我先获取 GitHub 的 ip：
> nslookup github.com 8.8.8.8
Server: dns.google
Address: 8.8.8.8
Name: github.com
Address: 13.229.188.59
这个 ip 是没问题的，位于新加坡的 Amazon，应该是个 CDN
然后测试证书：
$ openssl s_client -showcerts -servername github.com -connect 13.229.188.59:443
CONNECTED(00000005)
depth=1 C = CN, ST = GD, L = SZ, O = COM, OU = NSP, CN = CA, emailAddress = [email protected]
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
0 s:C = CN, ST = GD, L = SZ, O = COM, OU = NSP, CN = SERVER, emailAddress = [email protected]
i:C = CN, ST = GD, L = SZ, O = COM, OU = NSP, CN = CA, emailAddress = [email protected]
省略……
就是那个诡异的 QQ 号证书。
我再找个 cloudflare 的 ip 试试（ GitHub 没有使用 cloudflare 的 CDN ）
$ host v2ex.com
v2ex.com has address 104.20.9.218
v2ex.com has address 104.20.10.218
v2ex.com has IPv6 address 2606:4700:10::6814:ada
v2ex.com has IPv6 address 2606:4700:10::6814:9da
同样测试证书，SNI 为 github.com ，没有被劫持：
$ openssl s_client -showcerts -servername github.com -connect 104.20.9.218:443
CONNECTED(00000005)
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO ECC Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO ECC Domain Validation Secure Server CA 2
verify return:1
depth=0 CN = ssl509603.cloudflaressl.com
verify return:1
---
Certificate chain
0 s:CN = ssl509603.cloudflaressl.com
i:C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO ECC Domain Validation Secure Server CA 2
-----BEGIN CERTIFICATE-----
省略……
各位怎么看？
1
Select Language