c# - 在服务器端获取 SSL 错误 SSL_ERROR_RX_RECORD_TOO_LONG

Question

我已经用 C# 编写了自己的网络服务器。

而且我总是在端口 443 上的新 IP 中为我的站点建立 SSL 证书。而且它总是工作正常。

但是这次我得到了这个错误:

Secure Connection Failed

An error occurred during a connection to www.sayehrooshan-co.com. SSL received a record that exceeded the maximum permissible length. Error code:

SSL_ERROR_RX_RECORD_TOO_LONG

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website owners to inform them of this problem.

这是页面地址:

https://www.sayehrooshan-co.com

这是我的代码，始终与其他网站的 .pfx 文件一起使用:

sslstream = new SslStream(new NetworkStream(mySocket, false), false);
//commented for nedaye arzhang
X509Certificate2 serverCertificate = new X509Certificate2(Path, Password);
//X509Certificate2 serverCertificate = new X509Certificate2("www_nedaye-arzhang_com.cer");                           

sslstream.AuthenticateAsServer(serverCertificate, false, System.Security.Authentication.SslProtocols.Tls, true);

搜索了很多但没有得到任何解决方案有人知道吗？

Answer 1

服务器坏了。尝试使用 openssl s_client 显示 TLS 握手已成功完成并且证书没有问题，但稍后在通信中中断:

$ openssl s_client -connect www.sayehrooshan-co.com:443 -servername www.sayehrooshan-co.com -crlf
CONNECTED(00000003)
...
SSL-Session:
    Protocol  : TLSv1
    Cipher    : ECDHE-RSA-AES256-SHA
    ...
    Verify return code: 0 (ok)
---
GET / HTTP/1.1
Host: www.sayehrooshan-co.com

140040623380160:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:365:

在实验过程中进行数据包捕获可以看到服务器在 TLS 连接上发送纯文本:

> various TLS encrypted stuff from client (likely HTTP request) ....
< followed by sudden plain text from the server:
   Cannot find table 0.

   at System.Data.DataTableCollection.get_Item(Int32 index)
   at MyWebServerNamespace.MyWebServer.SetTableRowValue(DataSet& ds, String type, String name, String value) in D:\iteration source - table 13 removed\MyWebServer\MyWebServer.cs:line 4024
   at MyWebServerNamespace.MyWebServer.LoadCmsValues(Content cms, Ssl sslClass, DataSet& Ds, DataTable& fileDt, Socket& mySocket, Byte[]& contentBytes, Boolean& showCmsError) in D:\iteration source - table 13 removed\MyWebServer\MyWebServer.cs:line 1761
   at MyWebServerNamespace.MyWebServer.HandleTcpRequest(Object state) in D:\iteration source - table 13 removed\MyWebServer\MyWebServer.cs:line 1027
LoadCmsValues enter

客户端将尝试将此纯文本消息解释为 TLS 记录。这意味着它将解析初始字节并提取 TLS 协议(protocol)版本和有效负载长度。鉴于这根本不是 TLS 记录，所有这些值都将是垃圾。根据客户端中 TLS 堆栈的实际实现，这将导致错误消息，例如“错误的版本号”(不支持声明的 TLS 协议(protocol)版本)或“SSL_ERROR_RX_RECORD_TOO_LONG”(指定的有效负载长度不是有效负载的实际长度)或更一般的 “ERR_SSL_PROTOCOL_ERROR” 或类似的。