握手失败：SSL 警报编号 40

Question

我正在尝试爬取一个页面，但一直没有成功：

>> scrapy shell "XXXXXX"
...
2018-12-28 17:23:32 [scrapy.downloadermiddlewares.retry] DEBUG: Retrying <GET XXXXXXXX> (failed 1 times): [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]>]
2018-12-28 17:23:32 [scrapy.downloadermiddlewares.retry] DEBUG: Retrying <GET XXXXXXXXXXXXX> (failed 2 times): [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]>]
2018-12-28 17:23:33 [scrapy.downloadermiddlewares.retry] DEBUG: Gave up retrying <GET XXXXXXXXXXXXXXXXX> (failed 3 times): [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]>]
Traceback (most recent call last):
  File "/home/joaquin/Repos/extruct/env/bin/scrapy", line 11, in <module>
    sys.exit(execute())
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/scrapy/cmdline.py", line 150, in execute
    _run_print_help(parser, _run_command, cmd, args, opts)
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/scrapy/cmdline.py", line 90, in _run_print_help
    func(*a, **kw)
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/scrapy/cmdline.py", line 157, in _run_command
    cmd.run(args, opts)
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/scrapy/commands/shell.py", line 73, in run
    shell.start(url=url, redirect=not opts.no_redirect)
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/scrapy/shell.py", line 48, in start
    self.fetch(url, spider, redirect=redirect)
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/scrapy/shell.py", line 115, in fetch
    reactor, self._schedule, request, spider)
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/twisted/internet/threads.py", line 122, in blockingCallFromThread
    result.raiseException()
  File "/home/joaquin/Repos/extruct/env/lib/python3.7/site-packages/twisted/python/failure.py", line 467, in raiseException
    raise self.value.with_traceback(self.tb)
twisted.web._newclient.ResponseNeverReceived: [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_read_bytes', 'sslv3 alert handshake failure')]>]

尝试使用SSL连接时，我遇到了以下问题：

>> openssl s_client XXXXX.XXXX.XXXX:443
CONNECTED(00000003)
140087350686208:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1528:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 323 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
--- 

同样，当我使用curl访问此页面时，情况也是一样的：

curl -i XXXX.XXXX.XXXX
curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

我尝试在openssl中指定-servername，但它没有解决问题。同时尝试指定-tls1_2也不起作用。TLS信息:

更新

>> openssl version
OpenSSL 1.1.1a  20 Nov 2018

- Joaquin

---

如今，RSA/3DES_EDE_CBC/HMAC-SHA1已经过时了。虽然您的浏览器可能足够宽容以接受它们，但您的openssl版本似乎不支持。您至少需要告知您的openssl版本，如果您执行openssl ciphers命令，您将会看到是否拥有3DES-EDE-CBC。或者，您可以尝试在线扫描工具，例如https://www.ssllabs.com/ssltest/。 - Patrick Mevzek

我更新了我的问题，它是OpenSSL 1.1.1a。 - Joaquin

自 OpenSSL 1.1.0 起，默认情况下不再包括或启用“弱”密码套件，即 3DES 和 RC4。如果您的构建是使用“enable-weak-ssl-ciphers”完成的，则s_client ... -cipher DES-CBC3-SHA应该可以工作。在支持时，对于大多数 3DES 套件，OpenSSL 使用带有右侧的 3 的“交换”名称：DES-CBC3-SHA ECDHE-RSA-DES-CBC3-SHA 等。 - dave_thompson_085

@dave_thompson_085 顺便说一句，我的 openssl ciphers 命令仍然显示一些以 3 为前缀的名称，比如 PSK-3DES-EDE-CBC-SHA。 - Patrick Mevzek

@PatrickMevzek：这就是为什么我使用了“大多数”。 - dave_thompson_085

Answer 1

在搜索与您的问题完全相同的问题时找到了您的问题（curl成功连接，而openssl失败，并显示alert number 40）。

这可能与具有多个虚拟主机以提供服务的服务器有关，您需要告诉它要连接哪个主机，以使TLS握手成功。

请使用-servername参数指定您想要连接的确切主机名。例如：

openssl s_client -connect yourserver.domain.com:443 -servername yourserver.domain.com   

- Seki