Nginx由于TLS支持版本配置过低造成不能够正常访问Upstream服...

terte

Nginx由于TLS支持版本配置过低造成不能够正常访问Upstream服务器的问题                                                                                                                        打开Nginx错误日志，发现报了n多条错误：
1818/83/88 15:38:83 [crit] 16145#8: 3489687 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 118.188.118.113, server: 8.8.8.8:443
1818/83/88 15:38:83 [crit] 16143#8: 3489831 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.116.111.54, server: 8.8.8.8:443
1818/83/88 15:38:58 [crit] 16147#8: 3411814 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 181.187.111.141, server: 8.8.8.8:443
1818/83/88 15:39:15 [crit] 16148#8: 3418988 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 61.178.189.183, server: 8.8.8.8:443
1818/83/88 15:39:46 [crit] 16144#8: 3437445 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 61.178.176.51, server: 8.8.8.8:443
1818/83/88 15:39:46 [crit] 16143#8: 3437586 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 114.114.188.186, server: 8.8.8.8:443
1818/83/88 15:39:58 [crit] 16141#8: 3448651 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 58.11.118.98, server: 8.8.8.8:443
1818/83/88 15:48:33 [crit] 16148#8: 3449569 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.1.63.78, server: 8.8.8.8:443
1818/83/88 15:48:48 [crit] 16144#8: 3454868 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 117.31.181.138, server: 8.8.8.8:443
1818/83/88 15:48:58 [crit] 16147#8: 3456681 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 117.31.181.138, server: 8.8.8.8:443
1818/83/88 15:41:81 [crit] 16145#8: 3457117 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 61.134.61.5, server: 8.8.8.8:443
1818/83/88 15:41:13 [crit] 16148#8: 3468513 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 61.134.61.5, server: 8.8.8.8:443
1818/83/88 15:41:19 [crit] 16143#8: 3461181 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 116.116.94.5, server: 8.8.8.8:443
1818/83/88 15:41:18 [crit] 16148#8: 3461488 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.189.181.34, server: 8.8.8.8:443
1818/83/88 15:41:11 [crit] 16145#8: 3461496 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 116.116.94.5, server: 8.8.8.8:443
1818/83/88 15:41:14 [crit] 16145#8: 3463399 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 36.188.113.148, server: 8.8.8.8:443
1818/83/88 15:41:39 [crit] 16147#8: 3467137 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.118.13.178, server: 8.8.8.8:443
1818/83/88 15:41:41 [crit] 16148#8: 3467879 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.189.181.34, server: 8.8.8.8:443
1818/83/88 15:41:45 [crit] 16143#8: 3468518 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.189.181.34, server: 8.8.8.8:443
1818/83/88 15:41:87 [crit] 16148#8: 3474471 SSL_do_handshake() failed (SSL: error:14876181:SSL routines:SSL13_GET_CLIENT_HELLO:unsupported protocol) while SSL handshaking, client: 111.118.13.178, server: 8.8.8.8:443
SSL_do_handshake() failed (SSL: error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:SSL alert number 70) while SSL handshaking
应该是协议的版本号的问题，经查，是由于Nginx要访问的upstream服务器的TLS的版本已经进行了升级，而nginx的配置中并没有对支持的TLS协议进行升级。
随着SSLv3 SSLv2协议的众多漏洞与诟病，已经很多浏览器默认不再支持此协议，以上的错误也说明了upstream服务器已经不再支持这两种协议，两端进行TLS协议的握手，只有版本号一致才能够成功，那么则在nginx端也必须配置与upstream服务器一致的版本号，则修改nginx的配置文件nginx.conf，修改如下：
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
重新启动nginx服务器后，即可以顺利地访问upstream端的服务了。