禁用SSLv3中的cURL？

Question

我在连接到一个使用CloudFlare使用cURL托管的网站时遇到了问题。当我尝试用HTTPS (使用curl -v https://www.xxxxxx.com)连接到网站时，它说：

* About to connect() to www.xxxxxx.com port 443 (#0)
*   Trying 2400:cb00:2048:1::681c:116e...
* Connected to www.xxxxxx.com (2400:cb00:2048:1::681c:116e) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Error in TLS handshake, trying SSLv3...
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.xxxxxx.com
> Accept: */*
>
* Connection died, retrying a fresh connect
* Closing connection 0
* Issue another request to this URL: 'https://www.xxxxxx.com'
* About to connect() to www.xxxxxx.com port 443 (#1)
*   Trying 2400:cb00:2048:1::681c:116e...
* Connected to www.xxxxxx.com (2400:cb00:2048:1::681c:116e) port 443 (#1)
* TLS disabled due to previous handshake failure
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Closing connection 1
curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

关于这个问题，我联系了CloudFlare，他们说这是因为cURL试图使用SSLv3进行连接，并且由于贵宾狗的漏洞而禁用了它。我能够连接cURL v7.38.0在FreeBSD 10上没有问题，但与cURL v7.29.0在CentOS 6.5。

如果是因为它试图连接到SSLv3，那么如何在cURL上禁用SSLv3？或者是别的什么东西？

Answer 1

这个问题似乎是由于cURL版本不支持ECC256位SSL证书和ECDSA签名算法(由CloudFlare使用)造成的。您可以通过运行以下命令来测试您的cURL版本是否支持此加密：

curl -1IsS --ciphers ecdhe_ecdsa_aes_128_sha https://sslspdy.com

如果您得到以下内容，那么您的cURL就过时了：

curl: (59) Unknown cipher in list: ecdhe_ecdsa_aes_128_sha

否则，如果它连接并且不显示错误，那么它就是最新的。

由于CentOS在应用于其包之前似乎会对更新进行彻底的筛选，因此很难确定何时会修复这些更新。解决这一问题的唯一方法是更新cURL，传递-k或--insecure将无法工作。