Question

我创建了我的SSL证书，如下所示：

openssl ecparam -name secp521r1 -genkey -param_enc explicit -out domain.com.key
openssl req -new -sha256 -key domain.com.key -out domain.com.csr -config domain-csr.conf

我收到了domain.com.csr文件，我的SSL提供商向我发送了包和crt文件。

但是当我查看该网站时，我得到了ERR_SSL_VERSION_OR_CIPHER_MISMATCH

我的nginx.conf是：

server {
    server_name {{ $host }};
    listen 443 ssl http2 {{ $default_server }};
    access_log /var/log/nginx/access.log vhost;

    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;

这是日志：

ccc@zapotec ~/nginx-proxy $ docker logs nginx-proxy-server
WARNING: /etc/nginx/dhparam/dhparam.pem was not found. A pre-generated dhparam.pem will be used for now while a new one
is being generated in the background.  Once the new dhparam.pem is in place, nginx will be reloaded.
forego     | starting dockergen.1 on port 5000
forego     | starting nginx.1 on port 5100
dockergen.1 | 2017/10/13 11:50:18 Generated '/etc/nginx/conf.d/default.conf' from 14 containers
dockergen.1 | 2017/10/13 11:50:18 Running 'nginx -s reload'
dockergen.1 | 2017/10/13 11:50:18 Watching docker events
nginx.1    | 2017/10/13 11:50:18 [crit] 37#37: *20 SSL_do_handshake() failed (SSL: error:1417D102:SSL routines:tls_process_client_hello:unsupported protocol) while SSL handshaking, client: 195.39.86.27, server: 0.0.0.0:443
nginx.1    | 2017/10/13 11:50:18 [crit] 37#37: *21 SSL_do_handshake() failed (SSL: error:1417D102:SSL routines:tls_process_client_hello:unsupported protocol) while SSL handshaking, client: 195.39.86.27, server: 0.0.0.0:443

我错过了什么？

任何建议都非常感谢。

Answer 1

将您的ssl_ciphers更改为以下内容：

ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;

https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility

ERR_SSL_VERSION_OR_CIPHER_MISMATCH - nginx

1 个答案: