代码之家 › 专栏 › 技术社区 › Pensu

连接到主机的SSL验证失败

rackspace chef-infra openssl amazon-web-services ssl

Pensu · 技术社区 · 11 年前

我正在尝试在厨师服务器上上传一些食谱。我使用我的笔记本电脑作为工作站,使用opscode.com的托管厨师作为厨师服务器。现在,当我尝试将烹饪书从工作站上传到厨师服务器时,我收到以下错误:

错误:连接到主机时SSL验证失败:s3-external-1.amazonaws.com-SSL_connect返回=6 errno=0 state=SSLv3读取完成A 错误:OpenSSL::SSL::SSLError:SSL_connect returned=6 errno=0 state=SSLv3 read finished A

我正在使用rackspace私有云的食谱: http://www.rackspace.com/knowledge_center/article/installing-openstack-with-rackspace-private-cloud-tools

我正在使用烹饪书v4.2.1。请帮我解决这个问题。

谢谢

2 回复 | 直到 11 年前

Kyle Kelley 11 年前

错误:连接到主机时SSL验证失败: s3-external-1.amazonaws.com-SSL_connect返回=6错误号=0 state=SSLv3读取完成A错误:OpenSSL::SSL::SSLError:SSL_connect 返回=6错误号=0状态=SSLv3读取完成A

对我有用。

确保您拥有并信任 Class 3 Public Primary Certification Authority 。你可以得到 第3类公共初级认证机构 来自赛门铁克 Licensing and Use of Root Certificates 。特别是,fetch Root 3 VeriSign Class 3 Primary CA - G5 .

然后,使用OpenSSL进行测试 s_client 。您下载并信任的根是 PCA-3G5.pem ,然后通过 -CAfile 选项:

$ openssl s_client -CAfile PCA-3G5.pem -connect s3-external-1.amazonaws.com:443
CONNECTED(00000003)
depth=3 C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
verify return:1
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify return:1
depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = Terms of use at https://www.verisign.com/rpa (c)10, CN = VeriSign Class 3 Secure Server CA - G3
verify return:1
depth=0 C = US, ST = Washington, L = Seattle, O = Amazon.com Inc., CN = *.s3-external-1.amazonaws.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Washington/L=Seattle/O=Amazon.com Inc./CN=*.s3-external-1.amazonaws.com
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
 1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
 2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
...
    Start Time: 1392896325
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

foch 10 年前

如果您只是在做一个临时测试,可以通过在 刀.rb 文件:

verify_api_cert false
ssl_verify_mode :verify_none

但同样,如果您要设置一个真实的服务器,您应该获得一个真实证书:)