SSL连接因wget，curl而失败，但因firefox和lynx而成功
我无法通过自动脚本访问此网站: https://mydtac.dtac.co.th/EserviceLogin/Login?page = N& lang = zh_CN
I'm having trouble accessing this website by automated script: https://mydtac.dtac.co.th/EserviceLogin/Login?page=N&lang=en
如果我从浏览器查看(chrome，firefox，甚至lynx都在工作)，一切都很好.如果尝试从PHP(fsockopen)，wget或curl加载它，我会抱怨:
If i view from a browser (chrome, firefox, even lynx is working), it's all ok. I if try to load it from PHP (fsockopen), wget, or curl, it's complaining:
警告:stream_socket_enable_crypto():SSL操作失败，代码为1.OpenSSL错误消息:错误:140943FC:SSL例程:SSL3_READ_BYTES:sslv3警报坏记录中的Mac
Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac in
openssl检查也失败:
Also the openssl check fails:
openssl s_client -connect mydtac.dtac.co.th:4433074164412:错误:140770FC:SSL例程:SSL23_GET_SERVER_HELLO:未知协议:s23_clnt.c:787:
openssl s_client -connect mydtac.dtac.co.th:443 3074164412:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:787:
我已经尝试过在稳定和测试发行版的不同系统(debian)上使用wget来解决这个问题.
I've tried on different systems (debian), both stable and testing release, and the problem is present everywhere with wget.
我已经在连接上完成了TCP转储，看来工作方法和失败方法试图初始化ssl连接的方式是不同的:
I've done a TCP dump on the connection, and it seems the way is different how the working and the failing methods are trying to initialize the ssl connection:
失败的请求和响应:
T 192.168.1.42:60748-> 202.91.21.208:443 [AP]....，...(.. j ... 3O ..... N [U.iv.).5'... P..2 ....... 0.，.($ ......... kj9.8 ..... 2 ... *.& ....... =.5 .../.+.'.#......... g.@.3.2 ..... ED1 .-.).％.......<./... A ............................................... m ......... 4.2 .....................................#..... .....................................
#T 202.91.21.208:443-> 192.168.1.42:60748 [AP]......(
T 192.168.1.42:60748 -> 202.91.21.208:443 [AP] ....,...(..j...3O.....N[U.iv.).5'...P..2.......0.,.(.$.........k.j.9.8.....2...*.&.......=.5.../.+.'.#.........g.@.3.2.....E.D.1.-.).%...... .<./...A...............................................m...........4.2...................................................#..... ............ .........................
# T 202.91.21.208:443 -> 192.168.1.42:60748 [AP] ......(
工作请求和响应:
T 192.168.1.42:60751-> 202.91.21.208:443 [AP]................. 2 ... axg ....; .. | vYV .... oS#.. WD = u.zp..R./w.... ...... 3.2.E.9.8 ...../.A.5 ........... B......... mydtac.dtac.co.th ...............#.. 3t ...........
#T 202.91.21.208:443-> 192.168.1.42:60751 [AP]....:... 6..T ..(.. ok.q .. A .... F?... k.> V .... U..T....... ^ xc ......... 0 ... 0 ... a..L.Gd .... 0 ... .H ........ 0f1.0 ... U .... US1.0 ... U .... DigiCert Inc1.0 ... U .... www.digicert.com1％0#.. U .... DigiCert高保证CA-30 ... 120912000000Z..150917120000Z0..1.0 ... U .... TH1.0...U .... Bangkok1.0 ... U .... Pathumwan1(0&..U .... DTAC Internet Service Co.，Ltd.1#0！.. U .... Enterprise ServiceSupport1.0 ... U .... .dtac.co.th0 .."0 ... *.H ............. 0 ......... sa.9.w..3.@ IK .... | ... F... LgP.{J .... b + .....:....".._.b.{c ..... h ... n.2.J ... h..| lJ.= .. ^ .. i @ 6 .. ^.Fgg.！s .... U | ..'... w @ .RU.> .... 3 = cc.W ...... 0U ....... Jvlr .... J.hb ... p.+...d.} .. A .. ;; R..U.HN.\.#r％.％.. F..X ..; .. Y& ..... y ....IUy> ..... NU .- .. $ .. i..IP ......... \ c ........ N0..J0 ... U.#.. 0 ... Ps.)...... ..yH.0 ... U .......- f .... UY9; ..... T0#.. U .... 0 ... *.dtac.co.th..dtac.co.th0 ... U...... 0 ... U.％.. 0 ... + ......... + ....... 0a..U ... Z0X0 *.(.& .. $ http://crl3.digicert.com/ca3-g22.crl0 *.(.& .. $ http://crl4.digicert.com/ca3-g22.crl0....U...0...0 ......H ... l..0 ... 0:.. + .........
T 192.168.1.42:60751 -> 202.91.21.208:443 [AP] .................2...axg....;..|vYV....oS#..WD=u.zp..R./w...................3.2.E.9.8...../.A.5...........B.........mydtac.dtac.co.th...... ..................#..3t...........
# T 202.91.21.208:443 -> 192.168.1.42:60751 [AP] ....:...6..T ..(..ok.q..A....F?....k.>V....U..T.......^x.c...................0...0...............a..L.Gd....0....H........0f1.0...U....US1 .0...U....DigiCert Inc1.0...U....www.digicert.com1%0#..U....DigiCert High Assurance CA-30...120912000000Z..150917120000Z0..1.0...U....TH1.0. ..U....Bangkok1.0...U....Pathumwan1(0&..U....DTAC Internet Service Co., Ltd.1#0!..U....Enterprise Service Support1.0...U.....dtac.co.th0.." 0...*.H.............0.........sa.9.w..3.@I.K.....|...F...LgP.{J....b+.....:....".._.b.{c.....h...n.2.J...h..|lJ.=..^..i@6..^.Fgg.!s....U|..' ...w@.RU.>.... 3=cc.W......0U.......Jvlr....J.hb...p.+...d.}..A.. .;R..U.HN.\.#r%.%..F..X..;..Y&.......y....IUy>.....NU.-..$..i..I.P....... ...\c........N0..J0...U.#..0...P.s..)...... ..y.H..0...U.......-f.....U.Y.9;.....T0#..U....0...*.dtac.co.th..dtac.co.th0...U...........0...U .%..0...+.........+.......0a..U...Z0X0*.(.&.$http://crl3.digicert.com/ca3-g22.crl0*.(.&.$http://crl4.digicert.com/ca3-g22.crl0.....U. ....0. ..0......H...l..0...0:..+.........http://www.digicert.com/ssl-cps-repository.htm0..d..+.......0..V...R.A.n.y. .u.s.e. .o.f. .t.h.i.s. .C.e. r.t.i.f.i.c.a.t.e. .c.o.n.s.t.i.t.u.t.e.s. .a.c.c.e.p.t.a.n.c.e. .o.f. .t.h.e. .D.i.g.i.C.e.r.t. .C.P./.C.P.S. .a.n.d. .t.h.e. .R.e.l.y.i.n. g. .P.a.r.t.y. .A.g.r.e.e.m.e.n.t. .w.h.i.c.h. .l.i.m.i.t. .l.i.a.b.i.l.i.t.y. .a.n.d. .a.r.e. .i.n.c.o.r.p.o.r.a.t.e.d. .h.e.r.e.i.n. .b.y. .r.e.f.e.r.e.n.c.e..0{..+........o0m0$..+.....0
我试图在2天内找到一种解决方法，但被卡在这里.任何建议将不胜感激.
I'm trying to find a workaround this for 2 days but got stuck here. Any suggestions would be highly appreciated.
我知道这是网站管理员应该调查的事情，但这不是一种选择，因为99％的人在访问这些页面时没有任何问题，他们肯定不会做任何事情...
I know this is something which the webmaster should investigate, but that's not an option, as 99% of the people does not have any problem accessing these pages, they will do nothing for sure ...
openssl s_client -connect mydtac.dtac.co.th:4433074164412:错误:140770FC:SSL例程:SSL23_GET_SERVER_HELLO:未知协议:s23_clnt.c:787:
openssl s_client -connect mydtac.dtac.co.th:443 3074164412:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:787:
您需要使用SSLv3或TLS 1.0.您无法使用TLS 1.1或1.2发送 ClientHello .
You need to use SSLv3 or TLS 1.0. You can't send a ClientHello with TLS 1.1 or 1.2.
首先是TLS 1.0(不必担心自签名证书警告-我没有使用 CAfile 选项):
First, TLS 1.0 (don't worry about the self-signed certificate warning - I'm not using the CAfile option):
$ /usr/local/ssl/darwin/bin/openssl s_client -tls1 -connect mydtac.dtac.co.th:443
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
0 s:/C=TH/ST=Bangkok/L=Pathumwan/O=DTAC Internet Service Co., Ltd./OU=Enterprise Service Support/CN=*.dtac.co.th
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
...
下一步，TLS 1.2:
Next, TLS 1.2:
$ /usr/local/ssl/darwin/bin/openssl s_client -tls1_2 -connect mydtac.dtac.co.th:443
CONNECTED(00000003)
140735152734684:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:
...
相关，该服务器已关闭并且配置不正确.如果可能的话，您应该避免使用它:
Related, that server is down level and poorly configured. You should avoid it if possible:
$ openssl s_client -ssl3 -connect mydtac.dtac.co.th:443
CONNECTED(00000003)
...
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : SSLv3
Cipher : RC4-MD5
Session-ID: 1C04C221FDD0501832FFD8904790A34
从SSL扫描来看，我推测它是较旧的IIS服务器:
Judging from the SSL scan, I'd speculate its an older IIS server:
$ sslscan --no-failed mydtac.dtac.co.th
_
___ ___| |___ ___ __ _ _ __
/ __/ __| / __|/ __/ _` | '_ \
\__ \__ \ \__ \ (_| (_| | | | |
|___/___/_|___/\___\__,_|_| |_|
Version 1.8.2
http://www.titania.co.uk
Copyright Ian Ventura-Whiting 2009
Testing SSL server mydtac.dtac.co.th on port 443
Supported Server Cipher(s):
Accepted SSLv3 128 bits ADH-RC4-MD5
Accepted SSLv3 128 bits RC4-SHA
Accepted SSLv3 128 bits RC4-MD5
Accepted SSLv3 40 bits EXP-ADH-RC4-MD5
Accepted SSLv3 40 bits EXP-RC4-MD5
Accepted TLSv1 256 bits AES256-SHA
Accepted TLSv1 128 bits AES128-SHA
Accepted TLSv1 128 bits ADH-RC4-MD5
Accepted TLSv1 128 bits RC4-SHA
Accepted TLSv1 128 bits RC4-MD5
Accepted TLSv1 112 bits EDH-RSA-DES-CBC3-SHA
Accepted TLSv1 112 bits ADH-DES-CBC3-SHA
Accepted TLSv1 112 bits DES-CBC3-SHA
Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA
Accepted TLSv1 56 bits ADH-DES-CBC-SHA
Accepted TLSv1 56 bits DES-CBC-SHA
Accepted TLSv1 40 bits EXP-EDH-RSA-DES-CBC-SHA
Accepted TLSv1 40 bits EXP-ADH-DES-CBC-SHA
Accepted TLSv1 40 bits EXP-DES-CBC-SHA
Accepted TLSv1 40 bits EXP-ADH-RC4-MD5
Accepted TLSv1 40 bits EXP-RC4-MD5
Prefered Server Cipher(s):
SSLv3 128 bits RC4-MD5
TLSv1 128 bits RC4-MD5