如题，今天无法在命令行访问自己的网站，故 curl https://blog.cxzlw.top，得到如下结果
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
随后 openssl s_client -connect blog.cxzlw.top:443 -showcerts 发现：
Certificate chain
0 s:CN=cxzlw.top
i:C=US, O=CLOUDFLARE, INC., CN=Cloudflare TLS Issuing ECC CA 1
a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA256
v:NotBefore: Jun 12 20:44:39 2025 GMT; NotAfter: Sep 10 20:50:19 2025 GMT
1 s:C=US, O=CLOUDFLARE, INC., CN=Cloudflare TLS Issuing ECC CA 1
i:C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2
a:PKEY: EC, (prime256v1); sigalg: ecdsa-with-SHA384
v:NotBefore: Oct 31 17:17:49 2023 GMT; NotAfter: Oct 28 17:17:48 2033 GMT
2 s:C=US, O=SSL Corporation, CN=SSL.com TLS Transit ECC CA R2
i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
a:PKEY: EC, (secp384r1); sigalg: sha256WithRSAEncryption
v:NotBefore: Jun 21 00:00:00 2024 GMT; NotAfter: Dec 31 23:59:59 2028 GMT
注意这里的 AAA Certificate Services 已经自今年 4 月 5 日被弃用 Enhancements to Root CA and Hierarchies - Sectigo
网络搜寻关键词 cloudflare AAA Certificate Services 发现类似情况
14 条回复 • 2025-07-16 18:21:13 +08:00
 |
1
busier 12 天前 via Android
域名被劫持了？中间人攻击？
|
 |
2
cnrting 12 天前 via iPhone
没问题啊
|
 |
4
superrichman 12 天前
certifi 什么版本？
python -c "import certifi; print(certifi.__version__)" |
 |
6
cxzlw OP @superrichman 2024.02.02
|
|
7
cxzlw OP @superrichman 不对，跑错机子了，这个环境是 2025.07.09
|
 |
8
salmon5 12 天前
老问题了，curl 不会自动下载中间证书；
Chrome/Edge/IE 会自动下载中间证书； FF 不会自动下载中间证书，但是它打了个补丁： https://bugzilla.mozilla.org/show_bug.cgi?id=1966632 |
|
9
salmon5 12 天前
CF 的老证书链根证书 AAA Certificate Services 被移除:
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_111.html https://bugzilla.mozilla.org/show_bug.cgi?id=1957685 ca-certificates 又依赖 NSS 新的证书链又缺失了：SSL.com TLS Transit ECC CA R2 |
|
10
salmon5 12 天前
Cloudflare 这个事情处理的相当不专业；当然这也是商业 SSL 证书的价值
|
 |
12
JensenQian 11 天前
不行用 cf 的 api 切成谷歌或者别的
|
|
13
cxzlw OP @JensenQian 研究了一下，没懂要怎么切换，方便教教咱吗
|
Select Language