Ruby-on-rails OpenSSL::SSL::SSLError: SSL_connect 返回=1 errno=0 state=unknown state: 未知协议

OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=unknown state: unknown protocol

提问by Rizon

I've followed many posts regarding this issue and non of them helped. I'm trying to connect using simplest irb commands:

我关注了很多关于这个问题的帖子，但没有一个有帮助。我正在尝试使用最简单的 irb 命令进行连接：

require 'open-uri'
open ('https://aristo4stu3.bgu.ac.il')

The weird thing is that for any other https uri I tried, it worked fine (i.e. https://google.com).

奇怪的是，对于我尝试过的任何其他 https uri，它运行良好（即https://google.com）。

For debugging purposes, I even tried to disable SSL verification using:

出于调试目的，我什至尝试使用以下方法禁用 SSL 验证：

OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

which didn't seemed to help either.

这似乎也没有帮助。

My setup is (on AWS):

我的设置是（在 AWS 上）：

$ rvm -v

rvm 1.21.3 (stable) by Wayne E. Seguin <[email protected]>, Michal Papis <[email protected]> [https://rvm.io/]

$ ruby -v
ruby 2.0.0p247 (2013-06-27 revision 41674) [x86_64-linux]

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 13.04
Release:    13.04
Codename:   raring

Complete log:

完整日志：

2.0.0-p247 :001 > require 'open-uri'
 => true 
2.0.0-p247 :002 > open('https://aristo4stu3.bgu.ac.il')
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=unknown state: (null)
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/net/http.rb:918:in `connect'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/net/http.rb:918:in `block in connect'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/timeout.rb:52:in `timeout'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/net/http.rb:918:in `connect'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/net/http.rb:862:in `do_start'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/net/http.rb:851:in `start'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:313:in `open_http'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:708:in `buffer_open'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:210:in `block in open_loop'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:208:in `catch'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:208:in `open_loop'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:149:in `open_uri'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:688:in `open'
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/open-uri.rb:34:in `open'
    from (irb):2
    from /home/ubuntu/.rvm/rubies/ruby-2.0.0-p247/bin/irb:16:in `<main>'

回答by rhashimoto

The problem appears to be that your target site, aristo4stu3.bgu.ac.il, is picky about SSL/TLS handshaking. I got two different results with the following OpenSSL command with different versions of OpenSSL:

问题似乎是您的目标站点aristo4stu3.bgu.ac.il对 SSL/TLS 握手很挑剔。使用以下 OpenSSL 命令和不同版本的 OpenSSL，我得到了两个不同的结果：

openssl s_client -connect aristo4stu3.bgu.ac.il:443

This does connect with the stock OpenSSL 0.9.8x on OS X 10.7.5. However, it does notconnect using OpenSSL 1.0.1e - in that case the server just closes the connection (by sending a Close Notify alert) immediately after receiving the Client Hello.

这确实与 OS X 10.7.5 上的股票 OpenSSL 0.9.8x 连接。但是，它并不能连接使用OpenSSL 1.0.1e -在这种情况下，服务器只需关闭连接（通过发送关闭通知警告）收到客户机问候之后。

I captured packets with Wireshark, and the difference between what these two versions send is that 0.9.8x is sending an SSLv2 Client Hello advertising support through TLS 1.0, while 1.0.1e is sending a TLSv1 Client Hello advertising support through TLS 1.2.

我用 Wireshark 捕获了数据包，这两个版本发送的区别在于 0.9.8x 是通过 TLS 1.0 发送 SSLv2 Client Hello 广告支持，而 1.0.1e 是通过 TLS 1.2 发送 TLSv1 Client Hello 广告支持。

If I tell 1.0.1e not to use TLS:

如果我告诉 1.0.1e 不要使用 TLS：

openssl s_client -connect aristo4stu3.bgu.ac.il:443 -no_tls1

This connects successfully with an SSLv3 Client Hello advertising support through SSL 3.0.

这通过 SSL 3.0 与 SSLv3 Client Hello 广告支持成功连接。

Incidentally, my local ruby does make a successful connection with open-urito your site:

顺便说一句，我的本地 ruby​​ 确实与open-uri您的站点建立了成功的连接：

$ irb
>> require 'open-uri'
=> true
>> open('https://aristo4stu3.bgu.ac.il')
=> #<StringIO:0x10271fa90>
>> require 'openssl'
=> false
>> OpenSSL::OPENSSL_VERSION
=> "OpenSSL 0.9.8r 8 Feb 2011"
>>

So the indicated approaches seem to be:

因此，指示的方法似乎是：

1. Upgrade the server to handle more Client Hello variants, or
2. Install a ruby that uses an older OpenSSL library, or
3. Change your program to send a different Client Hello.

1. 升级服务器以处理更多 Client Hello 变体，或
2. 安装使用旧 OpenSSL 库的 ruby​​，或
3. 更改您的程序以发送不同的 Client Hello。

It does not appear that the open-urimodule has an option to set the SSL/TLS version used to communicate. If you can't modify the server you may need to use a different module or library to establish the connection, or perhaps find a way to patch the opensslmodule so it uses a different Client Hello.

该open-uri模块似乎没有设置用于通信的 SSL/TLS 版本的选项。如果您无法修改服务器，您可能需要使用不同的模块或库来建立连接，或者找到一种方法来修补openssl模块，使其使用不同的 Client Hello。

回答by pcv

If you're on Mac and it's an OSX certificate issue (which was the case for me), you can fix it by running:

如果您使用的是 Mac 并且是 OSX 证书问题（我就是这种情况），您可以通过运行以下命令来修复它：

rvm osx-ssl-certs update all

See https://rvm.io/support/fixing-broken-ssl-certificates

请参阅https://rvm.io/support/fixing-broken-ssl-certificates

回答by Hopsoft

I found a good writeup of the problem & solution here. http://blog.55minutes.com/2012/05/tls-error-with-ruby-client-and-tomcat-server/

我在这里找到了有关问题和解决方案的好文章。http://blog.55minutes.com/2012/05/tls-error-with-ruby-client-and-tomcat-server/

TLDR code snippet that resolves the problem.

解决问题的 TLDR 代码片段。

http = Net::HTTP.new(host, port)
http.use_ssl = true
http.ssl_version = :SSLv3
http.start { ... }

回答by user1756254

I received the same message and it simply turned out I had http.use_ssl = trueset on a non SSL connection.

我收到了同样的消息，结果只是我http.use_ssl = true设置了非 SSL 连接。