Centos 6.6 CURL在连接到某个SSL站点时返回错误

Question

I already tried to search most of things here but seems not worked. tried to curl -I -v https://secure2.lionair.co.id/lionairibe/OnlineBooking.aspx returns error usually im using ubuntu server and do not have any issue with this, but when i tried to use centos 6.6 suddenly all my curls to https returns that error both in PHP or even with linux command line appreciate if you can help me

Response when tried to curl :

* About to connect() to secure2.lionair.co.id port 443 (#0)
*   Trying 202.79.216.183... connected
* Connected to secure2.lionair.co.id (202.79.216.183) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12190
* Error in TLS handshake, trying SSLv3...
> HEAD /lionairibe/OnlineBooking.aspx HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: secure2.lionair.co.id
> Accept: */*
>
* Connection died, retrying a fresh connect
* Closing connection #0
* Issue another request to this URL: 'https://secure2.lionair.co.id/lionairibe/OnlineBooking.aspx'
* About to connect() to secure2.lionair.co.id port 443 (#0)
*   Trying 202.79.216.183... connected
* Connected to secure2.lionair.co.id (202.79.216.183) port 443 (#0)
* TLS disabled due to previous handshake failure
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12190
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error

Thanks :)

Answer 1

The server supports only TLS 1.1, i.e. no SSL 3.0, TLS 1.0 and TLS 1.2. So you have to be really careful when talking to this strange server. I don't know if the version of curl your are using already supports the necessary options to restrict the TLS protocol this way and if this option is implemented for the NSS backend, but you might try to enforce TLS 1.1 this way:

 curl  --tlsv1.1 https://secure2.lionair.co.id

If this does not help you might need to upgrade curl, use curl with another backend (like OpenSSL) or use tools like wget instead.