gpt4 book ai didi

android - openssl s_client -connect 默认为子域?

转载 作者:塔克拉玛干 更新时间:2023-11-02 23:29:12 30 4
gpt4 key购买 nike

过去两天我一直在试图找出为什么我的 android 应用程序在使用以下代码连接到我的网站时出现“无对等证书”异常错误:

HttpClient httpclient = new DefaultHttpClient();
HttpPost httppost = new HttpPost("https://mysite.co.uk/android/login.php");
ResponseHandler<String> responseHandler = new BasicResponseHandler();
String response = httpclient.execute(httppost, responseHandler);

我使用了 SSL Labs 检查器,我的证书以 A 级通过,并且 SSL 链没有问题(我在这里阅读了很多帖子,声称这是问题所在)。无论如何,我认为这是 android 的问题,我正在尝试许多不同的建议。

我发现了一个在我的服务器中输入以下命令的建议:

openssl s_client -connect mysite.co.uk:443

看结果的时候,打印出来的是我设计站点的自签名证书!显然这不是预期的!

这是我的主站点(域和 www)以及设计站点的三个虚拟主机配置文件

mysite.co.uk.conf:

# domain: mysite.co.uk
# public: /home/user/public/mysite.co.uk/public

<VirtualHost *:80>
ServerName mysite.co.uk
ServerAlias *.mysite.co.uk
RedirectMatch permanent /(.*) https://mysite.co.uk/$1
</VirtualHost>

<VirtualHost *:443>

Header always set Strict-Transport-Security "max-age=63072000;"

SSLEngine On
SSLCertificateFile /etc/apache2/ssl/mysite.co.uk/mysite.co.uk.crt
SSLCACertificateFile /etc/apache2/ssl/mysite.co.uk/gs_intermediate_ca.crt

<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>

<Directory "/home/user/public/mysite.co.uk/public">
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted
</Directory>

# Admin email, Server Name (domain name), and any aliases
ServerAdmin admin@mysite.co.uk
ServerName mysite.co.uk

# Index file and Document Root (where the public files are located)
DirectoryIndex index.html index.php
DocumentRoot /home/user/public/mysite.co.uk/public

# Log file locations
LogLevel warn
ErrorLog /home/user/public/mysite.co.uk/log/error.log
CustomLog /home/user/public/mysite.co.uk/log/access.log combined
</VirtualHost>

www.mysite.co.uk.conf:

# domain: www.mysite.co.uk
# public: /home/user/public/mysite.co.uk/public

<VirtualHost *:80>
ServerName www.mysite.co.uk
ServerAlias *.www.mysite.co.uk
RedirectMatch permanent /(.*) https://www.mysite.co.uk/$1
</VirtualHost>

<VirtualHost *:443>

Header always set Strict-Transport-Security "max-age=63072000;"

SSLEngine On
SSLCertificateFile /etc/apache2/ssl/mysite.co.uk/www.mysite.co.uk.crt
SSLCACertificateFile /etc/apache2/ssl/mysite.co.uk/gs_intermediate_ca.crt

<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>

<Directory "/home/user/public/mysite.co.uk/public">
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted
</Directory>

# Admin email, Server Name (domain name), and any aliases
ServerAdmin admin@mysite.co.uk
ServerName www.mysite.co.uk

# Index file and Document Root (where the public files are located)
DirectoryIndex index.html index.php
DocumentRoot /home/user/public/mysite.co.uk/public

# Log file locations
LogLevel warn
ErrorLog /home/user/public/mysite.co.uk/log/error.log
CustomLog /home/user/public/mysite.co.uk/log/access.log combined
</VirtualHost>

design.mysite.co.uk.conf:

# domain: design.mysite.co.uk
# public: /home/user/public/mysite.co.uk/design/public

<VirtualHost *:80>
ServerName design.mysite.co.uk
ServerAlias *.design.mysite.co.uk
RedirectMatch permanent /(.*) https://design.mysite.co.uk/$1
</VirtualHost>

<VirtualHost *:443>

SSLEngine On
SSLCertificateFile /etc/apache2/ssl/design.mysite.co.uk/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/design.mysite.co.uk/apache.key

<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>

<Directory "/home/user/public/mysite.co.uk/design/public">
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted
</Directory>

# Admin email, Server Name (domain name), and any aliases
ServerAdmin contact@mysite.co.uk
ServerName design.mysite.co.uk

# Index file and Document Root (where the public files are located)
DirectoryIndex index.html index.php
DocumentRoot /home/user/public/mysite.co.uk/design/public

# Log file locations
LogLevel warn
ErrorLog /home/user/public/mysite.co.uk/log/error.log
CustomLog /home/user/public/mysite.co.uk/log/access.log combined
</VirtualHost>

这也位于我的 apache 配置文件中

SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLCACertificateFile /etc/apache2/ssl/mysite.co.uk/gs_intermediate_ca.crt
SSLStaplingCache shmcb:/var/run/ocsp(128000)

SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2
SSLHonorCipherOrder on
SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
SSLInsecureRenegotiation off

当我运行时:

sudo a2dissite design.mysite.co.uk
sudo service apache2 restart

然后运行:

openssl s_client -connect mysite.co.uk:443

然后我获得了 mysite.co.uk 的证书详细信息,我的 Android 应用程序再次运行。我在这里错过了什么吗?为什么我的服务器默认为设计网站?

最佳答案

因为您在同一个 IP 地址后面有多个主机名,并且每个主机名都有自己的证书,所以您需要使用 SNI(服务器名称指示)。这会在 SSL 握手中发送所需的主机名。要使用 openssl 对此进行测试,您必须使用 -servername 参数,例如

openssl s_client -servername mysite.co.uk -connect mysite.co.uk:443

虽然当前所有浏览器都默认使用 SNI,但看起来 android 默认不使用 SNI,因此可能只会从默认服务器获取证书。我自己不是 android 程序员,但是在 stackoverflow 和其他地方有几个关于 SNI 与 android 的讨论表明,它可能是可能的,但可能不是 DefaultHTTPClient 类。

关于android - openssl s_client -connect 默认为子域?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/20823243/

30 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com