openssl协商STARTTLS的SSL加密 [英] openssl to negotiate SSL encryption for STARTTLS

问题描述

我正在使用openssl正常连接到SMTP服务器(不加密)，发送STARTTLS命令，协商SSL加密，然后与加密会话进行交互.

I'm using openssl to connect to an SMTP server normally (without encryption), send a STARTTLS command, negotiate the SSL encryption, and then interact with the encrypted session.

这是我正在使用的命令(通过telnet):

This is the command I'm using (through telnet):

openssl s_client -starttls smtp -crlf -connect 1.2.3.4:25

如何确保TLS握手成功?

How can I ensure that TLS handshake was successful?

这是到目前为止使用的命令序列:

This is the sequence of commands used so far:

<< 220 example.com ESMTP ready
>> EHLO localhost
<< 250-smtp.mail.yahoo.com
<< 250-PIPELINING
<< 250-AUTH PLAIN LOGIN CRAM-MD5
<< 250 STARTTLS
>> STARTTLS
<< 220 2.0.0 Start TLS
>> openssl s_client -starttls smtp -crlf -connect 127.0.0.1:587    

推荐答案

您似乎在混淆shell(在其中键入诸如telnet或openssl之类的命令)和套接字的协议.

You seem to be confusing a shell (where you type commands such as telnet or openssl) and the socket's protocol.

使用telnet连接到SMTP这样的协议的端口是一个快速技巧，它允许您直接输入在实现该协议的客户端时通常必须编写的内容.它可以用于基于文本的协议，但是有局限性.特别是，您将很难通过这种方式键入TLS握手:首先，您可能无法在键盘上找到需要发送的某些字节的正确键；其次，您当然无法阅读服务器发送给您的内容.简而言之，这种方法没有任何意义.

Using telnet to connect to a port for a protocol like SMTP is a quick hack that allows you to type in directly what you'd normally have to program if implementing a client for that protocol. It can work a little for text-based protocols but it has limitations. In particular, you'll have a hard-time typing an TLS handshake this way: firstly you probably won't be able to find the right keys on your keyboard for some of the bytes you need to send; secondly, you certainly won't be able to read what the server sends you. In short, this approach doesn't make any sense.

openssl s_client -starttls smtp -crlf -connect 127.0.0.1:587已经完成了您要使用telnet进行的操作:它打开了与该服务器的连接，发送了EHLO SMTP命令，发送了STARTTLS SMTP命令，然后开始了握手. OpenSSL命令本身根本不是SMTP协议的一部分，并且绝对不能在SMTP套接字上发送. 运行此命令时，您将获得与已执行握手的telnet会话类似的操作，因为您应该能够以与telnet相同的方式使用其标准输入/输出.

openssl s_client -starttls smtp -crlf -connect 127.0.0.1:587 already does what you're trying to do with telnet: it opens the connection to that server, sends the EHLO SMTP command, sends the STARTTLS SMTP command and then starts the handshake. The OpenSSL command itself is not part of the SMTP protocol at all and mustn't be sent on the SMTP socket. What you'll get when running this command should be similar to having your telnet session with the handshake already performed, since you should be able to use its standard input/ouput in the same way you would be able telnet.

话虽这么说，telnet和openssl s_client发送SMTP命令都是最好的调试技术.

This being said, both telnet and openssl s_client to send SMTP commands are debugging techniques at best.

这篇关于openssl协商STARTTLS的SSL加密的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！