Skip to content

关于解决https 在ios 超时的问题 #786

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
100cm opened this issue May 14, 2020 · 10 comments
Closed

关于解决https 在ios 超时的问题 #786

100cm opened this issue May 14, 2020 · 10 comments

Comments

@100cm
Copy link
Contributor

100cm commented May 14, 2020

先自问自答：

1. 为什么出现这个问题？

答： OCSP Stapling 失效

2. 为什么IOS有问题，安卓没问题？

答： 因为谷歌不满意这个方案

3. 解决方案

1.换证书
2.

1. 使用 ssl_stapling_file 配置，从一个外部文件获取ocsp信息 ngx_ssl_stapling_file
2. 使用 ssl_stapling_responder配置，nginx会用这个设置覆盖证书里面的Authority Information Access信息，使得请求ocsp被发送到设置的服务器

这里推荐第二种，如果在多台机器上部署的话第一种比较麻烦

https://github.com/dlecorfec/ocsp-proxy
可以参考如下配置

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/ca-certs.pem;
ssl_stapling_responder http://YOUR_PROXY_IP:8080/;
  1. 如果是使用k8S + nginx-ingress 部署
    这是我自己亲测的解决方式

首先将 nginx-ingress 更新到 0.31+ 这里有相关的变动日志。关于部署的冲突可以自行判断。

  1. 如果是使用k8S + traefik 部署
    这个就要自己解决了😂

如何测试是否成功？

openssl s_client -connect ${host}:443 -servername ${host} -status -tlsextdebug < /dev/null 2>&1 | grep -i "OCSP response"

将其中的 ${host} 改成自己的域名即可

OCSP response:
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response

输出如上及说明已经解决了。

另外希望作者能够关注下我的另外一个formdata的问题。。不想自己本地改了。
@100cm 100cm mentioned this issue May 14, 2020
Closed
@100cm
Copy link
Contributor Author

100cm commented May 14, 2020

此情况目前测试下来是使用lets-encrypt的情况。

@droplet-js
Copy link

docker swarm + traefik 已经哭晕在厕所了 ...

@100cm
Copy link
Contributor Author

100cm commented May 21, 2020

docker swarm + traefik 已经哭晕在厕所了 ...

建议换证书。。快捷。

@droplet-js
Copy link

执行你的命令，返回是这样的是可以么？

OCSP response: no response sent

@droplet-js
Copy link

另外发现一个完整可以测试域名证书的 https://www.immuniweb.com/ssl/?id=pg21dT3w

@100cm
Copy link
Contributor Author

100cm commented May 21, 2020

不可以 正确的是我上面的

@droplet-js
Copy link

我这边换了证书后，还是'no response sent'，iOS 13上已经不在卡了

OCSP response: no response sent

@openmynet
Copy link

按下面的配置修好 OCSP Stapling 后问题还是没有得到缓解

lets-encrypt 基于acme.sh

server{
  listen 80;
  listen 443 ssl;
  ....
  ssl_certificate /var/.acme.sh/***/fullchain.cer;
  ...
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /var/.acme.sh/***/ca.cer; # 与 fullchain.cer位于相同目录
  resolver 8.8.8.8 8.8.4.4 valid=86400s; # dns
  resolver_timeout 5s;
}

验证方法1. 按@100cm的

export host = ***.com
openssl s_client -connect ${host}:443 -servername ${host} -status -tlsextdebug < /dev/null 2>&1 | grep -i "OCSP response"

验证方法2：
https://certificate.revocationcheck.com/***.com

两种方法都测试通过了，但是没有缓解，似乎不是不仅仅是 OCSP Stapling 的问题
目前的情况暂时还不清楚是app的原因还好https的原因，情况有待测试

@kevinfujiang
Copy link

openssl ocsp -no_nonce -respout ./ocsp_resp.der -issuer ./ca.cer -cert ./mycom.cer -url http://ocsp.int-x3.letsencrypt.org/ -header "HOST" "ocsp.int-x3.letsencrypt.org"
获取ocsp响应： ocsp_resp.der
然后配置到nginx上
ssl_stapling_file /usr/local/nginx/conf/cert/ocsp_resp.der;
nginx 重启后可以验证通过。

@stale
Copy link

stale bot commented Jul 11, 2020

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If this is still an issue, please make sure it is up to date and if so, add a comment that this is still an issue to keep it open. Thank you for your contributions.

@stale stale bot added the stale label Jul 11, 2020
@stale stale bot closed this as completed Jul 18, 2020
@HannibalKcc HannibalKcc mentioned this issue Oct 13, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@kevinfujiang @openmynet @droplet-js @100cm