我应该怎么做才能知道 SSL 是否正常工作？

Question

我正在使用 NGINX，我只是设置了一个域和子域，我需要在这两个域上都使用 SSL。

查看子域的服务器块

server {

   listen 80;
   listen 443 ssl;
   server_name www.desktop.just4bettors.mobi  desktop.just4bettors.mobi;
   root   /home/c0pt/capilleira/capilleiraclickandgambleweb/dist;

   ssl_certificate      /etc/ssl/certs/just4bettors.mobi.chained.crt;
   ssl_certificate_key  /etc/ssl/private/just4bettors.mobi.key;

   ssl_session_cache    shared:SSL:1m;
   ssl_session_timeout  5m;

   ssl_ciphers  HIGH:!aNULL:!MD5;
   ssl_prefer_server_ciphers  on;

   location / {
        index index.html index.htm;
        ...
   }

}

如果我进入该子域，一切正常，但是，我应该如何知道 SSL 是否已设置？

Answer 1

您可以运行以下测试：

1. telnet $server_ip 443

   这将告诉您该端口中是否有东西在侦听

   telnet desktop.just4bettors.mobi 443
   Trying xxx.xxx.xx.xxx...
   Connected to desktop.just4bettors.mobi.
   Escape character is '^]'.
   ^]
   telnet> q
   Connection closed.
   

2. openssl s_client -connect $server_ip:443 -showcerts

   这实际上将查询服务并检索证书，您也应该能够检查信任链openssl。

   openssl s_client -connect desktop.just4bettors.mobi:443
   CONNECTED(00000003)
   depth=3 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
   verify return:1
   depth=2 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2
   verify return:1
   depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
   verify return:1
   depth=0 OU = Domain Control Validated, CN = *.just4bettors.mobi
   verify return:1
   ---
   Certificate chain
    0 s:/OU=Domain Control Validated/CN=*.just4bettors.mobi
      i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
    1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2
      i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root  Certificate Authority - G2
    2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
      i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
    3 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
      i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
   ---
   Server certificate
   -----BEGIN CERTIFICATE-----
   xxxxx
   

3. 使用第三方服务，例如SSL Labs提供的服务