OpenSSL 1.1.1d版本curl触发TLS 1.3握手失败，1.0.1t版本访问正常

基础环境说明 #

• 故障侧运行环境：curl 7.64.0 (x86_64-pc-linux-gnu)，配套依赖libcurl/7.64.0 OpenSSL/1.1.1d，访问目标服务时触发SSL握手失败
• 正常侧运行环境：curl 7.38.0 (x86_64-pc-linux-gnu)，配套依赖libcurl/7.38.0 OpenSSL/1.0.1t，相同目标服务可正常完成通信

分场景运行日志 #

故障场景运行日志 #

CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

正常场景运行日志 #

* Connected to kafkaconnect-0.kc.default.svc.cluster.local (10.244.4.107) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / DHE-DSS-AES256-GCM-SHA384
* Server certificate:
*    subject: CN=*.kc.default.svc.cluster.local.keystore.jks
*    start date: 2021-04-16 17:01:03 GMT
*    expire date: 2023-04-16 17:01:03 GMT
*    issuer: CN=Red-Security-CA
*    SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
> GET /connectors HTTP/1.1
> User-Agent: curl/7.38.0

故障触发逻辑对比 #

• 协议协商逻辑差异：OpenSSL 1.1.1d 默认启用TLS1.3支持，客户端发出的Client Hello直接携带TLS1.3协商标识；OpenSSL 1.0.1t 原生无TLS1.3支持，客户端发出的Client Hello最高仅能协商至TLS1.2版本
• 握手中断节点差异：故障侧握手推进到Encrypted Extensions阶段时，即收到服务端返回的握手失败告警；正常侧完整走完证书交换、密钥协商、会话校验全流程，最终协商使用的加密套件为TLSv1.2 / DHE-DSS-AES256-GCM-SHA384
• 核心触发逻辑：目标服务端不支持TLS1.3协议，且未对TLS1.3格式的Client Hello做兼容降级，同时无法匹配OpenSSL 1.1.1d客户端默认启用的密码套件、TLS1.3要求的签名算法或扩展字段，直接在握手阶段返回告警中断连接

根因验证操作 #

在故障侧客户端执行强制限定最高TLS版本为1.2的命令：
curl -v --tlsv1.2 --tls-max 1.2 https://kafkaconnect-0.kc.default.svc.cluster.local:443/connectors
命令执行后若握手流程恢复正常，即可确认故障由不同OpenSSL版本的默认协议支持范围差异导致。

内容的提问来源于stack exchange，提问作者SunilS