一次 HSTS 策略配置的排错之旅

这几天才发现，mail.mmf.moe 的服务不知道为什么上不去了。出错的地址是 https://mail.mmf.moe，这令我大惑不解。

尝试了一下 curl，发现 http 没有问题，https 就是不行。

http 结果：

1
$ curl -v http://mail.mmf.moe
2
*   Trying 172.217.24.19:80...
3
* Connected to mail.mmf.moe (172.217.24.19) port 80 (#0)
4
> GET / HTTP/1.1
5
> Host: mail.mmf.moe
6
> User-Agent: curl/7.72.0
7
> Accept: */*
8
>
9
* Mark bundle as not supporting multiuse
10
< HTTP/1.1 301 Moved Permanently
11
< Location: https://mail.google.com/a/mmf.moe
12
< Date: Fri, 04 Sep 2020 09:51:17 GMT
13
< Content-Type: text/html; charset=UTF-8
14
< Server: ghs
15
< Content-Length: 230
16
< X-XSS-Protection: 0
17
< X-Frame-Options: SAMEORIGIN
18
<
19
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
20
<TITLE>301 Moved</TITLE></HEAD><BODY>
21
<H1>301 Moved</H1>
22
The document has moved
23
<A HREF="https://mail.google.com/a/mmf.moe">here</A>.
24
</BODY></HTML>
25
* Connection #0 to host mail.mmf.moe left intact

https 的结果：

1
$ curl -v https://mail.mmf.moe
2
*   Trying 172.217.24.19:443...
3
* Connected to mail.mmf.moe (172.217.24.19) port 443 (#0)
4
* ALPN, offering h2
5
* ALPN, offering http/1.1
6
* successfully set certificate verify locations:
7
*   CAfile: /etc/ssl/certs/ca-certificates.crt
8
  CApath: none
9
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
10
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mail.mmf.moe:443
11
* Closing connection 0
12
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mail.mmf.moe:443