Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG]SNI mismatch while using multi-domain #549

Open
1 task done
Gaojianli opened this issue Mar 28, 2025 · 0 comments
Open
1 task done

[BUG]SNI mismatch while using multi-domain #549

Gaojianli opened this issue Mar 28, 2025 · 0 comments

Comments

@Gaojianli
Copy link

  • 我确定我已经尝试多次复现此次问题,并且将会提供涉及此问题的系统和网络环境,软件及其版本。

我们建议您按照下方模板填写 Bug Report,以便我们收集更多的有效信息

简单描述这个 Bug

前台使用trojan-go监听443,选择了一个证书,对于fallback,转发到nginx上(port 8443)

如何复现这个 Bug

在nginx 上配置了两个网站,domian A和domian B,trojan-go使用domain A的证书,此事对于所有Host = domainB的请求会出现错误:

* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS alert, internal error (592):
* OpenSSL/3.0.13: error:0A000438:SSL routines::tlsv1 alert internal error
* Closing connection
curl: (35) OpenSSL/3.0.13: error:0A000438:SSL routines::tlsv1 alert internal error

如果配置了verify-hostnamefalse,此时请求能够正确到达nginx,但是curl端会由于使用了domainA的证书,客户端会出现证书错误。

服务器和客户端环境信息

在此描述你的服务器和客户端所处的网络环境,系统架构,以及其他信息

服务端和客户端日志

[ERROR] 2025/03/28 17:22:55 github.com/p4gefau1t/trojan-go/tunnel/tls.(*Server).acceptLoop.func1:server.go:140 tls handshake failed | sni mismatched: domainB, expected: domainA

服务端和客户端配置文件

可以复现该问题的客户端和服务端的完整配置(请隐去域名和IP等隐私信息)

服务端和客户端版本信息

请执行./trojan-go -version并将输出完整粘贴在此处

其他信息

你认为对我们修复bug有帮助的任何信息都可以在这里写出来

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant