higress不支持v1.3以上的tls，怎么能

[caolicaoli]

{"ai_log":"{"answer":null,"api":"-","chat_round":1,"llm_service_duration":16,"question":"Output only your specific model name with no additional text.","response_type":"normal"}","authority":"higressha.ai:8080","bytes_received":"140","bytes_sent":"280","downstream_local_address":"172.20.188.211:8080","downstream_remote_address":"172.20.7.24:29432","duration":"16","istio_policy_status":"-","method":"POST","path":"/hbec/models/DeepSeek-V3-671B/chat/completions","protocol":"HTTP/1.1","request_id":"2e8c7fb8-ff5c-4a92-8963-1489c769a82e","requested_server_name":"-","response_code":"503","response_flags":"UF","route_name":"ai-route-DeepSeek-V3-671B.internal","start_time":"2025-07-31T02:14:12.510Z","trace_id":"cfa1d728718f75d9eea0deae9123bb0f","upstream_cluster":"outbound|443||llm-baowucloud.internal.dns","upstream_host":"180.168.130.222:443","upstream_local_address":"-","upstream_service_time":"-","upstream_transport_failure_reason":"TLS_error:_268436496:SSL_routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE_268435610:SSL_routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO","user_agent":"Go-http-client/1.1","x_forwarded_for":"172.20.7.24","response_code_details":"upstream_reset_before_response_started{remote_connection_failure,TLS_error:_268436496:SSL_routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE_268435610:SSL_routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO}"}

[CH3CHO]

你这个是 SSL v3，是更低的版本。版本太低导致不支持。

https://en.wikipedia.org/wiki/Transport_Layer_Security

[caolicaoli]

但是对面服务器支持tls

• ALPN, offering h2
• ALPN, offering http/1.1
• CAfile: /etc/ssl/certs/ca-certificates.crt
• CApath: /etc/ssl/certs
• TLSv1.0 (OUT), TLS header, Certificate Status (22):
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.2 (IN), TLS header, Certificate Status (22):
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.2 (IN), TLS header, Certificate Status (22):
• TLSv1.2 (IN), TLS handshake, Certificate (11):
• TLSv1.2 (IN), TLS header, Certificate Status (22):
• TLSv1.2 (IN), TLS handshake, Server finished (14):
• TLSv1.2 (OUT), TLS header, Certificate Status (22):
• TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
• TLSv1.2 (OUT), TLS header, Finished (20):
• TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.2 (OUT), TLS header, Certificate Status (22):
• TLSv1.2 (OUT), TLS handshake, Finished (20):
• TLSv1.2 (IN), TLS header, Finished (20):
• TLSv1.2 (IN), TLS header, Certificate Status (22):
• TLSv1.2 (IN), TLS handshake, Finished (20):
• SSL connection using TLSv1.2 / AES256-GCM-SHA384
• ALPN, server accepted to use http/1.1
• Server certificate:
• start date: Mar 3 02:59:52 2025 GMT
• expire date: Mar 3 02:59:50 2026 GMT
• SSL certificate verify ok.
• TLSv1.2 (OUT), TLS header, Supplemental data (23):

GET / HTTP/1.1
User-Agent: curl/7.81.0
Accept: /

• TLSv1.2 (IN), TLS header, Supplemental data (23):
• Mark bundle as not supporting multiuse
  < HTTP/1.1 200 OK
  < Server: Yxlink Reverse Proxy Server/2.8.1
  < Date: Thu, 31 Jul 2025 05:11:44 GMT
  < Content-Type: text/html
  < Content-Length: 562
  < Connection: keep-alive
  < Last-Modified: Wed, 23 Apr 2025 10:25:17 GMT
  < ETag: "6808c00d-232"
  < Accept-Ranges: bytes

[CH3CHO]

你的客户端用的是 SSL 3.0 还是 TLS 1.2？

---

Is your client using SSL 3.0 or TLS 1.2?

[CH3CHO]

Higress 底层使用的 Envoy 最低只能支持到 TLS v1.0。

• https://higress.cn/docs/latest/user/annotation-use-case/?spm=36971b57.2ef5001f.0.0.2a932c1fG1PInq#%E9%85%8D%E7%BD%AE%E5%AE%A2%E6%88%B7%E7%AB%AF%E5%88%B0%E7%BD%91%E5%85%B3%E4%B9%8B%E9%97%B4%E7%9A%84tls%E7%89%88%E6%9C%AC%E4%BB%A5%E5%8F%8A%E5%8A%A0%E5%AF%86%E5%A5%97%E4%BB%B6
• https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto
• https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#enum-extensions-transport-sockets-tls-v3-tlsparameters-tlsprotocol

---

Envoy used by Higress can only support TLS v1.0 at the lowest level.

• https://higress.cn/docs/latest/user/annotation-use-case/?spm=36971b57.2ef5001f.0.0.2a932c1fG1PInq#%E9%85%8D%E7%BD%AE%E5%AE%A2%E6%88%B7%E 7%AB%AF%E5%88%B0%E7%BD%91%E5%85%B3%E4%B9%8B%E9%97%B4%E7%9A%84tls%E7%89%88%E6%9C%AC%E4%BB%A5%E5%8F%8A%E5%8A%A0%E5%AF%86%E5%A5%97%E4%BB%B6
• https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto
• https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#enum-extensions-transport-sockets-tls-v3-tlsparameters-tlsprotocol

[caolicaoli]

对方的服务器太老了，加密算法支持少，没匹配的直接downgrade到ssl3.0了 ，骂他们一顿让他们升级。。。。。。

---

The other party's server is too old and has little encryption algorithm support. If there is no matching, it will go directly to SSL3.0. I scold them and let them upgrade. . . . . .