堆棧內存溢出
  簡體   English   中英

僅 nginx 和 iOS 11 之間的 SSL 握手失敗 (40)

[英]SSL handshake failure (40) between nginx and iOS 11 only

 原文  2017-10-26 13:50:42  8   1    ios/ ssl/ nginx

問題描述

我有一個運行 NextCloud 的 nginx 1.10.3 服務器並從各種客戶端訪問它。 該證書由 Lets Encrypt 提供並使用 2048 位 RSA 密鑰。

除了在 iPad 或 iPhone 上運行 iOS 11 的客戶端之外，所有客戶端都可以正常工作，包括 Web 瀏覽器。 工作瀏覽器是 MacOS 和 Linux 上的 Firefox 56，以及 MacOS Sierra 上的 Safari 11。 Linux 上的 NextCloud 客戶端也可以正常工作。 在 iOS 上，GoodReader 作為 webdav 客戶端訪問 NextCloud 沒有問題。 但是 Safari 不會訪問它，聲稱它無法訪問到服務器的安全連接。 iOS NextCloud 客戶端在嘗試連接時返回 SSL 錯誤（我認為它使用與 Safari 相同的庫進行連接）。

當 iOS（Safari 或 NextCloud 應用程序）嘗試連接但無法連接時，nginx 日志中的錯誤是：

SSL_do_handshake() failed (SSL: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher) while SSL handshaking

我查看了 Web 服務器上的流量，這是 Firefox 的 Client Hello：

Secure Sockets Layer
SSL Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.0 (0x0301)
    Length: 512
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 508
        Version: TLS 1.2 (0x0303)
        Random
            GMT Unix Time: Aug  8, 2013 06:38:14.000000000 JST
            Random Bytes: eece37d08b453cedc932958165d0b6c530b31a321554c874...
        Session ID Length: 32
        Session ID: c7...
        Cipher Suites Length: 30
        Cipher Suites (15 suites)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
            Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
            Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
        Compression Methods Length: 1
        Compression Methods (1 method)
            Compression Method: null (0)
        Extensions Length: 405
        Extension: server_name
            Type: server_name (0x0000)
            Length: 30
            Server Name Indication extension
                Server Name list length: 28
                Server Name Type: host_name (0)
                Server Name length: 25
                Server Name: mydomain.com
        Extension: Extended Master Secret
            Type: Extended Master Secret (0x0017)
            Length: 0
        Extension: renegotiation_info
            Type: renegotiation_info (0xff01)
            Length: 1
            Renegotiation Info extension
                Renegotiation info extension length: 0
        Extension: elliptic_curves
            Type: elliptic_curves (0x000a)
            Length: 10
            Elliptic Curves Length: 8
            Elliptic curves (4 curves)
                Elliptic curve: ecdh_x25519 (0x001d)
                Elliptic curve: secp256r1 (0x0017)
                Elliptic curve: secp384r1 (0x0018)
                Elliptic curve: secp521r1 (0x0019)
        Extension: ec_point_formats
            Type: ec_point_formats (0x000b)
            Length: 2
            EC point formats Length: 1
            Elliptic curves point formats (1)
                EC point format: uncompressed (0)
        Extension: SessionTicket TLS
            Type: SessionTicket TLS (0x0023)
            Length: 208
            Data (208 bytes)
        Extension: Application Layer Protocol Negotiation
            Type: Application Layer Protocol Negotiation (0x0010)
            Length: 14
            ALPN Extension Length: 12
            ALPN Protocol
                ALPN string length: 2
                ALPN Next Protocol: h2
                ALPN string length: 8
                ALPN Next Protocol: http/1.1
        Extension: status_request
            Type: status_request (0x0005)
            Length: 5
            Certificate Status Type: OCSP (1)
            Responder ID list Length: 0
            Request Extensions Length: 0
        Extension: signature_algorithms
            Type: signature_algorithms (0x000d)
            Length: 24
            Signature Hash Algorithms Length: 22
            Signature Hash Algorithms (11 algorithms)
                Signature Hash Algorithm: 0x0403
                    Signature Hash Algorithm Hash: SHA256 (4)
                    Signature Hash Algorithm Signature: ECDSA (3)
                Signature Hash Algorithm: 0x0503
                    Signature Hash Algorithm Hash: SHA384 (5)
                    Signature Hash Algorithm Signature: ECDSA (3)
                Signature Hash Algorithm: 0x0603
                    Signature Hash Algorithm Hash: SHA512 (6)
                    Signature Hash Algorithm Signature: ECDSA (3)
                Signature Hash Algorithm: 0x0804
                    Signature Hash Algorithm Hash: Unknown (8)
                    Signature Hash Algorithm Signature: Unknown (4)
                Signature Hash Algorithm: 0x0805
                    Signature Hash Algorithm Hash: Unknown (8)
                    Signature Hash Algorithm Signature: Unknown (5)
                Signature Hash Algorithm: 0x0806
                    Signature Hash Algorithm Hash: Unknown (8)
                    Signature Hash Algorithm Signature: Unknown (6)
                Signature Hash Algorithm: 0x0401
                    Signature Hash Algorithm Hash: SHA256 (4)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Hash Algorithm: 0x0501
                    Signature Hash Algorithm Hash: SHA384 (5)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Hash Algorithm: 0x0601
                    Signature Hash Algorithm Hash: SHA512 (6)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Hash Algorithm: 0x0203
                    Signature Hash Algorithm Hash: SHA1 (2)
                    Signature Hash Algorithm Signature: ECDSA (3)
                Signature Hash Algorithm: 0x0201
                    Signature Hash Algorithm Hash: SHA1 (2)
                    Signature Hash Algorithm Signature: RSA (1)
        Extension: Padding
            Type: Padding (0x0015)
            Length: 71
            Padding Data: 000000000000000000000000000000000000000000000000...

最終，為 Firefox 選擇了TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)密碼。

這是通過 Safari 為 iPad 提供的 Client Hello：

Secure Sockets Layer
SSL Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.0 (0x0301)
    Length: 239
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 235
        Version: TLS 1.2 (0x0303)
        Random
            GMT Unix Time: Jul 20, 2002 17:04:33.000000000 JST
            Random Bytes: 8f8602de9622cf56d70fa8d863a3c8d7154eb23ce19b625b...
        Session ID Length: 0
        Cipher Suites Length: 40
        Cipher Suites (20 suites)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
            Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
            Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
            Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
            Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
            Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
            Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
        Compression Methods Length: 1
        Compression Methods (1 method)
            Compression Method: null (0)
        Extensions Length: 154
        Extension: renegotiation_info
            Type: renegotiation_info (0xff01)
            Length: 1
            Renegotiation Info extension
                Renegotiation info extension length: 0
        Extension: server_name
            Type: server_name (0x0000)
            Length: 30
            Server Name Indication extension
                Server Name list length: 28
                Server Name Type: host_name (0)
                Server Name length: 25
                Server Name: mydomain.com
        Extension: Extended Master Secret
            Type: Extended Master Secret (0x0017)
            Length: 0
        Extension: signature_algorithms
            Type: signature_algorithms (0x000d)
            Length: 20
            Signature Hash Algorithms Length: 18
            Signature Hash Algorithms (9 algorithms)
                Signature Hash Algorithm: 0x0403
                    Signature Hash Algorithm Hash: SHA256 (4)
                    Signature Hash Algorithm Signature: ECDSA (3)
                Signature Hash Algorithm: 0x0804
                    Signature Hash Algorithm Hash: Unknown (8)
                    Signature Hash Algorithm Signature: Unknown (4)
                Signature Hash Algorithm: 0x0401
                    Signature Hash Algorithm Hash: SHA256 (4)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Hash Algorithm: 0x0503
                    Signature Hash Algorithm Hash: SHA384 (5)
                    Signature Hash Algorithm Signature: ECDSA (3)
                Signature Hash Algorithm: 0x0805
                    Signature Hash Algorithm Hash: Unknown (8)
                    Signature Hash Algorithm Signature: Unknown (5)
                Signature Hash Algorithm: 0x0501
                    Signature Hash Algorithm Hash: SHA384 (5)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Hash Algorithm: 0x0806
                    Signature Hash Algorithm Hash: Unknown (8)
                    Signature Hash Algorithm Signature: Unknown (6)
                Signature Hash Algorithm: 0x0601
                    Signature Hash Algorithm Hash: SHA512 (6)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Hash Algorithm: 0x0201
                    Signature Hash Algorithm Hash: SHA1 (2)
                    Signature Hash Algorithm Signature: RSA (1)
        Extension: status_request
            Type: status_request (0x0005)
            Length: 5
            Certificate Status Type: OCSP (1)
            Responder ID list Length: 0
            Request Extensions Length: 0
        Extension: next_protocol_negotiation
            Type: next_protocol_negotiation (0x3374)
            Length: 0
        Extension: signed_certificate_timestamp
            Type: signed_certificate_timestamp (0x0012)
            Length: 0
            Data (0 bytes)
        Extension: Application Layer Protocol Negotiation
            Type: Application Layer Protocol Negotiation (0x0010)
            Length: 48
            ALPN Extension Length: 46
            ALPN Protocol
                ALPN string length: 2
                ALPN Next Protocol: h2
                ALPN string length: 5
                ALPN Next Protocol: h2-16
                ALPN string length: 5
                ALPN Next Protocol: h2-15
                ALPN string length: 5
                ALPN Next Protocol: h2-14
                ALPN string length: 8
                ALPN Next Protocol: spdy/3.1
                ALPN string length: 6
                ALPN Next Protocol: spdy/3
                ALPN string length: 8
                ALPN Next Protocol: http/1.1
        Extension: ec_point_formats
            Type: ec_point_formats (0x000b)
            Length: 2
            EC point formats Length: 1
            Elliptic curves point formats (1)
                EC point format: uncompressed (0)
        Extension: elliptic_curves
            Type: elliptic_curves (0x000a)
            Length: 8
            Elliptic Curves Length: 6
            Elliptic curves (3 curves)
                Elliptic curve: ecdh_x25519 (0x001d)
                Elliptic curve: secp256r1 (0x0017)
                Elliptic curve: secp384r1 (0x0018)

在網絡流量中給 iOS 的響應是：

Secure Sockets Layer
TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Handshake Failure)
    Content Type: Alert (21)
    Version: TLS 1.2 (0x0303)
    Length: 2
    Alert Message
        Level: Fatal (2)
        Description: Handshake Failure (40)

不幸的是，我不清楚握手中具體失敗的原因，因為我無法找到任何更詳細的信息。 服務器為 Firefox 選擇的確切密碼被列為 iOS 支持，但 SSL 握手不僅沒有選擇它，而且沒有選擇任何選項。

更奇怪的是，通過 SSL Labs 運行該網站，除了 A+ 評級外，還提供了以下 Safari 握手測試的結果：

Safari 6/iOS 6.0.1    RSA 2048 (SHA256)  TLS 1.2       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     ECDH secp521r1  FS
Safari 7/iOS 7.1      RSA 2048 (SHA256)  TLS 1.2       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     ECDH secp521r1  FS
Safari 7/OS X 10.9    RSA 2048 (SHA256)  TLS 1.2       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     ECDH secp521r1  FS
Safari 8/iOS 8.4      RSA 2048 (SHA256)  TLS 1.2       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     ECDH secp521r1  FS
Safari 8/OS X 10.10   RSA 2048 (SHA256)  TLS 1.2       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     ECDH secp521r1  FS
Safari 9/iOS 9        RSA 2048 (SHA256)  TLS 1.2 > h2  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ECDH secp521r1  FS
Safari 9/OS X 10.11   RSA 2048 (SHA256)  TLS 1.2 > h2  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ECDH secp521r1  FS
Safari 10/iOS 10      RSA 2048 (SHA256)  TLS 1.2 > h2  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ECDH secp521r1  FS
Safari 10/OS X 10.12  RSA 2048 (SHA256)  TLS 1.2 > h2  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  ECDH secp521r1  FS

顯然 SSL Lab 的 Safari 模型對我的服務器很滿意，但 iOS 上的真正 Safari 則不然。

這是 nginx 服務器的 SSL 密碼配置：

ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:
  ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:
  ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:
  ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:
  ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:
  DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:
  DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:
  DHE-RSA-AES256-SHA256";

它是從這里拍攝的。 我還嘗試了來自Mozilla SSL 配置生成器的配置。 “現代”配置文件是這樣的：

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:
  ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:
  ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:
  ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:
  ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

這給出了與握手失敗相同的結果。

讓 nginx 使用ssl_ciphers的默認值ssl_ciphers導致 iOS 連接到服務器。 但是，當我檢查 TCP 轉儲時，我發現它選擇了密碼TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) ，它不提供前向保密當然，當服務器使用默認密碼選擇時，SSL Labs 也會給站點一個 A- 評級，由於某些瀏覽器選擇沒有前向保密的密碼。 但即使在這種情況下，SSL Labs 的 Safari 10/iOS 10 握手測試給出了RSA 2048 (SHA256) TLS 1.2 > h2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDH secp521r1 FS的結果，所以我對 iOS 有不同的RSA 2048 (SHA256) TLS 1.2 > h2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDH secp521r1 FS 。

非常感謝解決這種奇怪情況的任何幫助。

1 個解決方案

解決方案1
 4 已采納  2017-10-27 02:48:49

我已經找到了問題的根源。 服務器被限制為只接受secp521r1用於橢圓曲線（ ssl_ecdh_curve設置）。 我不記得為什么它是這樣設置的； 過去的一些向導告訴我這樣做，我盲目地遵守了。

添加一條強度較低的附加曲線secp384r1 ，允許 iOS 成功握手並使用TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384通信。 ssl_ecdh_curve現在設置為secp521r1:secp384r1 。

我不確定 iOS 10 和 11 之間發生了什么變化導致這種情況。 通過深入研究OpenSSL 代碼和一些進一步研究，我的最佳猜測是 iOS 11 正試圖遵守Suite B 。 Suite B 將曲線限制為 P-256 和 P-384。 但這只是業余愛好者的猜測。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 僅在IOS上SSL握手失敗 iOS推送通知（APN）超過GAE，SSL握手失敗 iOS SSL握手失敗 IOS中的推送通知-握手失敗 iOS 應用 SSL 握手失敗 在iOS應用中唯一標識SSL握手 iOS：SocketRocket-如何實現SSL握手 無聊的SSL握手失敗和復制身份Cred的錯誤 蘋果分發證書導致14094410：SSL例程：SSL3_READ_BYTES：sslv3警報握手失敗 Safari 5 / iOS，WebSocket握手有時僅適用
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM