Ich schliesse mich mal an ... exakt das gleiche Problem. DS-Lite mit Arris Modem.
curl -v https://bla.bla
* Rebuilt URL to: https://bla.bla/
* Trying 52.24.xx.xx...
* TCP_NODELAY set
* Connected to bla.bla (52.24.xx.xx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to bla.bla:443
* stopped the pause stream!
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to bla.bla:443
Zu fast.com geht es z.B. noch wenn man den ersten Redirect bekommt:
curl -v https://www.fast.com
* Rebuilt URL to: https://www.fast.com/
* Trying 104.109.79.74...
* TCP_NODELAY set
* Connected to www.fast.com (104.109.79.74) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: C=US; ST=California; L=Los Gatos; O=Netflix, Inc.; OU=Operations; CN=fast.com
* start date: Dec 3 00:00:00 2019 GMT
* expire date: Dec 3 12:00:00 2020 GMT
* subjectAltName: host "www.fast.com" matched cert's "www.fast.com"
* issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55d865355580)
> GET / HTTP/2
> Host: www.fast.com
> User-Agent: curl/7.58.0
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 301
< server: AkamaiGHost
< content-length: 0
< location: https://fast.com/
< cache-control: max-age=0
< expires: Sat, 21 Mar 2020 00:26:01 GMT
< date: Sat, 21 Mar 2020 00:26:01 GMT
< vary: Accept-Language
< strict-transport-security: max-age=31536000
<
* Connection #0 to host www.fast.com left intact
Nimmt man nun eine URL zu dem Inhalt vom eigentlichen Speedtest, dann geht es nicht:
curl -v 'https://api.fast.com/netflix/speedtest/v2?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=5'
* Trying 52.18.232.179...
* TCP_NODELAY set
* Connected to api.fast.com (52.18.232.179) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to api.fast.com:443
... und dann ist wieder Schluss.
Das gleiche zu api.fast.com selbst:
curl -v https://api.fast.com
* Rebuilt URL to: https://api.fast.com/
* Trying 54.154.202.35...
* TCP_NODELAY set
* Connected to api.fast.com (54.154.202.35) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to api.fast.com:443
Ueber eine andere Verbindung habe ich mal geguckt was an den Sites anders ist. Fast.com macht TLS 1.2 mit ECDHE-RSA-AES256-GCM-SHA384.
Die kaputten Seiten ('bla.bla' und api.fast.com) hingegen nur ECDHE-RSA-AES128-GCM-SHA256.
Mit openssl kann man das wunderbar selbst testen:
openssl s_client -connect api.fast.com:443
CONNECTED(00000005)
... und dann gibt es ein timeout. Erzwingt man AES256 geht es:
openssl s_client -connect api.fast.com:443 -tls1_2 -cipher ECDHE-RSA-AES256-GCM-SHA384 -reconnect
CONNECTED(00000005)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
verify return:1
depth=0 C = US, ST = California, L = Los Gatos, O = "Netflix, Inc.", OU = Operations, CN = api.fast.com
verify return:1
---
Certificate chain
0 s:C = US, ST = California, L = Los Gatos, O = "Netflix, Inc.", OU = Operations, CN = api.fast.com
i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
1 s:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGqDCCBZCgAwIBAgIQAfX2fg7CiUk6U8YiA7PP1zANBgkqhkiG9w0BAQsFADBN
...
Blockt da die liebe Vodafone die alten cipher suites?
