Curl Centos 7上的卷曲获取NSS错误-12188
我曾尝试向运行Curl Centos 7上的卷曲获取NSS错误-12188,curl,openssl,centos7,Curl,Openssl,Centos7,我曾尝试向运行HTTPS的网站发送GET请求，但总是收到curl:（35）同行报告它遇到内部错误。我仅在该网站上收到此错误。当我尝试向Youtube、Google和其他HTTPS网站发送GET请求时，它们与我的curl配合得很好。下面是我的服务器上以curl verbose模式显示的信息 # curl -v https://***.vn > test.htm % Total % Received % Xferd Average Speed Time Time
HTTPSGETcurl:（35）同行报告它遇到内部错误。GET# curl -v https://***.vn > test.htm
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0*
Trying 103.x.x.x:443...
* TCP_NODELAY set
* Connected to ***.vn (103.x.x.x) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: none
CApath: none
* loaded libnssckbi.so
* NSS error -12188 (SSL_ERROR_INTERNAL_ERROR_ALERT)
* Peer reports it experienced an internal error.
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
* Closing connection 0
curl: (35) Peer reports it experienced an internal error.
yum updateViets-MacBook-Pro:~ vietnguyen$ curl -v https://*****.vn > test.htm
* Rebuilt URL to: https://*****.vn/
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 103.xx.xx.xx...
* TCP_NODELAY set
* Connected to *****.vn (103.xx.xx.xx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [217 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [93 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [3177 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: businessCategory=Private Organization; serialNumber=.....; CN=*****.vn
* start date: Dec 11 06:22:40 2018 GMT
* expire date: Dec 11 06:22:40 2020 GMT
* subjectAltName: host "*****.vn" matched cert's "*****.vn"
* issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Extended Validation CA - SHA256 - G3
* SSL certificate verify ok.
> GET / HTTP/1.1
> Host: *****.vn
> User-Agent: curl/7.54.0
> Accept: */*
>
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0< HTTP/1.1 200 OK
< Cache-Control: private
< Content-Type: text/html; charset=utf-8
< Server: Microsoft-IIS/10.0
< X-Powered-By: ASP.NET
< X-XSS-Protection: 1;mode=block
< Date: Thu, 20 Feb 2020 13:41:32 GMT
< Content-Length: 73711
<
{ [7804 bytes data]
100 73711 100 73711 0 0 39172 0 0:00:01 0:00:01 --:--:-- 39166
* Connection #0 to host *****.vn left intact
# curl -V
curl 7.68.0 (x86_64-redhat-linux-gnu) libcurl/7.68.0 NSS/3.44 zlib/1.2.7 libpsl/0.7.0 (+libicu/50.1.2) libssh2/1.9.0 nghttp2/1.31.1
Release-Date: 2020-01-08
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz Metalink NTLM NTLM_WB PSL SPNEGO SSL UnixSockets
# openssl version
OpenSSL 1.1.1d 10 Sep 2019
yum更新nss-nss-util-nss-sysinit-nss-tools# curl -V
curl 7.68.0 (x86_64-redhat-linux-gnu) libcurl/7.68.0 NSS/3.44 zlib/1.2.7 libpsl/0.7.0 (+libicu/50.1.2) libssh2/1.9.0 nghttp2/1.31.1
Release-Date: 2020-01-08
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz Metalink NTLM NTLM_WB PSL SPNEGO SSL UnixSockets
# openssl version
OpenSSL 1.1.1d 10 Sep 2019
s_客户机-servername更奇怪的是，Firefox使用了NSS（尽管我找不到一种方法来判断哪个版本），而我当前的68esr发送了一个带有重新协商扩展（不是SCSV）的TLS1.3 ClientHello并成功。可能是服务器首先检查协议版本，然后以不同的方式处理rfc5746（避免失败），或者根本不进行处理，因为TLS1.3禁止重新协商，使rfc5746完全无效。您的OpenSSL版本无关紧要；CentOS上的curl使用的是NSS而不是OpenSSL。对于NSS，密码套件名称的拼写不同，请参阅的NSS部分；您需要
ecdhe\u rsa\u aes\u 256\u gcm\u sha\u 384