ruby SSL 客户端

Question

当我用

测试时，我有一个 SSL Echo 服务器工作正常

gnutls-cli --starttls --port 9002 --insecure localhost

我的 SSL Echo 服务器如下:

#!/usr/bin/ruby

require 'socket';
require 'openssl';
certfile = 'privkey.pem';
host = "127.0.0.1"
port = 9002;

server = TCPServer.new( host, port );

# Establish an SSL context 
sslContext = OpenSSL::SSL::SSLContext.new
sslContext.cert = OpenSSL::X509::Certificate.new(File.open( "myssl.cert.cert" ))
sslContext.key = OpenSSL::PKey::RSA.new(File.open( "myssl.cert.key" ))

# Create SSL server
sslServer = OpenSSL::SSL::SSLServer.new( server, sslContext );

# Don't expect an immidate SSL handshake upon connection.
sslServer.start_immediately = false;

sslSocket = sslServer.accept;
sslSocket.puts( "Toast.." );
# Server loop
while line = sslSocket.gets
  line.chomp!;
  if "STARTTLS" == line
    # Starting TLS
    sslSocket.accept;
  end
  sslSocket.puts( "Got '#{line}'" );
end
sslSocket.close;

但是，我的客户端无法正常工作(我在 StackOverflow 的某处借用了它)，如下所示:

#!/usr/bin/env ruby
require "socket"
require "thread"
require "openssl"

host = "127.0.0.1"
port = 9002

socket = TCPSocket.new(host, port)
expectedCert = OpenSSL::X509::Certificate.new(File.open("myssl.cert.cert"))
ssl = OpenSSL::SSL::SSLSocket.new(socket)
ssl.sync_close = true
ssl.connect
if ssl.peer_cert.to_s != expectedCert.to_s
  stderrr.puts "Unexpected certificate"
  exit(1)
end

Thread.new {
  begin
    while lineIn = ssl.gets
      lineIn = lineIn.chomp
      $stdout.puts lineIn
    end
  rescue
    $stderr.puts "Error in input loop: " + $!
  end
}

while (lineOut = $stdin.gets)
  lineOut = lineOut.chomp
  ssl.puts lineOut
end

我遇到了错误。

./sslclient.rb:13:in `connect': SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: unknown protocol (OpenSSL::SSL::SSLError)
    from ./sslclient.rb:13:in `<main>'

为什么ssl.connect会出错？我错过了什么吗？

Answer 1

在服务器端，您从纯文本开始，发送欢迎消息并期待 starttls 命令 - 只有这样您才能升级到 TLS。但是在客户端，您会在 TCP 连接后立即尝试升级到 TLS，例如无需读取服务器问候语，也无需发送 starttls 命令。