Openssl显示其他服务器证书，而浏览器正确显示 [英] Openssl shows a different server certificate while browser shows correctly
问题描述
我正在使用openssl s_client -showcerts -connect test.abc.com:443 -state -debug检查服务器证书.服务器正在使用nginx.但是，当我请求上述openssl时，服务器证书显示为* .xyz.com.我想知道openssl在哪里获取此证书作为服务器证书.操作系统是Linux.在/etc/pki/tls中签入，但是opensl的证书读为服务器证书不存在. Nginx配置指向abc.com的正确证书.另外，如果我使用浏览器访问，则会显示正确的证书.仅在openssl中会发生这种情况. :(
I am using openssl s_client -showcerts -connect test.abc.com:443 -state -debug to check the server certificate. The server is using nginx. But when i request the above openssl shows the server certificate as *.xyz.com. I want to know where openssl is getting this as the server certificate. OS is Linux. checked in /etc/pki/tls but the certificate which openssl reads as the server certificate is not there. And the nginx config points to the correct certificate for abc.com. Also if I access using the browser the correct cert is shown. This happens only with openssl. :(
推荐答案
服务器正在发布到ethornetworks.com的永久重定向.要查看它，请首先发出您的s_client命令:
The server is issuing a permanent redirect to ethornetworks.com. To see it, first issue your s_client command:
$ openssl s_client -CAfile AddTrustExternalCARoot.crt -connect apitest.ethormapp.com:443
CONNECTED(00000003)
depth=4 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=3 C = US, ST = UT, L = Salt Lake City, O = The USERTRUST Network, OU = http://www.usertrust.com, CN = UTN - DATACorp SGC
verify return:1
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = EssentialSSL CA
verify return:1
depth=0 OU = Domain Control Validated, OU = EssentialSSL Wildcard, CN = *.ethornetworks.com
verify return:1
...
在最底端，获得验证结果后，输入GET / HTTP/1.0命令并按两次RETURN键:
At the very bottom, after you get the verify result, enter a GET / HTTP/1.0 command and press RETURN twice:
...
Start Time: 1390985154
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
GET / HTTP/1.0
HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.4
Date: Wed, 29 Jan 2014 08:46:01 GMT
Content-Type: text/html
Content-Length: 184
Connection: close
Location: https://www.ethornetworks.com/
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.4.4</center>
</body>
</html>
closed
$
如果您遵循重定向，那么您将获得预期的结果:
If you follow the redirect, then you will get the expected result:
$ openssl s_client -CAfile AddTrustExternalCARoot.crt -connect www.ethornetworks.com:443
CONNECTED(00000003)
depth=4 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
0 s:/OU=Domain Control Validated/OU=EssentialSSL Wildcard/CN=*.ethornetworks.com
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=EssentialSSL CA
1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=EssentialSSL CA
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO Certification Authority
...
最后，您可以使用 AddTrust外部CA根以确保链条按预期进行验证.如果没有它和-CAfile选项，s_client将报告19 (self signed certificate in certificate chain).
Finally, you can use the AddTrust External CA Root to ensure the chain verifies as expected. Without it and the -CAfile option, s_client will report 19 (self signed certificate in certificate chain).
这篇关于Openssl显示其他服务器证书，而浏览器正确显示的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
