连接到主机的 SSL 验证失败

Question

我正在尝试在 Chef 服务器上上传一些 Recipe 。我将我的笔记本电脑用作工作站，使用 opscode.com 上的托管 Chef 作为 Chef 服务器。现在，当我尝试将 Recipe 从我的工作站上传到 Chef 服务器时，出现以下错误:

错误:连接到主机的 SSL 验证失败:s3-external-1.amazonaws.com - SSL_connect returned=6 errno=0 state=SSLv3 read finished A错误:OpenSSL::SSL::SSLError:SSL_connect returned=6 errno=0 state=SSLv3 read finished A

我正在使用来自 rackspace 私有(private)云的 Recipe :http://www.rackspace.com/knowledge_center/article/installing-openstack-with-rackspace-private-cloud-tools

我正在使用 v4.2.1 的 Recipe 。请帮我找出问题所在。

谢谢。

Answer 1

ERROR: SSL Validation failure connecting to host: s3-external-1.amazonaws.com - SSL_connect returned=6 errno=0 state=SSLv3 read finished A ERROR: OpenSSL::SSL::SSLError: SSL_connect returned=6 errno=0 state=SSLv3 read finished A

对我有用。

确保您拥有并信任 Class 3 Public Primary Certification Authority。您可以从 Symantec 的 Licensing and Use of Root Certificates 获得 Class 3 Public Primary Certification Authority .特别是，获取 Root 3 VeriSign Class 3 Primary CA - G5 .

然后，使用 OpenSSL 的 s_client 对其进行测试。您下载并信任的根是 PCA-3G5.pem，您通过 -CAfile 选项将其提供给 OpenSSL:

$ openssl s_client -CAfile PCA-3G5.pem -connect s3-external-1.amazonaws.com:443
CONNECTED(00000003)
depth=3 C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
verify return:1
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify return:1
depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = Terms of use at https://www.verisign.com/rpa (c)10, CN = VeriSign Class 3 Secure Server CA - G3
verify return:1
depth=0 C = US, ST = Washington, L = Seattle, O = Amazon.com Inc., CN = *.s3-external-1.amazonaws.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Washington/L=Seattle/O=Amazon.com Inc./CN=*.s3-external-1.amazonaws.com
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
 1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
 2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
...
    Start Time: 1392896325
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)