[英]Cloudflare SSL Handshake Failed (Error 525)
我的网站(和主机)有问题。 我正在为我的网站使用完整(严格)加密设置。 而且我不知道为什么它会遇到错误,因为上个月网络运行正常。
这是调试
使用curl -sv -o命令:
curl -sv -o /dev/null https://<domain>.com/ --resolve <domain>.com:<<port>>:<<ip>>
* Added <domain>.com:<<port>>:<<ip>> to DNS cache
* Hostname <domain>.com was found in DNS cache
* Trying <<vps_ip>>...
* TCP_NODELAY set
* Connected to <domain>.com (<<vps_ip>>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /usr/local/etc/openssl/cert.pem
CApath: /usr/local/etc/openssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* stopped the pause stream!
* Closing connection 0
使用openssl s_client命令:
openssl s_client -connect <<vps_ip>>:443 | openssl x509 -text -noout
52457:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/ssl/s23_clnt.c:618: unable to load certificate
52458:error:0906D06C:PEM routines:PEM_read_bio:no start line:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE
这是VHost配置:
Listen 80
<VirtualHost *:80>
ServerName <domain>
ServerAlias <alias>
ServerAdmin -alreadyset-
DocumentRoot -alreadyset-
SSLEngine off
SSLCertificateFile -alreadyset-/mikata.pem
SSLCertificateKeyFile -alreadyset-/mikata.key
<Directory />
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
<Directory /home/emtetour/public_html>
Options Indexes FollowSymLinks Multiviews
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
ErrorLog -alreadyset-
CustomLog -alreadyset-
</VirtualHost>
Listen 443
<VirtualHost *:443>
ServerName <domain>
ServerAlias <alias>
ServerAdmin -alreadyset-
DocumentRoot -alreadyset-
SSLEngine on
SSLCertificateFile -alreadyset-/mikata.pem
SSLCertificateKeyFile -alreadyset-/mikata.key
<Directory />
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
<Directory /<directory>/public_html>
Options Indexes FollowSymLinks Multiviews
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
</VirtualHost>
有人可以帮助我吗? 已经四天了,我不知道该怎么解决...谢谢..
PS服务器正在使用UbuntuOS运行Apache2.4.25。 密码和协议与cloudflare SSL兼容。
找到了解决方案
这可能是一个很晚的编辑,但是显然Apache需要443端口的默认VirtualHost设置。
因此,您必须添加诸如111-default.conf之类的内容,然后仅编写服务器admin,文档根目录和SSL配置(因为我的是通配证书,所以我使用了与网站相同的配置)。
希望这对遇到类似问题的其他人有所帮助。
根据您提供的错误消息,看来您的证书不正确:
Expecting: TRUSTED CERTIFICATE
我放
<VirtualHost *:443></VirtualHost>
在000-defaults.conf中,仅定义了DocumentRoot并得到了相同的错误。 因此,将其删除后,一切都很好。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.