Nginx 入口控制器如何在 SSL 握手时修复 SSL_do_handshake tls_process_client_hello:version 太低）

Question

在我的 kubernetes Ingress 控制器中记录了很多这样的握手消息。如何停止此错误消息？它出现了来自 pod 127.0.0.1

中的请求

2018/09/15 13:28:28 [crit] 21472#21472: *323765 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323766 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323767 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323768 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442
2018/09/15 13:28:28 [crit] 21472#21472: *323769 SSL_do_handshake() failed (SSL: error:1417D18C:SSL routines:tls_process_client_hello:version too low) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:442

这是入口参数。

 - args:
        - /nginx-ingress-controller
        - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
        - --configmap=$(POD_NAMESPACE)/nginx-configuration
        - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
        - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
        - --publish-service=$(POD_NAMESPACE)/ingress-nginx
        - --annotations-prefix=nginx.ingress.kubernetes.io
        - --enable-ssl-chain-completion=false
        - --default-ssl-certificate=ingress-nginx/ingress-tls-secret
        - --enable-ssl-passthrough

谢谢

Answer 1

我的问题是我设置为 ssl-hello-chk 的 HAPROXY 运行状况检查配置，现在我将其更改为 tcp-check 错误消息已停止。

改变这个：

mode tcp             
balance leastconn    
option ssl-hello-chk

到

 mode tcp         
 balance leastconn
 option tcp-check

Nginx 入口控制器如何在 SSL 握手时修复 SSL_do_handshake tls_process_client_hello:version 太低）

Nginx ingress controller how to fix SSL_do_handshake tls_process_client_hello:version too low) while SSL handshaking

nginx

kubernetes

nginx-ingress