使用Caddy调试curl SSL错误14094438

6

Caddy认为一切都很好:

{"level":"info","ts":...,"logger":"tls.issuance.acme.acme_client","msg":"validations succeeded; finalizing order","order":"https://acme-v02.api.letsencrypt.org/acme/order/.../..."}
{"level":"info","ts":...,"logger":"tls.issuance.acme.acme_client","msg":"successfully downloaded available certificate chains","count":2,"first_url":"https://acme-v02.api.letsencrypt.org/acme/cert/..."}
{"level":"info","ts":...,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"service.internal.example.com"}
{"level":"info","ts":...,"logger":"tls.obtain","msg":"releasing lock","identifier":"service.internal.example.com"}

在Caddy容器内部:
# curl https://localhost/ -H "Host: service.internal.example.com" -v
*   Trying 127.0.0.1:443...
* Connected to localhost (127.0.0.1) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, internal error (592):
* error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
* Closing connection 0
curl: (35) error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

Caddyfile:

{
  acme_dns cloudflare ... # github.com/caddy-dns/cloudflare
}

service.internal.example.com {
  reverse_proxy localhost:1234 # curl localhost:1234 works
}

Wget 抛出相同的错误文本,只是错误号略有不同:

# wget https://localhost/ --header "Host: service.internal.example.com" -v
--...--  https://localhost/
Resolving localhost (localhost)... 127.0.0.1, ::1
Connecting to localhost (localhost)|127.0.0.1|:443... connected.
OpenSSL: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
Unable to establish SSL connection.

感谢 @Buffoonism,我已经尝试过:

$ curl https://service.internal.example.com --resolve service.internal.example.com:443:127.0.0.1

这个调用(在Caddy容器内部)返回了成功的200响应。我已经回到了服务器,结果相同:

$ curl https://service.internal.example.com --resolve service.internal.example.com:443:10.1.2.3.4 # works

所以,这似乎是我的线索:使用主机头service.internal.example.com失败,但curl的解析标志有效。

我不确定接下来该尝试什么。

1个回答

4
看起来像是 TLS SNI 的问题。因为你连接的是本地主机,curl 和 wget 会发送一个 TLS SNI,其中包含 localhost,而不是 service.internal.example.com。这意味着服务器会拒绝它。
作为替代方法,可以使用 curl 的 resolve 选项 将地址固定到域名上:
curl https://service.internal.example.com --resolve service.internal.example.com:443:127.0.0.1

这个方法可行并且让我有所进展,我已经更新了我的问题! - knite

网页内容由stack overflow 提供, 点击上面的
可以查看英文原文,
原文链接