CURL - Intermittent Error 35 - Unknown SSL protoco

问题:

I have a server running Rundeck to handle a large amount of various integration tasks. The scheduled tasks each make a curl request to a given URL on our intranet system - essentially Rundeck just runs a temporary bash script.

About 99% of the time, this works fine - but we're seeing curl fail intermittently with Error 35: Unknown SSL protocol error in connection.

I've tried specifying the ssl protocol explicitly, with a known-good protocol, but we're still experiencing the issue.

We have a pretty high volume of requests going out - I'm not sure if that could have something to do with it. There is a chance we could have ~3 curl processes running at any given time.

Any advice would be appreciated.

curl --version
curl 7.35.0 (x86_64-pc-linux-gnu) libcurl/7.35.0 OpenSSL/1.0.1f zlib/1.2.8 libidn/1.28 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3     pop3s rtmp rtsp smtp smtps telnet tftp 
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP 

回答1:

I've figured this out myself.

I ended up using wireshark to watch the communication on the server side of the SSL connection. The only anomaly I could see in the trace of the failures was that our Diffe-Hellman Public Key was 127 bytes, when typically it would be 128.
It looks like IIS didn't know how to handle this, and terminated the communication.

I'm not 100% clear on what the root cause of the issue was, but forcing a non-DH ssl cipher completely stopped the error messages.

Check This Article On Security.StackExchange For More Information