微软 Azure 企业门户 Https 证书过期

https://ea.windowsazure.cn

在 Safari 中访问时，显示证书过期时间为 2019/03/24

但很诡异的是在 Chrome 中可以正常访问，且证书过期时间为 2020 年

使用 curl 也可以得到证书过期的错误提示：

Cat73s-MacBook-Air:~ Cat73$ curl -v --head https://ea.windowsazure.cn * Rebuilt URL to: https://ea.windowsazure.cn/ * Trying 139.217.24.215... * TCP_NODELAY set * Connected to ea.windowsazure.cn (139.217.24.215) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (OUT), TLS alert, Server hello (2): * SSL certificate problem: certificate has expired * stopped the pause stream! * Closing connection 0 curl: (60) SSL certificate problem: certificate has expired More details here: https://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure. 

使用某瓦工洛杉矶代理访问时，同样提示证书过期：

Cat73s-MacBook-Air:~ Cat73$ curl -v --head https://ea.windowsazure.cn * Rebuilt URL to: https://ea.windowsazure.cn/ * Trying 127.0.0.1... * TCP_NODELAY set * SOCKS5 communication to ea.windowsazure.cn:443 * SOCKS5 connect to IPv4 139.217.24.215 (locally resolved) * SOCKS5 request granted. * Connected to 127.0.0.1 (127.0.0.1) port 1086 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (OUT), TLS alert, Server hello (2): * SSL certificate problem: certificate has expired * stopped the pause stream! * Closing connection 0 curl: (60) SSL certificate problem: certificate has expired More details here: https://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.