnVz
dEV4dGVybmFsQ0FSb290LnA3YzA5BggrBgEFBQcwAoYtaHR0cDovL2NydC51c2Vy
dHJ1c3QuY29tL0FkZFRydXN0VVROU0dDQ0EuY3J0MCUGCCsGAQUFBzABhhlodHRw
Oi8vb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQCcNuNOrvGK
u2yXjI9LZ9Cf2ISqnyFfNaFbxCtjDei8d12nxDf9Sy2e6B1pocCEzNFti/OBy59L
dLBJKjHoN0DrH9mXoxoR1Sanbg+61b4s/bSRZNy+OxlQDXqV8wQTqbtHD4tc0azC
e3chUN1bq+70ptjUSlNrTa24yOfmUlhNQ0zCoiNPDsAgOa/fT0JbHtMJ9BgJWSrZ
6EoYvzL7+i1ki4fKWyvouAt+vhcSxwOCKa9Yr4WEXT0K3yNRw82vEL+AaXeRCk/l
uuGtm87fM04wO+mPZn+C+mv626PAcwDj1hKvTfIPWhRRH224hoFiB85ccsJP81cq
cdnUl4XmGFO3
-----END CERTIFICATE-----
2 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
-----BEGIN CERTIFICATE-----
MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
-----END CERTIFICATE-----
---
Server certificate
subject=/OU=Domain Control Validated/OU=Hosted by A Small Orange LLC/OU=PositiveSSL/CN=genesispetaluma.com
issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
---
No client certificate CA names sent
---
SSL handshake has read 4373 bytes and written 434 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: A171C87253621808B164BAA1399B07D776E28EBCB8A5AB3A81D65DD66505E3AF
Session-ID-ctx:
Master-Key: 559289812A3602C49FEC4C6FEDC714D4D7B107BDB4E9AD5A811DD0606EF5114D4DD2624EE141508E92092CF23D946185
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - f4 67 cf 21 46 b8 f9 ae-ba ec da f4 2a 24 9f 5b .g.!F.......*$.[
0010 - d3 01 c1 21 60 54 8b 1a-8f 5f 5f d5 16 e5 97 11 ...!`T...__.....
0020 - 0f 63 22 5a d3 59 f3 96-a1 3a 35 93 b9 7c 40 9d .c"Z.Y...:5..|@.
0030 - 1d 15 3c 03 04 30 7b 0c-fa fd 69 fc cf ac 32 8c ..<..0{...i...2.
0040 - e2 f2 91 48 37 9b 11 ca-f6 b4 e8 65 5f f2 90 31 ...H7......e_..1
0050 - 8c 2c 7a 74 2e 9a ab de-1f 31 05 b6 a7 6e 42 8b .,zt.....1...nB.
0060 - 6d 36 10 38 38 9f f5 1f-c8 e3 ac ce ba 95 21 4f m6.88.........!O
0070 - 21 3f 38 ef 20 33 f4 b8-86 6a 61 4b e9 cc 00 4d !?8. 3...jaK...M
0080 - ab f3 c6 24 33 3c c5 44-1c 4a f9 71 9b 3c 25 74 ...$3<.D.J.q.<%t
0090 - af 63 73 d7 b3 1b 4f cc-fe 05 76 75 02 db 5b 12 .cs...O...vu..[.
00a0 - 8d 2c 5e 7a 98 ca 95 1c-1a 04 df 6e 22 c3 f2 55 .,^z.......n"..U
00b0 - b8 97 35 30 cf c6 83 a6-14 a6 b7 16 b1 6c 50 b6 ..50.........lP.
Start Time: 1408754636
Timeout : 300 (sec)
Verify return code: 0 (ok)
---