阿里云 ecs 上 etcd SSL reset

etcd ssl aliyun

字数统计: 646阅读时长: 3 min

 2025/02/14 

折腾一些时间的 etcd ssl reset 问题…..

由来

几年前的 120 块的腾讯云轻量应用服务器买了后再 240 块续费两年，快到期了后阿里云 90 快去买了一年。然后上面把我之前的 etcd 迁移过去了，证书当初生成的时候可以预留了 cert SAN 域名相关：

1
2
3

# openssl  x509 -in s1.pem -noout -text | grep -A1 'X509v3 Subject Alternative Name'
            X509v3 Subject Alternative Name: 
                DNS:localhost, DNS:xxx.com, IP Address:127.0.0.1, IP Address:10.0.x.x, IP Address:10.2.0.1

避免其他 etcd 客户端换证书的，一些非云上会用到该 etcd 的直接本地配置 hosts xxx.com ，这样后续 ecs 换 ip 了直接改 hosts 文件即可。

经过

过年放假之前 etcd 整到阿里云 ecs 上了，然后看着也正常，后面突然几个 agent 连不上 etcd，包括 curl 也有问题：

$ curl -v https://xxx.com:22379 --resolve xxx.com:22379:x.x.x.x
* Added xxx.com:22379:x.x.x.x to DNS cache
* Hostname xxx.com was found in DNS cache
*   Trying x.x.x.x:22379...
* TCP_NODELAY set
* Connected to xxx.com (x.x.x.x) port 22379 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to xxx.com:22379 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to xxx.com:22379

但是直接 ip 就没问题：

$ curl -v https://x.x.x.x:22379 --resolve xxx.com:22379:x.x.x.x
* Added xxx.com:22379:x.x.x.x to DNS cache
*   Trying x.x.x.x:22379...
* TCP_NODELAY set
* Connected to x.x.x.x (x.x.x.x) port 22379 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

这些日子没那么忙了就看了下，发现好几个地方网络访问都这样，根据排除法一定是阿里云有问题了。搜了下 aliyun ssl reset 搜到果然是阿里云有问题。访问阿里云 ecs 的流量会先进云盾，会根据 SSL 的 SNI 域名做判断，如果没备案则 tcp reset。无语了，我这又不是 80、8080、443 端口，没办法暂时用 IP 吧。