{"id":169401,"date":"2020-10-07T13:31:57","date_gmt":"2020-10-07T05:31:57","guid":{"rendered":"http:\/\/4563.org\/?p=169401"},"modified":"2020-10-07T13:31:57","modified_gmt":"2020-10-07T05:31:57","slug":"solidot-%e7%9a%84-wotrus-%e8%af%81%e4%b9%a6%e4%b8%8d%e8%a2%ab%e4%bf%a1%e4%bb%bb","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=169401","title":{"rendered":"Solidot \u7684 WoTrus \u8bc1\u4e66\u4e0d\u88ab\u4fe1\u4efb"},"content":{"rendered":"
\n
\n
\n

Solidot \u7684 WoTrus \u8bc1\u4e66\u4e0d\u88ab\u4fe1\u4efb <\/h1>\n

<\/p>\n

\n
\u8cc7\u6df1\u5927\u4f6c : guyskk0x0 <\/span> <\/i> 4<\/span> <\/div>\n
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n
<\/p>\n

\u4ece 2020-10-16 \u5f00\u59cb\uff0cSolidot \u4f3c\u4e4e\u66f4\u6362\u4e86 WoTrus (\u6c83\u901a) \u7b7e\u53d1\u7684 HTTPS \u8bc1\u4e66\uff0ccurl, requests \u548c cloudflare \u90fd\u4e0d\u4fe1\u4efb\u8fd9\u4e2a\u8bc1\u4e66\u3002<\/p>\n

$ curl -v https:\/\/www.solidot.org\/ * About to connect() to www.solidot.org port 443 (#0) *   Trying 106.75.14.181... * Connected to www.solidot.org (106.75.14.181) port 443 (#0) * Initializing NSS with certpath: sql:\/etc\/pki\/nssdb *   CAfile: \/etc\/pki\/tls\/certs\/ca-bundle.crt   CApath: none * Server certificate: *  subject: CN=*.solidot.org,OU=PositiveSSL Multi-Domain,OU=Domain Control Validated *  start date: 10 \u6708 16 00:00:00 2019 GMT *  expire date: 10 \u6708 15 23:59:59 2021 GMT *  common name: *.solidot.org *  issuer: CN=WoTrus DV Server CA,OU=Controlled by Sectigo exclusively for WoTrus CA Limited,O=WoTrus CA Limited,L=Shenzhen,ST=Guangdong,C=CN * NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER) * Peer's Certificate issuer is not recognized. * Closing connection 0 curl: (60) Peer's Certificate issuer is not recognized. <\/code><\/pre>\n
requests.exceptions.SSLError: HTTPSConnectionPool(host='www.solidot.org', port=443): Max retries exceeded with url: \/index.rss (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)'))) <\/code><\/pre>\n<\/p><\/div>\n
 \u5927\u4f6c\u6709\u8a71\u8aaa<\/b> (6<\/span>)        <\/div>\n
 <\/div>\n<\/p><\/div>\n<\/p><\/div>\n
    \n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : Xusually <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 curl -v https:\/\/www.solidot.org\/
    * Trying 106.75.14.181…
    * TCP_NODELAY set
    * Connected to www.solidot.org (106.75.14.181) port 443 (#0)
    * ALPN, offering h2
    * ALPN, offering http\/1.1
    * successfully set certificate verify locations:
    * CAfile: \/etc\/ssl\/cert.pem
     CApath: none
    * TLSv1.2 (OUT), TLS handshake, Client hello (1):
    * TLSv1.2 (IN), TLS handshake, Server hello (2):
    * TLSv1.2 (IN), TLS handshake, Certificate (11):
    * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
    * TLSv1.2 (IN), TLS handshake, Server finished (14):
    * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
    * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
    * TLSv1.2 (OUT), TLS handshake, Finished (20):
    * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
    * TLSv1.2 (IN), TLS handshake, Finished (20):
    * SSL connection using TLSv1.2 \/ ECDHE-RSA-AES128-GCM-SHA256
    * ALPN, server accepted to use http\/1.1
    * Server certificate:
    * subject: OU=Domain Control Validated; OU=PositiveSSL Multi-Domain; CN=*.solidot.org
    * start date: Oct 16 00:00:00 2019 GMT
    * expire date: Oct 15 23:59:59 2021 GMT
    * subjectAltName: host “www.solidot.org” matched cert’s “*.solidot.org”
    * issuer: C=CN; ST=Guangdong; L=Shenzhen; O=WoTrus CA Limited; OU=Controlled by Sectigo exclusively for WoTrus CA Limited; CN=WoTrus DV Server CA
    * SSL certificate verify ok.
    > GET \/ HTTP\/1.1
    > Host: www.solidot.org
    > User-Agent: curl\/7.64.1
    > Accept: *\/*
    > 
    < HTTP\/1.1 403 Forbidden
    < Server: nginx
    < Date: Mon, 19 Oct 2020 14:50:53 GMT
    < Content-Type: text\/html
    < Content-Length: 146
    < Connection: keep-alive
    < 
    <html>
    <head><title>403 Forbidden<\/title><\/head>
    <body>
    <center><h1>403 Forbidden<\/h1><\/center>
    <hr><center>nginx<\/center>
    <\/body>
    <\/html>
    * Connection #0 to host www.solidot.org left intact
    * Closing connection 0<\/p>\n
    \u6211\u8fd9\u91cc\u6ca1\u4ec0\u4e48\u95ee\u9898<\/p>\n
    \u4e3b\u4f60\u662f\u4e0d\u662f\u5728\u6c83\u901a\u4e0a\u6b21\u51fa\u4e8b\u513f\u7684\u65f6\u5019\uff0c\u8ddf\u98ce\u81ea\u5df1\u5220\u6389\u4e86\u81ea\u5df1\u672c\u5730\u5bf9\u6c83\u901a\u7684\u4fe1\u4efb\uff1f                                                            <\/p><\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : guyskk0x0 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @Xusually \u6211 Mac \u548c Chrome \u4e0a\u4e5f\u6b63\u5e38\uff0c\u4f46\u7528 requests\uff0c\u4ee5\u53ca\u670d\u52a1\u5668\u4e0a\u90fd\u62a5 SSL \u9519\u8bef\u3002                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : Xusually <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u63a5\u4e0a\u4e00\u6761\uff0c\u6216\u8005\u4f60\u7684\u73af\u5883\u6ca1\u6709\u66f4\u65b0\u6216\u8005\u5b89\u88c5\u6bd4\u8f83\u65b0\u7684 Root CA \u8bc1\u4e66\uff1f
    \u5982\u679c\u662f\u8fd9\u6837\u7684\u8bdd\uff0c\u8bd5\u8bd5\u770b\u6307\u5b9a\u4e00\u4e0b ca certs \u7684\u8def\u5f84                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : Xusually <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @guyskk0x0 \u770b\u4e0a\u53bb Solidot \u6ca1\u6709\u628a WoTrus \u7684\u6574\u4e2a\u8bc1\u4e66\u94fe\u6253\u5305\u8fdb\u4e00\u4e2a bundle \u91cc\u9762\uff0c\u4f60\u53ef\u4ee5\u5c1d\u8bd5\u53bb Comodo \u6216\u8005 Wotrus \u53bb\u627e\u4e00\u4e0b\uff0c\u4e00\u822c\u60c5\u51b5\u4e0b\uff0c\u4e0a\u5c42 CA \u7684\u8bc1\u4e66\u94fe\u90fd\u662f\u6709\u516c\u5f00\u63d0\u4f9b\u7684\u3002                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : guyskk0x0 <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @Xusually \u8fd9\u91cc\u663e\u793a\u4e5f\u662f\u8bc1\u4e66\u94fe\u4e0d\u5b8c\u6574 https:\/\/myssl.com\/www.solidot.org?domain=www.solidot.org&port=443                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : Xusually <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @guyskk0x0 \u55ef\uff0c\u90a3\u5c31\u5bf9\u4e86\u3002\u4f60\u53bb\u627e\u4e00\u4e0b\u7f3a\u5931\u7684\u8bc1\u4e66\u94fe\u5c31\u884c\u3002\u4ed6\u4eec\u524d\u7aef\u670d\u52a1\u5668\u6ca1\u6709\u4f7f\u7528\u5305\u542b\u5b8c\u6574 CA \u94fe\u7684 cert bundle\uff0c\u540c\u65f6\u4e5f\u6ca1\u6709\u5355\u72ec\u914d\u7f6e CA cert\uff0c\u5c31\u4f1a\u8fd9\u6837\u5f88\u4f9d\u8d56\u4e8e\u5ba2\u6237\u7aef\u7684\u8bc1\u4e66\u5b8c\u5907\u7a0b\u5ea6\uff0c\u5728\u670d\u52a1\u5668\u4e0a\u53ef\u80fd\u51fa\u95ee\u9898\u3002                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n","protected":false},"excerpt":{"rendered":"
    Solidot \u7684 WoTrus …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/169401"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=169401"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/169401\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=169401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=169401"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=169401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}