https 页面使用 http 资源导致的 https 告警 - V2EX
V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
egen
V2EX    V2EX

https 页面使用 http 资源导致的 https 告警

  •  
  •   egen 2014-11-25 18:42:50 +08:00 5301 次点击
    这是一个创建于 4050 天前的主题,其中的信息可能已经有所发展或是发生改变。
    目前发现有两种情况:
    1. 使用新浪图床的时候
    2. 程序员页面右边栏引用的亚马逊图片资源

    经检查这新浪图床和亚马逊的图片链接都是支持 https 方式访问,能否处理一下?
    18 条回复    2015-02-15 20:43:43 +08:00
    kmvan
        1
    kmvan  
       2014-11-25 18:50:18 +08:00
    果然,想不到渣浪也支持 https 图片。果断更新图床
    Livid
        2
    Livid  
    MOD
    PRO
       2014-11-25 18:57:15 +08:00
    收到,现在处理。
    0x142857
        3
    0x142857  
       2014-11-25 18:57:33 +08:00
    egen
        4
    egen  
    OP
       2014-11-25 19:09:25 +08:00
    @0x142857
    我这边显示是正常的

    aaaa007cn
        5
    aaaa007cn  
       2014-11-25 20:26:57 +08:00
    @egen

    从日本某服务器
    > curl -I -v -k
    * Server certificate:
    * subject: /C=CN/O=Sinorail Certification Authority/OU=\x94\xC1\x8D\xEF[\xA2b7g\x0DR\xA1N-_\xC3/CN=kyfw.12306.cn
    * start date: 2014-05-26 01:44:36 GMT
    * expire date: 2019-05-25 01:44:36 GMT
    * common name: kyfw.12306.cn (does not match 'ww3.sinaimg.cn')
    * issuer: /C=CN/O=Sinorail Certification Authority/CN=SRCA
    < HTTP/1.1 200 OK
    这证书……
    本地电信也一样是这张证书

    另一个日本 ip
    > curl -I -v -k
    * Server certificate:
    * subject: C=SG; ST=Some-State; L=Singapore; O=Thunderbird CDN; CN=Thunderbird CDN
    * start date: 2011-11-09 21:54:17 GMT
    * expire date: 2012-11-08 21:54:17 GMT
    * issuer: C=SG; ST=Some-State; L=Singapore; O=Thunderbird CDN; CN=Thunderbird CDN
    * SSL certificate verify result: self signed certificate (18), continuing anyway.
    < HTTP/1.1 404 Not Found
    自签 + 过期 + 404

    aws
    > curl -I -v -k
    * Server certificate:
    * subject: CN=ssl.cdngc.net,O=CDNetworks Inc.,L=San Jose,ST=California,C=US
    * start date: Feb 17 00:00:00 2014 GMT
    * expire date: Mar 09 12:00:00 2016 GMT
    * common name: ssl.cdngc.net
    * issuer: CN=DigiCert High Assurance CA-3,OU=www.digicert.com,O=DigiCert Inc,C=US
    < HTTP/1.1 403 Forbidden
    403
    wwqgtxx
        6
    wwqgtxx  
       2014-11-25 20:27:20 +08:00 via Android
    @0x142857 我这里也正常,用uc浏览器
    wwqgtxx
        7
    wwqgtxx  
       2014-11-25 20:29:04 +08:00 via Android
    jasontse
        8
    jasontse  
       2014-11-25 20:29:20 +08:00 via Android
    @aaaa007cn
    @egen
    我这里证书也没问题
    wwqgtxx
        9
    wwqgtxx  
       2014-11-25 20:30:21 +08:00 via Android
    aaaa007cn
        10
    aaaa007cn  
       2014-11-25 21:14:52 +08:00
    @wwqgtxx
    @jasontse
    @egen

    使用 114.114.114.114 解析 ww3.sinaimg.cn 拿到 122.228.117.169
    $ curl https://122.228.117.169/large/ad14ad59jw1emnimmgt62j20k00zk0ux.jpg -v -I -k
    * Server certificate:
    * subject: C=CN; ST=Beijing; L=Beijing; O=Sina.com Technology(China)Co.,ltd; OU=Sina.com Technology(China)Co.,ltd; CN=*.sinaimg.cn
    * start date: 2014-06-25 00:00:00 GMT
    * expire date: 2016-06-24 23:59:59 GMT
    * common name: *.sinaimg.cn (does not match '122.228.117.169')
    * issuer: C=US; O=GeoTrust Inc.; CN=GeoTrust SSL CA - G2
    * SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
    这次的证书终于对了……
    cst4you
        11
    cst4you  
       2014-11-25 21:40:34 +08:00
    curl -I -v -k
    * About to connect() to ww3.sinaimg.cn port 443 (#0)
    * Trying 115.231.156.72... Connection timed out
    * Trying 180.97.180.96... connected
    * Connected to ww3.sinaimg.cn (180.97.180.96) port 443 (#0)
    * Initializing NSS with certpath: sql:/etc/pki/nssdb
    * warning: ignoring value of ssl.verifyhost
    * skipping SSL peer certificate verification
    * SSL connection using TLS_RSA_WITH_AES_256_CBC_SHA
    * Server certificate:
    * subject: CN=kyfw.12306.cn,OU=铁路客户服务中心,O=Sinorail Certification Authority,C=CN
    * start date: May 26 01:44:36 2014 GMT
    * expire date: May 25 01:44:36 2019 GMT
    * common name: kyfw.12306.cn
    * issuer: CN=SRCA,O=Sinorail Certification Authority,C=CN
    > HEAD /large/628ab35egw1emngb8igz4j20kn0dpwfy.jpg HTTP/1.1
    > User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2
    > Host: ww3.sinaimg.cn
    > Accept: */*

    美国过去的, 这中国网络真是醉了.
    wwqgtxx
        12
    wwqgtxx  
       2014-11-25 21:52:45 +08:00 via Android
    @cst4you 应该是cdn节点证书还没有部署完毕吧
    wenketel
        13
    wenketel  
       2014-11-25 21:53:28 +08:00
    这楼歪成什么样子了。
    egen
        14
    egen  
    OP
       2014-11-25 22:52:56 +08:00 via Android
    @aaaa007cn 这个真是见识了
    aaaa007cn
        15
    aaaa007cn  
       2014-11-26 00:00:55 +08:00
    @wwqgtxx 可是这 12306 的证书是搞什么
    一开始我还以为是打开方式不对 233
    xoxo
        16
    xoxo  
       2014-11-26 00:01:49 +08:00
    新浪图片域在国内已支持HTTPS加载.
    wwqgtxx
        17
    wwqgtxx  
       2014-11-26 06:09:23 +08:00 via Android
    @aaaa007cn 渣浪用了别人的cdn呗,像好多国内的cdn供应商节点都部署了12306的证书,不知道为啥,那个证书貌似的公开的
    egen
        18
    egen  
    OP
       2015-02-15 20:43:43 +08:00
    问与答页面的 “罗汉创学院” Logo 图片在 https 页面下加载 http 资源
    http://cdn.v2ex.com/assets/sidebar/luohan_201501_new.jpg

    其他几个 logo 是用的正确的 https 资源
    @Livid
    关于     帮助文档     自助推广系统     博客     API     FAQ     Solana     2581 人在线   最高记录 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 27ms UTC 06:34 PVG 14:34 LAX 22:34 JFK 01:34
    Do have faith in what you're doing.
    ubao msn snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86