【发布时间】：2015-07-16 14:49:56
【问题描述】：
我们在 azure 中托管一个网站。我们托管的服务有 6 个实例。在该服务上，我们添加了一个涵盖该站点的证书，并且具有如下所示的身份验证链：
our certificate
Comodo RDAOrganisation Validation Secure Server CA (2014 - 2029)
Comodo RSA certification Authority (2000 - 2020)
USERTrust (2000 - 2020)
我们可以在浏览器中看到我们发出的任何请求，该链似乎正确存在并且 SSL 握手可以完成。
我们有一位客户报告说他们在远程连接到我们时遇到了一些问题。他们一直在使用 openssl 来尝试验证它的来源。
我的知识在解释此输出时出现问题，我想知道您是否可以帮助发现差异或确定下一步 - 无论是为我们还是我们的客户。
运行的命令是
$ openssl s_client -CApath /etc/ssl/certs/ -connect <our service uri>
成功案例的输出：
CONNECTED(00000003)
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root verify return:1
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Organization Validation Secure Server CA verify return:1
depth=0 C = DK, <certificate information pertianing to our company >
---
Certificate chain
0 s:/C=DK/<certificate information pertianing to our company >
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
Server certificate
-----BEGIN CERTIFICATE-----
Key is the same between both requests
-----END CERTIFICATE-----
subject=/C=DK/<certificate information pertianing to our company >
issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 5052 bytes and written 509 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-SHA384
Session-ID: <session id hidden>
Session-ID-ctx:
Master-Key: <key hidden>
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1436543517
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
在不成功的情况下：
CONNECTED(00000003)
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Organization Validation Secure Server CA verify error:num=20:unable to get local issuer certificate verify return:0
---
Certificate chain
0 s:/C=DK/<certificate information pertianing to our company >
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
Key is the same between both requests
-----END CERTIFICATE-----
subject=/C=DK/<certificate information pertianing to our company >
issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
---
No client certificate CA names sent
---
SSL handshake has read 3649 bytes and written 509 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-SHA384
Session-ID: <session id hidden>
Session-ID-ctx:
Master-Key: <key hidden>
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1436543605
Timeout : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)
---
我可以看到这些是不同的，我可以看到深度场是不同的，（我不确定这意味着什么，但假设这表明身份验证链 openssl 有多远）。我还可以看到，成功案例和不成功案例的链条本身似乎有所不同，并添加了
2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
我的问题是什么会导致这种情况发生，这是服务器问题还是用户问题（特别是请记住，对于大多数用户的大多数请求，这似乎工作得很好），我们是否需要采取确定问题的任何后续步骤？
感谢您的宝贵时间:)
【问题讨论】：
标签： azure iis openssl ssl-certificate certificate-authority