0

我将 RapidSSL/GeoTrust 证书加载到我的 AppEngine 应用程序中。该网站完美地使用 SSL 加载到浏览器中。

但是，当我从命令行（Ubuntu 13.04）验证证书时，它失败了。这是一般的 SSL 失败，所以我所有的 Python 请求也失败了（“urllib3”失败，这会导致“请求”失败）：

$ openssl s_client -connect www.XYZ.com:443 
CONNECTED(00000003)
3073689800:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 225 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

我在另一台运行 NGINX 的服务器上使用它的一个 AS 的证书，并且完全没有问题验证：

$ openssl s_client -connect XYZ.com:443 
CONNECTED(00000003)
depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/serialNumber=gQpQo/GwZhs9/JqYi8P8DsQNFmVC5VQB/OU=GT09052054/OU=See www.rapidssl.com/resources/cps (c)13/OU=Domain Control Validated - RapidSSL(R)/CN=www.XYZ.com
   i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
 1 s:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFRjCCBC6gAwIBAgIDDOW3MA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT
<truncated>
S6YumLnJrUVoCA==
-----END CERTIFICATE-----
subject=/serialNumber=gQpQo/GwZhs9/JqYi8P8DsQNFmVC5VQB/OU=GT09052054/OU=See www.rapidssl.com/resources/cps (c)13/OU=Domain Control Validated - RapidSSL(R)/CN=www.XYZ.com
issuer=/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
---
No client certificate CA names sent
---
SSL handshake has read 3023 bytes and written 375 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: A69E838824AF4F74228A82105A74D708A63CB5FDE042A04072A937A9A25DC1C7
    Session-ID-ctx: 
    Master-Key: 35EACC6FCFA5F901AA355C0379289EE33FEB77334A95EC45A4A9D7CD22E4C944C76F998C2D9AAAF635FD88D02CDB7B08
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 5f 78 c7 0c da f1 7b ee-52 7a 4d 36 c0 28 b0 d7   _x....{.RzM6.(..
    <truncated>
    0090 - 5e fc 2c 37 d4 6f 20 0b-a6 aa 62 f4 df 90 1e 18   ^.,7.o ...b.....

    Start Time: 1374291906
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    ---

该站点尚未完成，因此我无法共享域。

我会很感激任何见解。

达斯汀

4

1 回答 1

1

您使用的是 SNI 还是 VIP？如果您使用的是 SNI，则需要将 -servername 与 openssl 一起使用。

于 2013-07-20T06:12:49.930 回答