我做：
openssl s_client -connect website.com:443 -tls1_1
并得到：
CONNECTED(00000003) 140120601777808:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1315:SSL alert number 40 140120601777808:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:637: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1495200033 Timeout : 7200 (sec) Verify return code: 0 (ok) ---
testingTLS 1.0时，我也得到了类似的东西。
但是，testingTLS 1.2 是成功的
网站configuration（nginx）包括：
server { listen 443 ssl; listen [::]:443 ssl; server_name website.com www.website.com; root /var/www/public/website.com; error_log /var/www/nginx.error.log; ssl_certificate /etc/letsencrypt/live/website.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/website.com/privkey.pem; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits ssl_dhparam /etc/nginx/dhparam.pem; # modern configuration. tweak to your needs. ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers '*EDITED*; ssl_prefer_server_ciphers on; # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) add_header Strict-Transport-Security max-age=15768000; # OCSP Stapling --- # fetch OCSP records from URL in ssl_certificate and cache them ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /etc/letsencrypt/live/website.com/fullchain.pem; resolver 8.8.8.8 8.8.4.4; [...]
不知道发生了什么事！ 有什么build议么？
谢谢！
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers '*EDITED*;
虽然根据协议TLS 1.0 1.2被服务器支持，但问题可能是一组密码，遗憾的是这些密码没有详细显示。 有几个密码是用TLS 1.2定义的，只能用于TLS 1.2，尤其是所有使用SHA-256或SHA-384作为HMAC的密码。 如果只有这些密码被服务器接受，那么这隐含地意味着只接受TLS 1.2协议。
例如， Mozilla SSLconfiguration生成器当前显示的现代configuration文件仅包含TLS 1.2或更高版本提供的密码，因此不能与旧版TLS协议版本一起使用。