机械化的 SSL 错误答案

【问题标题】：SSL errors with Mechanize机械化的 SSL 错误
【发布时间】：2015-04-13 16:36:15
【问题描述】：

我在irb 上收到了这些命令

require 'mechanize'
agent = Mechanize.new
agent.get('https://monabo.lemonde.fr/customer/account/forgotpassword/')

我收到了这个错误：

OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=unknown state: sslv3 alert handshake failure

我在mac上试过了，没有这个错误。但是，它在我的计算机上不起作用（运行 Linux Mint 17）。

我尝试了什么：

导出这个变量：

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

设置这个变量：

agent.agent.http.ca_file = '/etc/ssl/certs/ca-certificates.crt'

设置：

OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

更改 ruby 版本（我目前使用的是 ruby 2.1.5p275）

这些解决方案都没有改变问题。我怀疑服务器需要特定版本的 OpenSSL。

请注意，我可以用mechanize 请求https://google.com，并且它可以工作，但不能https://monabo.lemonde.fr/customer/account/forgotpassword/。它在 mac 上工作的事实可能假设我得到了错误的配置。

编辑：这是此命令的输出：

➜  swiff git:(master) ✗  openssl s_client -connect  monabo.lemonde.fr/customer/account/forgotpassword:443 -tls1 -servername monabo.lemonde.fr/customer/account/forgotpassword | openssl x509 -text -noout 
gethostbyname failure
connect:errno=0
unable to load certificate
140045809014432:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE

其他一些数据：

【问题讨论】：

OpenSSL::SSL::VERIFY_NONE - 坏主意。它可能由于 SSLv3 支持不匹配而失败（应在任何地方禁用 SSLv3）。请发布您用于连接服务器的确切 URL，并发布 openssl s_client -connect <hostname>:<port> -tls1 -servername <hostname> | openssl x509 -text -noout 的输出。通过单击编辑将其添加到您的问题中（不要将其作为评论发布）。否则，没有足够的信息来帮助解决问题。
如果这是一台 Windows 机器，我会推荐 certified gem。它完美地处理了这个问题。
该服务器仅支持被拒绝的 SSL v3。那是一个配置错误的服务器，需要先修复它才能正常工作。大多数客户端会自动忽略 SSL 作为有效方法并坚持使用 TLS 1.1 或更高版本。你可以test your configuration看看有什么问题。
@jww 谢谢，已更新。
@tadman => 我无权访问该远程服务器。我，作为客户端，希望我的应用程序访问该服务器，即使有任何错误。在这之间，我的代码可以在另一台机器上运行，但不能在我的机器上运行，所以这绝对是一个配置问题。该 url 只是一个示例，我的应用程序可能会访问遇到相同问题的任何其他 url，这就是为什么即使远程服务器配置错误，我也需要访问它。

标签： ruby ssl openssl mechanize

【解决方案1】：

服务器仅支持 SSLv3 和 TLSv1，并且仅支持密码 DES-CBC3-SHA。此密码不包含在您的 ruby 版本使用的默认密码集中，您可以在 https://github.com/ruby/ruby/blob/ruby_2_1/ext/openssl/lib/openssl/ssl.rb 中看到。这个设置很奇怪，因为据我所知，DES-CBC3-SHA（即 DES3）被认为比密码集中的 RC4-SHA 更安全。

我试图找到一种方法来设置机械化对象的密码，但我对编写 ruby 知之甚少，而且系统上只有旧版本的 ruby。您可以尝试agent.agent.http.ciphers = [ 'des-cbc3-sha' ] 之类的方法或咨询一些 ruby 专家。

【讨论】：

感谢您的回答。我也没有找到如何改变它。我现在使用较旧的 ruby 版本并且它可以工作（我认为以前没有）。我会暂时这样做。我会让这个问题打开，直到有人找到答案，或者如果没有办法设置它，我会接受你的:)

【解决方案2】：

openssl s_client -connect monabo.lemonde.fr/customer/account/forgotpassword:443 -tls1 -servername monabo.lemonde.fr/customer/account/forgotpassword | openssl x509 -text -noout

从外部世界，我能够连接。我可以通过使用带有 OpenSSL 命令的-CApath 来解决“无法获取本地颁发者证书” 错误（练习留给读者，因为它不是问题）。

这可能会帮助您解决问题....

获取证书转储

$ openssl s_client -connect  monabo.lemonde.fr:443 -tls1 -servername monabo.lemonde.fr | openssl x509 -text -noout
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - G2
verify error:num=20:unable to get local issuer certificate
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:21:56:eb:c5:b1:54:fb:88:02:47:ec:cd:51:d9:38:89:d2
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Domain Validation CA - G2
        Validity
            Not Before: Dec 18 17:19:34 2013 GMT
            Not After : Jan 19 18:10:24 2017 GMT
        Subject: OU=Domain Control Validated, CN=*.lemonde.fr
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d3:59:62:60:4e:18:52:3d:f5:f9:e2:54:5a:dd:
                    54:09:05:27:ae:f9:42:20:d6:ff:0a:5f:97:64:33:
                    64:5c:9a:80:67:de:6a:be:f9:6a:cb:1c:14:14:df:
                    90:cb:77:9a:d9:22:15:45:eb:ac:9a:c3:36:1f:52:
                    ee:22:b5:9f:67:22:35:52:64:e0:4e:44:f8:ab:01:
                    3a:e8:f6:57:81:27:3b:28:3c:b1:da:e2:59:12:63:
                    99:89:e2:ed:bf:42:09:4c:39:f3:d7:2e:4a:5d:d1:
                    d7:4c:d1:cd:2c:98:f9:da:da:a0:10:85:17:92:05:
                    62:c1:89:f0:ff:5a:cd:f7:72:a8:e0:3d:f2:ad:c7:
                    44:64:88:72:40:84:53:fc:80:f9:5f:44:7b:bf:ce:
                    3c:93:87:05:af:d6:95:00:44:63:be:55:ac:25:8e:
                    25:3c:1c:2c:99:2d:d0:d0:72:da:f1:5f:a0:9b:4e:
                    56:20:10:4e:db:a7:cd:32:c8:32:48:cd:f9:bf:45:
                    8c:ca:b3:68:88:6d:61:fa:4c:80:87:0b:d6:f8:e6:
                    d9:73:5d:27:b7:bf:0f:35:81:89:93:ee:fa:84:15:
                    de:d4:99:45:d6:7a:fe:19:dc:71:56:29:00:6d:fb:
                    1b:1f:48:16:17:12:fe:0b:05:76:37:b7:f0:11:7a:
                    32:fb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                  CPS: https://www.globalsign.com/repository/

            X509v3 Subject Alternative Name: 
                DNS:*.lemonde.fr, DNS:lemonde.fr
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.globalsign.com/gs/gsdomainvalg2.crl

            Authority Information Access: 
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsdomainvalg2.crt
                OCSP - URI:http://ocsp2.globalsign.com/gsdomainvalg2

            X509v3 Subject Key Identifier: 
                49:7C:AB:DD:45:95:AB:8C:15:8E:9A:E2:0E:FE:79:39:FF:5C:A6:3C
            X509v3 Authority Key Identifier: 
                keyid:96:AD:FA:B0:5B:B9:83:64:2A:76:C2:1C:8A:69:DA:42:DC:FE:FD:28

    Signature Algorithm: sha1WithRSAEncryption
         33:65:d5:4d:39:4d:c9:86:52:bf:0f:d0:85:28:50:36:21:ac:
         1d:f4:b4:69:22:48:5b:6b:99:64:19:51:71:0e:fc:c9:ca:5e:
         05:e2:fc:ff:b8:e1:50:b8:4d:1c:82:a6:06:3e:3b:85:d2:ab:
         fe:1e:18:02:d3:c1:e6:54:f4:26:ce:20:af:a3:52:90:5c:a8:
         bb:ad:a0:a9:29:30:50:bd:64:f3:1e:26:76:d7:5d:05:2e:9e:
         57:f2:3a:2a:fe:49:30:74:76:9f:b2:95:07:47:de:9e:8f:74:
         5d:97:62:45:2b:16:d3:ae:80:66:22:b7:3a:b4:34:f0:33:e2:
         40:bf:3d:39:3d:64:3f:94:b4:d7:a9:c6:e3:ca:76:76:86:67:
         58:82:e9:95:4a:c4:70:93:6f:bc:34:5e:a6:6d:93:05:ae:41:
         ae:8a:ac:ef:c2:65:6c:8f:af:46:31:c1:98:ca:11:6c:56:87:
         98:44:9d:8b:8a:29:03:a3:cf:c7:6c:d5:3c:29:9f:ba:ff:db:
         2f:38:a6:be:29:3d:be:ec:01:dc:1f:6c:55:1d:7d:74:7e:f4:
         74:18:5a:f3:ca:64:2b:1e:d7:82:36:2c:ee:08:a5:35:c2:54:
         0b:b5:cc:8b:28:03:6e:1e:ad:b6:05:c3:01:67:34:59:db:8b:
         d4:20:b8:cb

执行 HTML GET（注意 -ign_eof）：

riemann::cryptopp$ echo -e "GET /customer/account/forgotpassword HTTP/1.1\r\nHost:monabo.lemonde.fr\r\n\r\n" | openssl s_client -connect  monabo.lemonde.fr:443 -tls1 -ign_eof -servername monabo.lemonde.fr 
CONNECTED(00000003)
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - G2
verify error:num=20:unable to get local issuer certificate
---
Certificate chain
 0 s:/OU=Domain Control Validated/CN=*.lemonde.fr
   i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - G2
 1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - G2
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIE2TCCA8GgAwIBAgISESFW68WxVPuIAkfszVHZOInSMA0GCSqGSIb3DQEBBQUA
MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMS0wKwYD
VQQDEyRHbG9iYWxTaWduIERvbWFpbiBWYWxpZGF0aW9uIENBIC0gRzIwHhcNMTMx
MjE4MTcxOTM0WhcNMTcwMTE5MTgxMDI0WjA6MSEwHwYDVQQLExhEb21haW4gQ29u
dHJvbCBWYWxpZGF0ZWQxFTATBgNVBAMMDCoubGVtb25kZS5mcjCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBANNZYmBOGFI99fniVFrdVAkFJ675QiDW/wpf
l2QzZFyagGfear75asscFBTfkMt3mtkiFUXrrJrDNh9S7iK1n2ciNVJk4E5E+KsB
Ouj2V4EnOyg8sdriWRJjmYni7b9CCUw589cuSl3R10zRzSyY+draoBCFF5IFYsGJ
8P9azfdyqOA98q3HRGSIckCEU/yA+V9Ee7/OPJOHBa/WlQBEY75VrCWOJTwcLJkt
0NBy2vFfoJtOViAQTtunzTLIMkjN+b9FjMqzaIhtYfpMgIcL1vjm2XNdJ7e/DzWB
iZPu+oQV3tSZRdZ6/hnccVYpAG37Gx9IFhcS/gsFdje38BF6MvsCAwEAAaOCAbow
ggG2MA4GA1UdDwEB/wQEAwIFoDBJBgNVHSAEQjBAMD4GBmeBDAECATA0MDIGCCsG
AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAj
BgNVHREEHDAaggwqLmxlbW9uZGUuZnKCCmxlbW9uZGUuZnIwCQYDVR0TBAIwADAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPwYDVR0fBDgwNjA0oDKgMIYu
aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9nc2RvbWFpbnZhbGcyLmNybDCB
iAYIKwYBBQUHAQEEfDB6MEEGCCsGAQUFBzAChjVodHRwOi8vc2VjdXJlLmdsb2Jh
bHNpZ24uY29tL2NhY2VydC9nc2RvbWFpbnZhbGcyLmNydDA1BggrBgEFBQcwAYYp
aHR0cDovL29jc3AyLmdsb2JhbHNpZ24uY29tL2dzZG9tYWludmFsZzIwHQYDVR0O
BBYEFEl8q91FlauMFY6a4g7+eTn/XKY8MB8GA1UdIwQYMBaAFJat+rBbuYNkKnbC
HIpp2kLc/v0oMA0GCSqGSIb3DQEBBQUAA4IBAQAzZdVNOU3JhlK/D9CFKFA2Iawd
9LRpIkhba5lkGVFxDvzJyl4F4vz/uOFQuE0cgqYGPjuF0qv+HhgC08HmVPQmziCv
o1KQXKi7raCpKTBQvWTzHiZ2110FLp5X8joq/kkwdHafspUHR96ej3Rdl2JFKxbT
roBmIrc6tDTwM+JAvz05PWQ/lLTXqcbjynZ2hmdYgumVSsRwk2+8NF6mbZMFrkGu
iqzvwmVsj69GMcGYyhFsVoeYRJ2LiikDo8/HbNU8KZ+6/9svOKa+KT2+7AHcH2xV
HX10fvR0GFrzymQrHteCNizuCKU1wlQLtcyLKANuHq22BcMBZzRZ24vUILjL
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/CN=*.lemonde.fr
issuer=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - G2
---
No client certificate CA names sent
---
SSL handshake has read 2528 bytes and written 584 bytes
---
New, TLSv1/SSLv3, Cipher is DES-CBC3-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DES-CBC3-SHA
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 5CB47D92BE13BC28113D333A7B3BEECBF90B78EB4751BC1285F4EB1EA129914D8E61629E1EE84E9B6177ADC1E2CA9AE9
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1428944574
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
HTTP/1.0 200 OK
Set-Cookie: ARVATO=R212127208; path=/
Set-Cookie: ARVATO=R1228432574; path=/
Date: Mon, 13 Apr 2015 16:56:33 GMT
Server: Apache
Set-Cookie: frontend=8b5a9c59bc8c3e36259d9bb9c5d786b6; expires=Thu, 03-Mar-2332 10:43:14 GMT; path=/; domain=monabo.lemonde.fr; HttpOnly
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, public
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from cache-02
X-Cache-Lookup: MISS from cache-02:80
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head>
<title>Magento Commerce</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="description" content="Default Description" />
<meta name="keywords" content="Magento, Varien, E-commerce" />
<meta name="robots" content="INDEX,FOLLOW" />
...
</body>
</html>
closed

尝试强制 SSLv3 失败（注意使用-ssl3，缺少-servername）：

$ openssl s_client -connect  monabo.lemonde.fr:443 -ssl3 | openssl x509 -text -noout
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - G2
verify error:num=20:unable to get local issuer certificate
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:21:56:eb:c5:b1:54:fb:88:02:47:ec:cd:51:d9:38:89:d2
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Domain Validation CA - G2
        Validity
            Not Before: Dec 18 17:19:34 2013 GMT
            Not After : Jan 19 18:10:24 2017 GMT
        Subject: OU=Domain Control Validated, CN=*.lemonde.fr
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d3:59:62:60:4e:18:52:3d:f5:f9:e2:54:5a:dd:
                    54:09:05:27:ae:f9:42:20:d6:ff:0a:5f:97:64:33:
                    64:5c:9a:80:67:de:6a:be:f9:6a:cb:1c:14:14:df:
                    90:cb:77:9a:d9:22:15:45:eb:ac:9a:c3:36:1f:52:
                    ee:22:b5:9f:67:22:35:52:64:e0:4e:44:f8:ab:01:
                    3a:e8:f6:57:81:27:3b:28:3c:b1:da:e2:59:12:63:
                    99:89:e2:ed:bf:42:09:4c:39:f3:d7:2e:4a:5d:d1:
                    d7:4c:d1:cd:2c:98:f9:da:da:a0:10:85:17:92:05:
                    62:c1:89:f0:ff:5a:cd:f7:72:a8:e0:3d:f2:ad:c7:
                    44:64:88:72:40:84:53:fc:80:f9:5f:44:7b:bf:ce:
                    3c:93:87:05:af:d6:95:00:44:63:be:55:ac:25:8e:
                    25:3c:1c:2c:99:2d:d0:d0:72:da:f1:5f:a0:9b:4e:
                    56:20:10:4e:db:a7:cd:32:c8:32:48:cd:f9:bf:45:
                    8c:ca:b3:68:88:6d:61:fa:4c:80:87:0b:d6:f8:e6:
                    d9:73:5d:27:b7:bf:0f:35:81:89:93:ee:fa:84:15:
                    de:d4:99:45:d6:7a:fe:19:dc:71:56:29:00:6d:fb:
                    1b:1f:48:16:17:12:fe:0b:05:76:37:b7:f0:11:7a:
                    32:fb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                  CPS: https://www.globalsign.com/repository/

            X509v3 Subject Alternative Name: 
                DNS:*.lemonde.fr, DNS:lemonde.fr
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.globalsign.com/gs/gsdomainvalg2.crl

            Authority Information Access: 
                CA Issuers - URI:http://secure.globalsign.com/cacert/gsdomainvalg2.crt
                OCSP - URI:http://ocsp2.globalsign.com/gsdomainvalg2

            X509v3 Subject Key Identifier: 
                49:7C:AB:DD:45:95:AB:8C:15:8E:9A:E2:0E:FE:79:39:FF:5C:A6:3C
            X509v3 Authority Key Identifier: 
                keyid:96:AD:FA:B0:5B:B9:83:64:2A:76:C2:1C:8A:69:DA:42:DC:FE:FD:28

    Signature Algorithm: sha1WithRSAEncryption
         33:65:d5:4d:39:4d:c9:86:52:bf:0f:d0:85:28:50:36:21:ac:
         1d:f4:b4:69:22:48:5b:6b:99:64:19:51:71:0e:fc:c9:ca:5e:
         05:e2:fc:ff:b8:e1:50:b8:4d:1c:82:a6:06:3e:3b:85:d2:ab:
         fe:1e:18:02:d3:c1:e6:54:f4:26:ce:20:af:a3:52:90:5c:a8:
         bb:ad:a0:a9:29:30:50:bd:64:f3:1e:26:76:d7:5d:05:2e:9e:
         57:f2:3a:2a:fe:49:30:74:76:9f:b2:95:07:47:de:9e:8f:74:
         5d:97:62:45:2b:16:d3:ae:80:66:22:b7:3a:b4:34:f0:33:e2:
         40:bf:3d:39:3d:64:3f:94:b4:d7:a9:c6:e3:ca:76:76:86:67:
         58:82:e9:95:4a:c4:70:93:6f:bc:34:5e:a6:6d:93:05:ae:41:
         ae:8a:ac:ef:c2:65:6c:8f:af:46:31:c1:98:ca:11:6c:56:87:
         98:44:9d:8b:8a:29:03:a3:cf:c7:6c:d5:3c:29:9f:ba:ff:db:
         2f:38:a6:be:29:3d:be:ec:01:dc:1f:6c:55:1d:7d:74:7e:f4:
         74:18:5a:f3:ca:64:2b:1e:d7:82:36:2c:ee:08:a5:35:c2:54:
         0b:b5:cc:8b:28:03:6e:1e:ad:b6:05:c3:01:67:34:59:db:8b:
         d4:20:b8:cb

【讨论】：

感谢您的回答。我把日志放在问题中。但这并不能帮助我理解。我仍在进行故障排除。
根据我的日志，我可以访问该资源。但不使用我自己的应用程序（使用 ruby）。我想我的应用正在使用一个不兼容的 open-ssl 库。

【解决方案3】：

安装certified gem 为我解决了这个问题，在 Windows 7 上使用以下版本的 ruby/rubygems。

> ruby -v
ruby 2.2.3p173 (2015-08-18 revision 51636) [i386-mingw32]
> gem -v
2.6.6

【讨论】：

【解决方案4】：

对于 Ruby

您可以将您的密码添加到默认密码列表中：

OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers] += ':DES-CBC3-SHA'

然后：

require 'mechanize'
agent = Mechanize.new
agent.get 'https://monabo.lemonde.fr/customer/account/forgotpassword/'

【讨论】：

【解决方案5】：

我对 ruby 一无所知，但问题看起来是证书链验证问题。

即openssl 错误“验证错误：num=20：无法获取本地颁发者证书”

是你失败的原因。

失败的原因是无法加载完整的链。即缺少一个或多个证书。

第一点是服务器给的证书链缺少中间件。这确实是一个网络服务器设置问题，因为他们在网络服务器设置中缺少intermediate 证书。

您可以通过在本地 CA 文件中提供此中间体来解决此问题。这很可能是它在您的另一台机器上工作的原因，因为该机器的 CA 文件在您的 CA 文件中包含 intermediate 和 root 证书。

我会检查您的 CA 文件 (/etc/ssl/certs/ca-certificates.crt) 中是否有这两个证书，如果没有，请添加它们。一旦 openssl 命令在没有“验证错误：num = 20：无法获取本地颁发者证书”错误的情况下工作，那么这将排除您的粗鲁代码问题（假设您的粗鲁代码使用相同的 ca 文件）。

如果您可以更新 Web 服务器以使用包含服务器证书和 intermediate 证书的证书链文件，那也应该可以解决该问题。

【讨论】：