Ubuntu更新CURL至USN-6237-1版本后出现SSL证书主体名称不匹配问题的解决咨询

最近在Ubuntu上把CURL更新到USN-6237-1版本后，我们遇到了SSL证书验证失败的问题——昨天还能正常运行的命令今天突然报错了。具体操作和错误信息如下：

执行的命令 #

sudo apt update -y && sudo apt install --no-install-recommends -y curl
curl -vvv https://downloads.apache.org/maven/maven-3/3.8.8/binaries/

错误输出 #

*   Trying 88.99.95.219:443...
* Connected to downloads.apache.org (88.99.95.219) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS header, Certificate Status (22):
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.2 (IN), TLS header, Finished (20):
{ [5 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [25 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [4583 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.2 (OUT), TLS header, Finished (20):
} [5 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=*.apache.org
*  start date: Jun 29 00:00:00 2022 GMT
*  expire date: Jul 30 23:59:59 2023 GMT
*  subjectAltName does not match downloads.apache.org
* SSL: no alternative certificate subject name matches target host name 'downloads.apache.org'
* Closing connection 0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
} [5 bytes data]
* TLSv1.3 (OUT), TLS alert, close notify (256):
} [2 bytes data]
curl: (60) SSL: no alternative certificate subject name matches target host name 'downloads.apache.org'
More details here: https://curl.se/docs/sslcerts.html

我们想知道该如何解决这个问题？是不是从现在开始需要手动管控第三方证书了？麻烦各位帮忙解答，谢谢！

可能的解决思路 #

• 优先排查目标服务器证书问题：从错误日志来看，核心问题是服务器返回的证书subjectAltName不匹配downloads.apache.org。这大概率是目标服务器的证书配置临时异常，你可以先尝试访问该域名的其他路径，或者等待一段时间，看是否是Apache侧的临时故障导致的。
• 测试场景临时绕过验证（不推荐生产）：如果只是临时测试需求，可以添加--insecure参数跳过证书验证，但这会忽略安全风险，命令如下：

curl -vvv --insecure https://downloads.apache.org/maven/maven-3/3.8.8/binaries/

• 更新本地CA证书存储：虽然报错指向域名不匹配，但也可以尝试重置本地CA证书，确保系统信任的根证书是最新的：

sudo apt update && sudo apt install --reinstall ca-certificates

• 回退CURL版本：如果确定是USN-6237-1的更新引入的问题，可以尝试回退到之前的版本。先查看已安装的版本：

apt list --installed | grep curl

然后指定旧版本号安装（替换<旧版本号>为实际版本）：

sudo apt install curl=<旧版本号>

⚠️ 注意：回退版本可能会丢失安全补丁，需要权衡安全风险后再操作。

备注：内容来源于stack exchange，提问作者Sergei Varaksin