{"id":541,"date":"2025-02-14T02:35:40","date_gmt":"2025-02-14T02:35:40","guid":{"rendered":"https:\/\/replicounts.org\/failures\/navigating-the-maze-of-tls-ssl-proxy-errors\/"},"modified":"2025-02-14T02:35:40","modified_gmt":"2025-02-14T02:35:40","slug":"navigating-the-maze-of-tls-ssl-proxy-errors","status":"publish","type":"post","link":"https:\/\/replicounts.org\/vi\/failures\/navigating-the-maze-of-tls-ssl-proxy-errors\/","title":{"rendered":"\u0110i\u1ec1u h\u01b0\u1edbng qua M\u00ea cung l\u1ed7i Proxy TLS\/SSL"},"content":{"rendered":"<h2>Gi\u1edbi thi\u1ec7u<\/h2>\n<p>Trong l\u0129nh v\u1ef1c truy\u1ec1n th\u00f4ng k\u1ef9 thu\u1eadt s\u1ed1, c\u00e1c giao th\u1ee9c b\u1ea3o m\u1eadt TLS (Transport Layer Security) v\u00e0 SSL (Secure Sockets Layer) \u0111\u00f3ng vai tr\u00f2 l\u00e0 l\u00ednh g\u00e1c, \u0111\u1ea3m b\u1ea3o d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c truy\u1ec1n qua internet m\u1ed9t c\u00e1ch an to\u00e0n. Tuy nhi\u00ean, khi c\u00e1c giao th\u1ee9c n\u00e0y g\u1eb7p l\u1ed7i k\u1ebft h\u1ee3p v\u1edbi proxy, ch\u00fang c\u00f3 th\u1ec3 t\u1ea1o ra r\u00e0o c\u1ea3n \u0111\u00e1ng k\u1ec3 cho ng\u01b0\u1eddi d\u00f9ng. V\u1ea5n \u0111\u1ec1 n\u00e0y \u0111\u1eb7c bi\u1ec7t li\u00ean quan \u0111\u1ebfn nh\u1eefng ng\u01b0\u1eddi d\u1ef1a v\u00e0o proxy \u0111\u1ec3 \u1ea9n danh, b\u1ea3o m\u1eadt ho\u1eb7c truy c\u1eadp n\u1ed9i dung. Hi\u1ec3u v\u00e0 gi\u1ea3i quy\u1ebft c\u00e1c l\u1ed7i n\u00e0y kh\u00f4ng ch\u1ec9 l\u00e0 nhu c\u1ea7u k\u1ef9 thu\u1eadt; m\u00e0 c\u00f2n l\u00e0 n\u1ec1n t\u1ea3ng \u0111\u1ec3 duy tr\u00ec s\u1ef1 hi\u1ec7n di\u1ec7n tr\u1ef1c tuy\u1ebfn an to\u00e0n.<\/p>\n<h2>Hi\u1ec3u \u0111\u01b0\u1ee3c nguy\u00ean nh\u00e2n g\u1ed1c r\u1ec5<\/h2>\n<p>L\u1ed7i proxy TLS\/SSL th\u01b0\u1eddng ph\u00e1t sinh t\u1eeb s\u1ef1 hi\u1ec3u l\u1ea7m c\u01a1 b\u1ea3n v\u1ec1 c\u00e1ch c\u00e1c giao th\u1ee9c n\u00e0y t\u01b0\u01a1ng t\u00e1c v\u1edbi m\u00e1y ch\u1ee7 proxy. Khi m\u00e1y kh\u00e1ch c\u1ed1 g\u1eafng thi\u1ebft l\u1eadp k\u1ebft n\u1ed1i an to\u00e0n th\u00f4ng qua proxy, proxy c\u0169ng ph\u1ea3i h\u1ed7 tr\u1ee3 v\u00e0 \u0111\u00e0m ph\u00e1n \u0111\u00fang c\u00e1ch b\u1eaft tay TLS. N\u1ebfu c\u00f3 s\u1ef1 kh\u00f4ng kh\u1edbp v\u1ec1 phi\u00ean b\u1ea3n, b\u1ed9 m\u00e3 h\u00f3a ho\u1eb7c x\u00e1c th\u1ef1c ch\u1ee9ng ch\u1ec9, k\u1ebft n\u1ed1i s\u1ebd kh\u00f4ng th\u00e0nh c\u00f4ng.<\/p>\n<p>H\u00e3y xem x\u00e9t m\u1ed9t t\u00ecnh hu\u1ed1ng th\u1ef1c t\u1ebf: ng\u01b0\u1eddi d\u00f9ng c\u1ed1 g\u1eafng truy c\u1eadp m\u1ed9t trang web an to\u00e0n th\u00f4ng qua m\u1ed9t proxy ch\u1ec9 h\u1ed7 tr\u1ee3 phi\u00ean b\u1ea3n TLS l\u1ed7i th\u1eddi. Trang web \u0111\u01b0\u1ee3c \u0111\u1ecbnh c\u1ea5u h\u00ecnh \u0111\u1ec3 t\u1eeb ch\u1ed1i c\u00e1c giao th\u1ee9c l\u1ed7i th\u1eddi v\u00ec l\u00fd do b\u1ea3o m\u1eadt, t\u1eeb ch\u1ed1i k\u1ebft n\u1ed1i, d\u1eabn \u0111\u1ebfn th\u00f4ng b\u00e1o l\u1ed7i g\u00e2y kh\u00f3 ch\u1ecbu. Nh\u1eefng s\u1ef1 kh\u00f4ng kh\u1edbp nh\u01b0 v\u1eady, cho d\u00f9 l\u00e0 do ph\u1ea7n m\u1ec1m l\u1ed7i th\u1eddi hay c\u00e0i \u0111\u1eb7t c\u1ea5u h\u00ecnh sai, \u0111\u1ec1u l\u00e0m n\u1ed5i b\u1eadt s\u1ef1 c\u00e2n b\u1eb1ng tinh t\u1ebf c\u1ea7n thi\u1ebft \u0111\u1ec3 duy tr\u00ec giao ti\u1ebfp an to\u00e0n.<\/p>\n<h2>Nh\u1eefng Sai L\u1ea7m Th\u01b0\u1eddng G\u1eb7p C\u1ea7n Tr\u00e1nh<\/h2>\n<ol>\n<li><strong>B\u1ecf qua kh\u1ea3 n\u0103ng t\u01b0\u01a1ng th\u00edch c\u1ee7a Proxy<\/strong>: Kh\u00f4ng \u0111\u1ea3m b\u1ea3o r\u1eb1ng m\u00e1y ch\u1ee7 proxy h\u1ed7 tr\u1ee3 c\u00f9ng phi\u00ean b\u1ea3n TLS\/SSL v\u00e0 m\u00e3 h\u00f3a nh\u01b0 trang web \u0111\u00edch c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn l\u1ed7i.<\/li>\n<li><strong>B\u1ecf qua c\u00e1c v\u1ea5n \u0111\u1ec1 v\u1ec1 ch\u1ee9ng ch\u1ec9<\/strong>: Kh\u00f4ng ki\u1ec3m tra xem proxy c\u00f3 xu\u1ea5t tr\u00ecnh ch\u1ee9ng ch\u1ec9 h\u1ee3p l\u1ec7 hay kh\u00f4ng c\u00f3 th\u1ec3 khi\u1ebfn tr\u00ecnh duy\u1ec7t ch\u1eb7n k\u1ebft n\u1ed1i.<\/li>\n<li><strong>B\u1ecf qua C\u00e0i \u0111\u1eb7t C\u1ea5u h\u00ecnh<\/strong>:Vi\u1ec7c c\u1ea5u h\u00ecnh sai c\u00e0i \u0111\u1eb7t proxy, ch\u1eb3ng h\u1ea1n nh\u01b0 b\u1ecf qua x\u00e1c th\u1ef1c SSL, c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn c\u1ea3m gi\u00e1c an to\u00e0n sai l\u1ea7m v\u00e0 ti\u1ec1m \u1ea9n l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt.<\/li>\n<li><strong>S\u1eed d\u1ee5ng ph\u1ea7n m\u1ec1m l\u1ed7i th\u1eddi<\/strong>: Ch\u1ea1y m\u00e1y ch\u1ee7 ho\u1eb7c m\u00e1y kh\u00e1ch proxy l\u1ed7i th\u1eddi c\u00f3 th\u1ec3 g\u00e2y ra c\u00e1c v\u1ea5n \u0111\u1ec1 v\u1ec1 kh\u1ea3 n\u0103ng t\u01b0\u01a1ng th\u00edch v\u00e0 r\u1ee7i ro b\u1ea3o m\u1eadt.<\/li>\n<li><strong>V\u1ed9i v\u00e3 gi\u1ea3i quy\u1ebft s\u1ef1 c\u1ed1<\/strong>:Vi\u1ec7c b\u1ecf qua c\u00e1c b\u01b0\u1edbc kh\u1eafc ph\u1ee5c s\u1ef1 c\u1ed1 c\u00f3 h\u1ec7 th\u1ed1ng c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn c\u00e1c v\u1ea5n \u0111\u1ec1 ch\u01b0a \u0111\u01b0\u1ee3c gi\u1ea3i quy\u1ebft v\u00e0 gia t\u0103ng s\u1ef1 th\u1ea5t v\u1ecdng.<\/li>\n<\/ol>\n<h2>Gi\u1ea3i ph\u00e1p<\/h2>\n<h3>B\u1ea3n s\u1eeda l\u1ed7i th\u00e2n thi\u1ec7n v\u1edbi ng\u01b0\u1eddi m\u1edbi b\u1eaft \u0111\u1ea7u<\/h3>\n<ol>\n<li><strong>X\u00e1c minh c\u00e0i \u0111\u1eb7t Proxy<\/strong>: <\/li>\n<li>V\u00e0o ph\u1ea7n c\u00e0i \u0111\u1eb7t c\u1ee7a tr\u00ecnh duy\u1ec7t.<\/li>\n<li>\u0110i\u1ec1u h\u01b0\u1edbng \u0111\u1ebfn c\u00e0i \u0111\u1eb7t m\u1ea1ng ho\u1eb7c proxy.<\/li>\n<li>\n<p>\u0110\u1ea3m b\u1ea3o \u0111\u1ecba ch\u1ec9 proxy v\u00e0 c\u1ed5ng \u0111\u01b0\u1ee3c nh\u1eadp ch\u00ednh x\u00e1c.<\/p>\n<\/li>\n<li>\n<p><strong>C\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m<\/strong>:<\/p>\n<\/li>\n<li>Ki\u1ec3m tra b\u1ea3n c\u1eadp nh\u1eadt cho ph\u1ea7n m\u1ec1m proxy c\u1ee7a b\u1ea1n v\u00e0 c\u00e0i \u0111\u1eb7t ch\u00fang.<\/li>\n<li>\n<p>\u0110\u1ea3m b\u1ea3o tr\u00ecnh duy\u1ec7t c\u1ee7a b\u1ea1n c\u0169ng \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t.<\/p>\n<\/li>\n<li>\n<p><strong>Ki\u1ec3m tra k\u1ebft n\u1ed1i Internet<\/strong>:<\/p>\n<\/li>\n<li>\u0110\u1ea3m b\u1ea3o k\u1ebft n\u1ed1i Internet c\u1ee7a b\u1ea1n \u1ed5n \u0111\u1ecbnh.<\/li>\n<li>N\u1ebfu c\u00f3 th\u1ec3, h\u00e3y ki\u1ec3m tra proxy b\u1eb1ng k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh v\u1ea5n \u0111\u1ec1.<\/li>\n<\/ol>\n<h3>Gi\u1ea3i ph\u00e1p trung gian<\/h3>\n<ol>\n<li><strong>\u0110i\u1ec1u ch\u1ec9nh c\u00e0i \u0111\u1eb7t TLS<\/strong>:<\/li>\n<li>Trong tr\u00ecnh duy\u1ec7t c\u1ee7a b\u1ea1n, h\u00e3y \u0111i\u1ec1u h\u01b0\u1edbng \u0111\u1ebfn m\u1ee5c b\u1ea3o m\u1eadt ho\u1eb7c c\u00e0i \u0111\u1eb7t n\u00e2ng cao.<\/li>\n<li>\n<p>\u0110\u1ea3m b\u1ea3o r\u1eb1ng phi\u00ean b\u1ea3n TLS m\u1edbi nh\u1ea5t \u0111\u01b0\u1ee3c b\u1eadt (TLS 1.2 ho\u1eb7c 1.3).<\/p>\n<\/li>\n<li>\n<p><strong>Ki\u1ec3m tra ch\u1ee9ng ch\u1ec9<\/strong>:<\/p>\n<\/li>\n<li>S\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 nh\u01b0 OpenSSL ho\u1eb7c c\u00f4ng c\u1ee5 d\u00e0nh cho nh\u00e0 ph\u00e1t tri\u1ec3n tr\u00ecnh duy\u1ec7t \u0111\u1ec3 ki\u1ec3m tra t\u00ednh h\u1ee3p l\u1ec7 c\u1ee7a ch\u1ee9ng ch\u1ec9 proxy.<\/li>\n<li>\u0110\u1ea3m b\u1ea3o chu\u1ed7i ch\u1ee9ng ch\u1ec9 \u0111\u1ea7y \u0111\u1ee7 v\u00e0 \u0111\u01b0\u1ee3c tr\u00ecnh duy\u1ec7t c\u1ee7a b\u1ea1n tin c\u1eady.<\/li>\n<\/ol>\n<h3>X\u1eed l\u00fd s\u1ef1 c\u1ed1 n\u00e2ng cao<\/h3>\n<ol>\n<li><strong>S\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 d\u00f2ng l\u1ec7nh<\/strong>:<\/li>\n<li>S\u1eed d\u1ee5ng <code data-no-translation=\"\">curl<\/code> ho\u1eb7c <code data-no-translation=\"\">wget<\/code> \u0111\u1ec3 ki\u1ec3m tra k\u1ebft n\u1ed1i th\u00f4ng qua proxy v\u1edbi \u0111\u1ea7u ra chi ti\u1ebft. V\u00ed d\u1ee5:<br \/>\n     <code data-no-translation=\"\">bash<br \/>\n     curl -v -x http:\/\/proxy_address:port https:\/\/target_site<\/code><\/li>\n<li>\n<p>Ph\u00e2n t\u00edch \u0111\u1ea7u ra \u0111\u1ec3 t\u00ecm b\u1ea5t k\u1ef3 l\u1ed7i n\u00e0o li\u00ean quan \u0111\u1ebfn SSL.<\/p>\n<\/li>\n<li>\n<p><strong>Xem l\u1ea1i Nh\u1eadt k\u00fd Proxy<\/strong>:<\/p>\n<\/li>\n<li>Ki\u1ec3m tra nh\u1eadt k\u00fd m\u00e1y ch\u1ee7 proxy \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh l\u1ed7i trong qu\u00e1 tr\u00ecnh b\u1eaft tay TLS.<\/li>\n<li>\n<p>T\u00ecm ki\u1ebfm m\u00e3 l\u1ed7i c\u1ee5 th\u1ec3 c\u00f3 th\u1ec3 cung c\u1ea5p th\u00f4ng tin chi ti\u1ebft v\u1ec1 c\u1ea5u h\u00ecnh sai.<\/p>\n<\/li>\n<li>\n<p><strong>C\u1ea5u h\u00ecnh Cipher Suites<\/strong>:<\/p>\n<\/li>\n<li>N\u1ebfu b\u1ea1n qu\u1ea3n l\u00fd m\u00e1y ch\u1ee7 proxy, h\u00e3y \u0111\u1ea3m b\u1ea3o r\u1eb1ng n\u00f3 h\u1ed7 tr\u1ee3 b\u1ed9 m\u00e3 h\u00f3a hi\u1ec7n \u0111\u1ea1i t\u01b0\u01a1ng th\u00edch v\u1edbi trang web \u0111\u00edch.<\/li>\n<li>\u0110i\u1ec1u ch\u1ec9nh c\u00e0i \u0111\u1eb7t trong t\u1ec7p c\u1ea5u h\u00ecnh proxy \u0111\u1ec3 b\u1eadt ho\u1eb7c t\u1eaft c\u00e1c m\u00e3 h\u00f3a c\u1ee5 th\u1ec3 khi c\u1ea7n.<\/li>\n<\/ol>\n<h2>C\u00f4ng c\u1ee5 &amp; C\u1ea5u h\u00ecnh \u0111\u01b0\u1ee3c \u0111\u1ec1 xu\u1ea5t<\/h2>\n<ul>\n<li><strong>Ph\u1ea7n m\u1ec1m Proxy<\/strong>:C\u00e2n nh\u1eafc s\u1eed d\u1ee5ng ph\u1ea7n m\u1ec1m proxy \u0111\u00e1ng tin c\u1eady nh\u01b0 Squid ho\u1eb7c HAProxy, c\u00f3 h\u1ed7 tr\u1ee3 m\u1ea1nh m\u1ebd cho vi\u1ec7c ch\u1ea5m d\u1ee9t SSL v\u00e0 c\u00f3 th\u1ec3 x\u1eed l\u00fd \u0111\u00e0m ph\u00e1n TLS hi\u1ec7u qu\u1ea3.<\/li>\n<li><strong>Qu\u1ea3n l\u00fd ch\u1ee9ng ch\u1ec9<\/strong>:C\u00e1c c\u00f4ng c\u1ee5 nh\u01b0 Certbot c\u00f3 th\u1ec3 t\u1ef1 \u0111\u1ed9ng h\u00f3a qu\u00e1 tr\u00ecnh l\u1ea5y v\u00e0 gia h\u1ea1n ch\u1ee9ng ch\u1ec9 SSL.<\/li>\n<li><strong>C\u00f4ng c\u1ee5 gi\u00e1m s\u00e1t<\/strong>:S\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 gi\u00e1m s\u00e1t nh\u01b0 Wireshark \u0111\u1ec3 n\u1eafm b\u1eaft v\u00e0 ph\u00e2n t\u00edch l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp nh\u1eb1m c\u00f3 c\u00e1i nh\u00ecn s\u00e2u h\u01a1n v\u1ec1 l\u1ed7i b\u1eaft tay ho\u1eb7c l\u1ed7i SSL.<\/li>\n<\/ul>\n<h2>Suy ngh\u0129 cu\u1ed1i c\u00f9ng<\/h2>\n<p>Vi\u1ec7c \u0111i\u1ec1u h\u01b0\u1edbng c\u00e1c l\u1ed7i proxy TLS\/SSL c\u00f3 th\u1ec3 gi\u1ed1ng nh\u01b0 \u0111ang \u0111i qua m\u1ed9t m\u00ea cung, nh\u01b0ng v\u1edbi c\u00e1ch ti\u1ebfp c\u1eadn c\u00f3 c\u1ea5u tr\u00fac, con \u0111\u01b0\u1eddng tr\u1edf n\u00ean r\u00f5 r\u00e0ng h\u01a1n. Nh\u1eefng \u0111i\u1ec3m ch\u00ednh c\u1ea7n ghi nh\u1edb bao g\u1ed3m t\u1ea7m quan tr\u1ecdng c\u1ee7a vi\u1ec7c duy tr\u00ec ph\u1ea7n m\u1ec1m \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt, \u0111\u1ea3m b\u1ea3o kh\u1ea3 n\u0103ng t\u01b0\u01a1ng th\u00edch gi\u1eefa c\u00e1c proxy v\u00e0 c\u00e1c trang web m\u1ee5c ti\u00eau v\u00e0 kh\u1eafc ph\u1ee5c s\u1ef1 c\u1ed1 m\u1ed9t c\u00e1ch c\u00f3 h\u1ec7 th\u1ed1ng khi ch\u00fang ph\u00e1t sinh. B\u1eb1ng c\u00e1ch tu\u00e2n th\u1ee7 c\u00e1c bi\u1ec7n ph\u00e1p th\u1ef1c h\u00e0nh t\u1ed1t nh\u1ea5t v\u00e0 t\u1eadn d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 ph\u00f9 h\u1ee3p, ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng ch\u1ec9 c\u00f3 th\u1ec3 gi\u1ea3i quy\u1ebft c\u00e1c l\u1ed7i n\u00e0y m\u00e0 c\u00f2n c\u1ee7ng c\u1ed1 b\u1ea3o m\u1eadt tr\u1ef1c tuy\u1ebfn c\u1ee7a h\u1ecd. H\u00e3y nh\u1edb r\u1eb1ng, trong th\u1ebf gi\u1edbi k\u1ef9 thu\u1eadt s\u1ed1, ki\u1ebfn th\u1ee9c l\u00e0 l\u00e1 ch\u1eafn t\u1ed1t nh\u1ea5t c\u1ee7a b\u1ea1n v\u00e0 s\u1ef1 chu\u1ea9n b\u1ecb l\u00e0 l\u1edbp \u00e1o gi\u00e1p m\u1ea1nh nh\u1ea5t c\u1ee7a b\u1ea1n.<\/p>","protected":false},"excerpt":{"rendered":"<p>Introduction In the realm of digital communication, the security protocols TLS (Transport Layer Security) and SSL (Secure Sockets Layer) stand as sentinels, ensuring that data traverses the internet safely. However, when these protocols encounter errors in conjunction with proxies, they can create significant roadblocks for users. This issue is particularly pertinent for those relying on [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":542,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[153],"tags":[301,302,116,11,33,300,115,114,104,179],"class_list":["post-541","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-failures","tag-certificates","tag-connectivity-issues","tag-encryption","tag-https","tag-network-security","tag-proxy-errors","tag-ssl","tag-tls","tag-troubleshooting","tag-web-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/posts\/541","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/comments?post=541"}],"version-history":[{"count":0,"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/posts\/541\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/media\/542"}],"wp:attachment":[{"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/media?parent=541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/categories?post=541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/replicounts.org\/vi\/wp-json\/wp\/v2\/tags?post=541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}