加入收藏 | 设为首页 | 会员中心 | 我要投稿 安卓应用网 （https://www.0791zz.com/）- 科技、建站、经验、云计算、5G、大数据,站长网!
当前位置： 首页 > 运营中心 > Nginx > 正文

SSL连接失败,没有来自服务器的证书请求,从AWS上运行的本地Websphere AS连接到AWS上的Nginx

发布时间：2020-05-27 11:13:42 所属栏目：Nginx 来源：互联网
导读：我很难通过客户端身份验证连接到服务.该服务(“SecureService”)在AWS上.客户端位于Mac上的Linux VM上. SecureService上的Nginx对我在端口443上访问的资源强制执行客户端身份验证.我可以使用概念验证Java独立应用程序(openjdk 1.8.0_60)或其他客户端,从同一个

我很难通过客户端身份验证连接到服务.该服务(“SecureService”)在AWS上.客户端位于Mac上的Linux VM上. SecureService上的Nginx对我在端口443上访问的资源强制执行客户端身份验证.我可以使用概念验证Java独立应用程序(openjdk 1.8.0_60)或其他客户端,从同一个VM连接到同一个SecureService,获得成功的响应(wget,openssl),但不是来自Websphere AS上托管的相同Java代码(无可否认地依赖于旧库和IBM J9 VM,构建2.6,JRE 1.6.0).但是,在/ etc / hosts中将SecureService主机名重新映射到127.0.0.1时,Websphere AS上的相同Java代码会成功连接到需要来自同一证书颁发机构的客户端身份验证的本地openSSL服务器. SecureServer在失败连接中的响应报告“400没有发送所需的SSL证书”…“400 Bad Request”,但tcpdump数据包捕获显示它不发送证书请求,而在所有其他情况下.这令人费解并且让我认为ClientHello消息中有一些服务器不喜欢的东西,尽管成功和失败连接中的ClientHello消息非常相似.

一个非常奇怪的细节也是tcpdump从未在失败的通信中捕获从我的客户端到服务器的第一个TCP SYN数据包,而它捕获其余的(来自服务器的SYN ACK,然后来自客户端的ACK)和所有数据包(SYN)所有其他通信上的,SYN ACK,ACK).

所有通信都在其所有部分中使用TLSv1.2.

连接失败：


    (client <--> server)
    <-- SYN,ACK
    --> ACK
    --> Client Hello
    <-- ACK
    <-- Server Hello,Certificate,Server Hello Done
    --> ACK
    --> Client Key Exchange
    <-- ACK
    --> Change Cypher Spec
    <-- ACK
    --> Encrypted Handshake Message
    <-- ACK
    <-- Change Cypher Spec,Encrypted Handshake Message
    --> Application Data
    ...

从概念证明Java app成功连接：
(客户端< - >服务器)


    --> SYN
    <-- SYN,ACK
    --> ACK
    --> Client Hello
    <-- ACK
    <-- Server Hello
    <-- Certificate
    <-- Certificate Request,Server Hello Done
    --> ACK
    --> ACK
    --> [TCP segment of a reassembled PDU]
    --> Certificate,Client Key Exchange
    <-- ACK
    --> Certificate Verify
    --> Change Cypher Spec
    --> Hello Request,Hello Request
    <-- ACK
    <-- Change Cypher Spec,Encrypted Handshake Message
    --> Application Data
    ...

从Websphere AS到本地openSSL的成功连接：
(客户端< - >服务器)


    --> SYN
    <-- SYN,Certificate Request,Server Hello Done
    --> ACK
    --> Certificate,Client Key Exchange
    <-- ACK
    --> Certificate Verify
    --> Change Cypher Spec
    --> Encrypted Handshake Message
    <-- ACK
    <-- Change Cypher Spec,Encrypted Handshake Message
    --> Application Data
    ...

失败的客户你好：

Frame 3: 332 bytes on wire (2656 bits),332 bytes captured (2656 bits)
    Encapsulation type: Linux cooked-mode capture (25)
    Arrival Time: Feb 25,2016 13:29:15.353437000 GMT
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1456406955.353437000 seconds
    [Time delta from previous captured frame: 0.004839000 seconds]
    [Time delta from previous displayed frame: 0.004839000 seconds]
    [Time since reference or first frame: 0.004868000 seconds]
    Frame Number: 3
    Frame Length: 332 bytes (2656 bits)
    Capture Length: 332 bytes (2656 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: sll:ethertype:ip:tcp:ssl]
    [Coloring Rule Name: TCP]
    [Coloring Rule String: tcp]
Linux cooked capture
    Packet type: Sent by us (4)
    Link-layer address type: 1
    Link-layer address length: 6
    Source: CadmusCo_67:0a:c1 (08:00:27:67:0a:c1)
    Protocol: IPv4 (0x0800)
Internet Protocol Version 4,Src: (OMITTED FOR SECURITY REASONS),Dst: (OMITTED FOR SECURITY REASONS)
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP: CS0,ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 316
    Identification: 0xf29d (62109)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: TCP (6)
    Header checksum: 0xc7f8 [validation disabled]
        [Good: False]
        [Bad: False]
    Source: (OMITTED FOR SECURITY REASONS)
    Destination: (OMITTED FOR SECURITY REASONS)
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol,Src Port: 51512 (51512),Dst Port: 443 (443),Seq: 1,Ack: 1,Len: 276
    Source Port: 51512
    Destination Port: 443
    [Stream index: 0]
    [TCP Segment Len: 276]
    Sequence number: 1    (relative sequence number)
    [Next sequence number: 277    (relative sequence number)]
    Acknowledgment number: 1    (relative ack number)
    Header Length: 20 bytes
    Flags: 0x018 (PSH,ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: *******AP***]
    Window size value: 14600
    [Calculated window size: 14600]
    [Window size scaling factor: -2 (no window scaling used)]
    Checksum: 0x8054 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [Bytes in flight: 276]
Secure Sockets Layer
    TLSv1.2 Record Layer: Handshake Protocol: Client Hello
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 271
        Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 267
            Version: TLS 1.2 (0x0303)
            Random
                GMT Unix Time: Feb 25,2016 13:29:15.000000000 GMT
                Random Bytes: 2ca99e72b66289fcd3f11bf2dc3ef464709b197e6dd6cdd5...
            Session ID Length: 32
            Session ID: 28eef056a41440e760eaa9e3358a9cd56d8823fa130e9100...
            Cipher Suites Length: 128
            Cipher Suites (64 suites)
                Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)
                Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
                Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
                Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)
                Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
                Cipher Suite: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA (0xfeff)
                Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016)
                Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)
                Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066)
                Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
                Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067)
                Cipher Suite: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 (0x00a2)
                Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (0x0040)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
                Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011)
                Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)
                Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)
                Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (0x0040)
                Cipher Suite: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 (0x00a2)
                Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012)
                Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066)
                Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014)
                Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
                Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007)
                Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
                Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011)
                Cipher Suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc003)
                Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA (0xc004)
                Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 (0xc025)
                Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02d)
                Cipher Suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA (0xc002)
                Cipher Suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA (0xc00d)
                Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA (0xc00e)
                Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 (0xc029)
                Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 (0xc031)
                Cipher Suite: TLS_ECDH_RSA_WITH_RC4_128_SHA (0xc00c)
                Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008)
                Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)
                Cipher Suite: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA (0xfeff)
                Cipher Suite: SSL_RSA_FIPS_WITH_DES_CBC_SHA (0xfefe)
                Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
                Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
                Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
                Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
                Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009)
                Cipher Suite: TLS_RSA_WITH_NULL_MD5 (0x0001)
                Cipher Suite: TLS_RSA_WITH_NULL_SHA (0x0002)
                Cipher Suite: TLS_RSA_WITH_NULL_SHA256 (0x003b)
                Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)
                Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
                Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
            Compression Methods Length: 1
            Compression Methods (1 method)
                Compression Method: null (0)
            Extensions Length: 66
            Extension: elliptic_curves
                Type: elliptic_curves (0x000a)
                Length: 24
                Elliptic Curves Length: 22
                Elliptic curves (11 curves)
                    Elliptic curve: secp256r1 (0x0017)
                    Elliptic curve: secp192r1 (0x0013)
                    Elliptic curve: secp224r1 (0x0015)
                    Elliptic curve: secp384r1 (0x0018)
                    Elliptic curve: secp521r1 (0x0019)
                    Elliptic curve: secp160k1 (0x000f)
                    Elliptic curve: secp160r1 (0x0010)
                    Elliptic curve: secp160r2 (0x0011)
                    Elliptic curve: secp192k1 (0x0012)
                    Elliptic curve: secp224k1 (0x0014)
                    Elliptic curve: secp256k1 (0x0016)
            Extension: ec_point_formats
                Type: ec_point_formats (0x000b)
                Length: 2
                EC point formats Length: 1
                Elliptic curves point formats (1)
                    EC point format: uncompressed (0)
            Extension: signature_algorithms
                Type: signature_algorithms (0x000d)
                Length: 28
                Signature Hash Algorithms Length: 26
                Signature Hash Algorithms (13 algorithms)
                    Signature Hash Algorithm: 0x0603
                        Signature Hash Algorithm Hash: SHA512 (6)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Hash Algorithm: 0x0601
                        Signature Hash Algorithm Hash: SHA512 (6)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0503
                        Signature Hash Algorithm Hash: SHA384 (5)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Hash Algorithm: 0x0501
                        Signature Hash Algorithm Hash: SHA384 (5)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0403
                        Signature Hash Algorithm Hash: SHA256 (4)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Hash Algorithm: 0x0401
                        Signature Hash Algorithm Hash: SHA256 (4)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0303
                        Signature Hash Algorithm Hash: SHA224 (3)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Hash Algorithm: 0x0301
                        Signature Hash Algorithm Hash: SHA224 (3)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0203
                        Signature Hash Algorithm Hash: SHA1 (2)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Hash Algorithm: 0x0201
                        Signature Hash Algorithm Hash: SHA1 (2)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0402
                        Signature Hash Algorithm Hash: SHA256 (4)
                        Signature Hash Algorithm Signature: DSA (2)
                    Signature Hash Algorithm: 0x0202
                        Signature Hash Algorithm Hash: SHA1 (2)
                        Signature Hash Algorithm Signature: DSA (2)
                    Signature Hash Algorithm: 0x0101
                        Signature Hash Algorithm Hash: MD5 (1)
                        Signature Hash Algorithm Signature: RSA (1)

从SecureServer的概念证明成功的客户Hello：

（编辑：安卓应用网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!
    相关内容
      推荐文章
        站长推荐
        热点阅读

          【免责声明】本站内容转载自互联网，其发布内容言论不代表本站观点，如果其链接、内容的侵犯您的权益，烦请提交相关链接至邮箱bqsm@foxmail.com我们将及时予以处理。

          建议您使用1920×1080分辨率、谷歌浏览器Google Chrome、Microsoft Edge以获得本站的最佳浏览效果

          Copygight © 2008-2022 https://www.0791zz.com/ All Rights Reserved. 安卓应用网