Tongsuo8.4.0+Angie1.7 使用CFCA证书配置ntls单向认证报错

[Tri13stan]

• 配置:

server {
        listen       1443 ssl;
        ssl_ntls        on;
        ssl_verify_client off;

        ssl_certificate      /data/nginx/conf/dgfzx/qm.cer;
        ssl_certificate_key  /data/nginx/conf/dgfzx/qmsy.key;
        ssl_certificate /data/nginx/conf/dgfzx/jm.cer;
        ssl_certificate_key /data/nginx/conf/dgfzx/jmsy.key;

        ssl_session_cache    shared:SSL:20m;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers  on;

• 错误日志

2025/01/06 16:40:34 [info] 1223683#1223683: *245 SSL_do_handshake() failed (SSL: error:143280C1:SSL routines:tls_post_process_client_hello_ntls:no shared cipher) while SSL handshaking, client: X.X.X.X, server: 0.0.0.0:1443

• 使用国密浏览器提示:
  ERR_SSL_VERSION_OR_CIPHER_MISMATCH

而使用同样的配置 注释掉ssl_ntls使用gmssl_nginx_b2025.0331_aarch64.tar.gz(from gmssl.cn) 测试，证书协商正常。

理论上两者应该完全兼容才对，麻烦看看是哪儿配置有问题呢?

[Tri13stan]

编译参数如下:

./configure \
--prefix=$NGINX_ROOT \
--conf-path=$NGINX_ROOT/conf/nginx.conf \
--error-log-path=$NGINX_ROOT/logs/error.log \
--http-log-path=$NGINX_ROOT/logs/access.log \
--pid-path=$NGINX_ROOT/run/nginx.pid \
--lock-path=$NGINX_ROOT/run/nginx.lock \
--http-client-body-temp-path=$NGINX_ROOT/client/ \
--http-proxy-temp-path=$NGINX_ROOT/proxy/ \
--http-fastcgi-temp-path=$NGINX_ROOT/fcgi/ \
--http-uwsgi-temp-path=$NGINX_ROOT/uwsgi/ \
--http-scgi-temp-path=$NGINX_ROOT/scgi/ \
--with-select_module \
--with-poll_module \
--with-http_ssl_module \
--with-http_v2_module \
--with-http_v3_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_xslt_module \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_mp4_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_auth_request_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_degradation_module \
--with-http_slice_module \
--with-http_stub_status_module \
--with-mail \
--with-mail_ssl_module \
--with-stream \
--with-stream_ssl_module \
--with-stream_realip_module \
--with-stream_ssl_preread_module \
--with-cpp_test_module \
--with-threads \
--with-file-aio \
--with-pcre-jit \
--with-compat \
--with-openssl=$OPENSSL \
--with-openssl-opt=enable-ntls  \
--with-pcre=$PCRE \
--with-zlib=$ZLIB 
--with-ntls