curl: (35) SSL connect error

Question

[root@vagrant-centos65 you-get]# curl -v https://api.xxx.cn
* About to connect() to api.xxx.cn port 443 (#0)
*   Trying 123.xxx.xx.xx... connected
* Connected to api.xxx.cn (123.xxx.xx.xx) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error
[root@vagrant-centos65 you-get]#

[root@vagrant-centos65 you-get]# curl --version
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp
Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz

Answer 1

CentOS release 6.7 (Final) 遇到同样问题

# curl -v https://cisofy.com/download/lynis
* About to connect() to cisofy.com port 443 (#0)
*   Trying 37.97.224.115... connected
* Connected to cisofy.com (37.97.224.115) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error

# ll /etc/pki/nssdb
total 124K
-rw-r--r--. 1 root root  64K 2010-01-13 04:09 cert8.db
-rw-r--r--. 1 root root 9.0K 2010-01-13 05:18 cert9.db
-rw-r--r--. 1 root root  16K 2010-01-13 05:21 key3.db
-rw-r--r--. 1 root root  11K 2010-01-13 05:20 key4.db
-rw-r--r--. 1 root root  451 2016-03-24 00:54 pkcs11.txt
-rw-r--r--. 1 root root  16K 2010-01-13 04:45 secmod.db

但是 wget 正常

# wget https://cisofy.com/download/lynis -O /tmp/lynis.html
--2017-03-23 11:41:40--  https://cisofy.com/download/lynis
Resolving cisofy.com... 37.97.224.115, 2a01:7c8:aac4:309::1
Connecting to cisofy.com|37.97.224.115|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: /download/lynis/ [following]
--2017-03-23 11:41:42--  https://cisofy.com/download/lynis/
Connecting to cisofy.com|37.97.224.115|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: “/tmp/lynis.html”

    [ <=>               ] 16,896      --.-K/s   in 0s      

2017-03-23 11:41:44 (106 MB/s) - “/tmp/lynis.html” saved [16896]

CentOS Linux release 7.2.1511 (Core) 没有问题

# curl -v  https://cisofy.com/download/lynis
* About to connect() to cisofy.com port 443 (#0)
*   Trying 37.97.224.115...
* Connected to cisofy.com (37.97.224.115) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*     subject: CN=cisofy.com,OU=IT,O=CISOfy,L=Vlijmen,ST=Noord-Brabant,C=NL,serialNumber=59010347,businessCategory=Business Entity,incorporationCountry=NL
*     start date: 1月 03 00:00:00 2017 GMT
*     expire date: 3月 04 23:59:59 2019 GMT
*     common name: cisofy.com
*     issuer: CN=GeoTrust EV SSL CA - G4,O=GeoTrust Inc.,C=US
> GET /download/lynis HTTP/1.1
> User-Agent: curl/7.29.0
> Host: cisofy.com
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
.......


# ll /etc/pki/nssdb
total 124
-rw-r--r--  1 root root 65536 2016-01-08 02:03 cert8.db
-rw-r--r--. 1 root root  9216 2015-11-09 09:36 cert9.db
-rw-r--r--  1 root root 16384 2016-01-08 02:03 key3.db
-rw-r--r--. 1 root root 11264 2015-11-09 09:36 key4.db
-rw-r--r--  1 root root   451 2016-01-08 02:03 pkcs11.txt
-rw-r--r--  1 root root 16384 2016-01-08 02:03 secmod.db

问题可能是 curl 版本，或者 NSS DB 的版本，但是手工复制 Centos7 的 nssdb 到 Centos6，问题依旧。

我一个脚本需要curl https://cisofy.com/download/l... ，只好临时用 wget 了。