search

loyess / Shell

Shadowsocks with plugins one-click installation. e.g. v2ray-plugin, kcptun, simple-obfs, goquiet, cloak, mos-tls-tunnel, rabbit-tcp, simple-tls, gost-plugin, xray-plugin, qtun, gun
783 stars 356 forks source link

SSL handshake failed #82

Closed quanljh closed 2 years ago

quanljh commented 2 years ago

This issue was introduced by b0b1a16fa4c33acb61949b6103bb160963918a0b, The root cause should be the protocol was set to TLSv1.3. I reverted code changes and tested it again, working now. Snipaste_2021-12-09_19-42-23

loyess commented 2 years ago

Please use the client in the link below： v2ray-plugin (teddysun) v2ray-plugin-android (teddysun)

quanljh commented 2 years ago

I was using the teddysun's version and get that error.

loyess commented 2 years ago

证书的算法，从默认的RSA更改为了ECC，证书所在目录也从原来的 /root/.acme.sh/${domain} 变成了 /root/.acme.sh/${domain}_ecc ，如果你用的是原来的的域名，去安装，申请证书那一步可能会出现问题。

你可以 使用 acme.sh 指令删除原来申请的证书：

acme.sh --remove --domain your-domain.com --ecc

然后，手动删除 /root/.acme.sh/${domain}_ecc 目录，里面是你相关域名的证书文件。

之后，执行 ./ss-plugin.sh 正常安装，就可以了。

你也可以用，其它域名，或者，子域名尝试。

loyess commented 2 years ago

删除原来的RSA证书，应该不用加 --ecc

quanljh commented 2 years ago

It doesn't work for me... I removed the original cert and used ecc to test, same error.

quanljh commented 2 years ago

Closing this, cause my system is CentOS 7, by default, the openssl version doesn't support TLS1.3.

quanljh commented 2 years ago

Instead of setting TLS1.3 only in niginx config, suggest checking if the openssl version support TLS1.3 first (above or equal 1.1.1) and then set config accordingly.