SSL会话建立是否支持特定TLS版本？TLS1.0检测结果矛盾排查

问题1：若SSL会话已建立，是否意味着服务器支持特定版本的TLS？ #

不一定。显示“SSL会话已建立”可能仅代表TCP连接成功，但TLS握手过程可能并未完整完成。比如你遇到的场景，虽然输出了CONNECTED，但握手阶段出现了内部错误，最终未协商出可用的加密套件，这种情况下服务器并不真正支持该TLS版本。只有当握手完全完成，协商出有效的加密套件（Cipher字段不为0000或NONE），才能确认服务器支持对应TLS版本。

问题2：OpenSSL检测与SSL Labs结果不一致的原因分析 #

你执行的检测命令：

openssl s_client -connect test.server.cloud:443 -servername test.server.cloud -tls1

输出中存在关键错误信息：

E81F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:ssl\statem\statem_clnt.c:2252:

这表明TLS握手在密钥交换阶段失败，虽然SSL-Session里显示Protocol : TLSv1，但Cipher : 0000、Master-Key为空，说明会话并未真正建立成功。

可能的原因及解决方向 #

• OpenSSL版本兼容问题：你使用的OpenSSL版本可能不支持服务器（或前端中间设备）启用的TLS 1.0加密套件，导致握手失败。尝试更新OpenSSL到较新版本后重新测试。
• Apache配置未生效：尽管你已禁用TLS 1.0，但可能存在配置未重载、虚拟主机配置覆盖全局设置等情况。可通过apachectl -t -D DUMP_VHOSTS检查虚拟主机配置，确认TLS 1.0是否确实被禁用。
• 前端中间设备干扰：服务器前端的负载均衡、WAF等设备可能仍启用了TLS 1.0，SSL Labs扫描的是这些中间设备的配置，而非后端Apache的实际设置。需要检查前端设备的TLS版本配置。

另外，SSL Labs使用的客户端支持更多TLS 1.0加密套件，因此能成功握手；而你的OpenSSL客户端不支持服务器（或中间设备）启用的套件，导致检测结果不一致。

附OpenSSL命令输出 #

CONNECTED(00000140)
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = *.server.cloud
verify return:1
E81F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:ssl\statem\statem_clnt.c:2252:
---
Certificate chain
 0 s:CN = *.server.cloud
   i:C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Feb  2 15:55:04 2022 GMT; NotAfter: Feb 27 07:09:10 2023 GMT
 1 s:C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
   i:C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: May  3 07:00:00 2011 GMT; NotAfter: May  3 07:00:00 2031 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
*********************************
*********************************
-----END CERTIFICATE-----
subject=CN = *.server.cloud
issuer=C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
---
No client certificate CA names sent
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3350 bytes and written 148 bytes
Verification error: unable to get local issuer certificate
---
New, (NONE), Cipher is (NONE)
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID: 42430000BACE6D963C2154287E5949A5BCEA93B1E8895F656FD8AF82FAF41625
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1663242412
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    Extended master secret: yes
---

内容的提问来源于stack exchange，提问作者Sameer