$ curl --tlsv1.0 --tls-max 1.0 https://www.example.com -vvv
* Trying 10.34.200.12:443...
* Connected to www.example.com (10.34.200.12) port 443 (#0)
* ALPN: offers http/1.1
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
* CApath: none
* TLSv1.0 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS handshake, Server hello (2):
* TLSv1.0 (IN), TLS handshake, Certificate (11):
* TLSv1.0 (IN), TLS handshake, Server key exchange (12):
* TLSv1.0 (IN), TLS handshake, Server finished (14):
* TLSv1.0 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.0 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.0 (OUT), TLS handshake, Finished (20):
* TLSv1.0 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1 / ECDHE-RSA-AES128-SHA
* ALPN: server accepted http/1.1
* Server certificate:
* subject: C=CN; ST=xxx; L=xxx; O=xxxxxxxxxx;CN=*.example.com
* start date: May 18 09:35:22 2026 GMT
* expire date: Dec 3 09:35:21 2026 GMT
* subjectAltName: host "www.example.com" matched cert's "*.example.com"
* issuer: C=CN; O=China Financial Certification Authority; CN=CFCA OV OCA
* SSL certificate verify ok.
> GET / HTTP/1.1
> Host: www.example.com
> User-Agent: curl/7.84.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302
< Date: Sat, 30 May 2026 15:18:55 GMT
< Content-Type: text/html;charset=UTF-8
< Content-Length: 0
< Connection: keep-alive
< Cache-Control: no-cache
< Cache-Control: no-store
< Pragma: no-cache
< Expires: Wed, 31 Dec 1969 23:59:59 GMT
< Set-Cookie: JSESSIONID=12258A970721D45DB0CED7D759ABDE16; Path=/space; HttpOnly
< Set-Cookie: toweibologin=login; Expires=Sun, 30-May-2027 15:18:55 GMT; Path=/
< Location: /home
< Strict-Transport-Security: max-age=15724800; includeSubDomains
<
* Connection #0 to host www.example.com left intact
我来逐行、清晰、通俗解读你这条 curl 命令的完整输出。
这是一次强制使用 TLSv1.0 访问目标网站的调试日志，能直接看出服务器配置、证书、连接状态、业务返回等关键信息。
命令本身含义
curl --tlsv1.0 --tls-max 1.0 https://www.example.com -vvv
- 强制客户端只使用 TLS 1.0 协议进行 HTTPS 连接
- 禁止升级到更高版本（TLS1.1/1.2/1.3）
-
-vvv输出最详细的调试日志
日志逐段解读
1. 网络连接阶段
* Trying 10.34.200.12:443...
* Connected to www.example.com (10.34.200.12) port 443 (#0)
✅ 成功解析域名并建立 TCP 连接
目标域名指向内网 IP：10.34.200.12
2. TLS 握手阶段（核心）
* TLSv1.0 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS handshake, Server hello (2):
* TLSv1.0 (IN), TLS handshake, Certificate (11):
* TLSv1.0 (IN), TLS handshake, Server key exchange (12):
* TLSv1.0 (IN), TLS handshake, Server finished (14):
* TLSv1.0 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.0 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.0 (OUT), TLS handshake, Finished (20):
* TLSv1.0 (IN), TLS handshake, Finished (20):
✅ TLS 1.0 握手完全成功
说明：
- 服务器支持并允许 TLS 1.0
- 密钥交换、证书验证流程全部正常走完
* SSL connection using TLSv1 / ECDHE-RSA-AES128-SHA
使用的加密套件：ECDHE-RSA-AES128-SHA（TLS1.0 常用套件）
3. 服务器证书信息（非常关键）
* Server certificate:
* subject: C=CN; ST=广东; L=深圳; O=深圳不怕影子斜有限责任公司; CN=*.example.com
* start date: May 18 09:35:22 2026 GMT
* expire date: Dec 3 09:35:21 2026 GMT
* subjectAltName: host "www.example.com" matched cert's "*.example.com"
* issuer: C=CN; O=China Financial Certification Authority; CN=CFCA OV OCA
* SSL certificate verify ok.
✅ 证书完全合法、有效、匹配
- 颁发给：深圳不怕影子斜有限责任公司
- 域名：泛域名
*.example.com，支持 www.example.com - 颁发机构：中国金融认证中心（CFCA）
- 有效期：2026-05-18 ~ 2026-12-03（你现在访问时间在有效期内）
- 证书校验：OK
4. HTTP 请求发送
> GET / HTTP/1.1
> Host: www.example.com
> User-Agent: curl/7.84.0
> Accept: */*
发送了标准的 GET 请求，访问根路径 /
5. 服务器响应（业务结果）
< HTTP/1.1 302
< Location: /home
< Set-Cookie: JSESSIONID=12258A970721D45DB0CED7D759ABDE16; Path=/space; HttpOnly
< Set-Cookie: toweibologin=login; Expires=Sun, 30-May-2027 15:18:55 GMT; Path=/
< Strict-Transport-Security: max-age=15724800; includeSubDomains
关键解读：
-
返回 302 重定向
访问/→ 自动跳转到/home（典型登录/门户系统行为） -
设置了两个 Cookie
-
JSESSIONID：Java 应用会话标识 -
toweibologin=login：登录态标记
-
-
HSTS 启用
强制使用 HTTPS，安全配置正常
最终总结（一句话结论）
这次 TLS1.0 访问完全成功：网络通、证书有效、TLS1.0 握手正常、服务器正常返回 302 重定向。
额外重要安全提示（你必须知道）
-
TLS 1.0 已被全球废弃、存在高危漏洞
- 不安全
- 不符合等保合规
- 现代浏览器默认禁止 TLS1.0
- 这个服务器还开启 TLS1.0，属于高危配置，建议尽快关闭，只保留 TLS1.2+
- 你这条命令只是强制测试，不代表日常应该使用 TLS1.0
总结
- 网络+TLS1.0+证书 三层全部正常，连接成功
- 业务返回 302 跳转到 /home，是正常门户行为
- 服务器仍支持老旧不安全的 TLS1.0，存在安全风险
- 证书由 CFCA 颁发，合法有效，归属 深圳不怕影子斜有限责任公司
$ curl -vvv --tlsv1.0 --tls-max 1.0 https://www.example.com
23:16:30.890000 [0-x] * [READ] client_reset, clear readers
23:16:30.920000 [0-0] * Host www.example.com:443 was resolved.
23:16:30.923000 [0-0] * IPv6: (none)
23:16:30.925000 [0-0] * IPv4: 10.34.200.12
23:16:30.928000 [0-0] * [HTTPS-CONNECT] adding wanted h2
23:16:30.931000 [0-0] * [HTTPS-CONNECT] added
23:16:30.936000 [0-0] * [HTTPS-CONNECT] connect, init
23:16:30.939000 [0-0] * Trying 10.34.200.12:443...
23:16:30.943000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
23:16:30.946000 [0-0] * [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
23:16:30.951000 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
23:16:30.955000 [0-0] * [SSL] cf_connect()
23:16:30.957000 [0-0] * schannel: disabled automatic use of client certificate
23:16:30.966000 [0-0] * ALPN: curl offers http/1.1
23:16:30.971000 [0-0] * [SSL] cf_connect() -> 0, done=0
23:16:30.974000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
23:16:30.977000 [0-0] * [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
23:16:30.981000 [0-0] * [SSL] adjust_pollset, POLLIN fd=660
23:16:30.985000 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
23:16:31.153000 [0-0] * [SSL] cf_connect()
23:16:31.158000 [0-0] * [SSL] cf_connect() -> 0, done=0
23:16:31.162000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
23:16:31.165000 [0-0] * [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
23:16:31.170000 [0-0] * [SSL] adjust_pollset, POLLIN fd=660
23:16:31.175000 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
23:16:31.190000 [0-0] * [SSL] cf_connect()
23:16:31.193000 [0-0] * [SSL] cf_connect() -> 0, done=0
23:16:31.196000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
23:16:31.200000 [0-0] * [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
23:16:31.206000 [0-0] * [SSL] adjust_pollset, POLLIN fd=660
23:16:31.209000 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
23:16:31.213000 [0-0] * [SSL] cf_connect()
23:16:31.429000 [0-0] * [SSL] cf_connect() -> 0, done=0
23:16:31.435000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
23:16:31.439000 [0-0] * [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
23:16:31.443000 [0-0] * [SSL] adjust_pollset, POLLIN fd=660
23:16:31.446000 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
23:16:31.469000 [0-0] * [SSL] cf_connect()
23:16:31.476000 [0-0] * ALPN: server accepted http/1.1
23:16:31.479000 [0-0] * [SSL] cf_connect() -> 0, done=1
23:16:31.482000 [0-0] * [HTTPS-CONNECT] connect+handshake h2: 544ms, 1st data: 218ms
23:16:31.487000 [0-0] * [HTTPS-CONNECT] connect -> 0, done=1
23:16:31.490000 [0-0] * [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=1
23:16:31.495000 [0-0] * Established connection to www.example.com (10.34.200.12 port 443) from 127.0.0.1 por
t 56918
23:16:31.505000 [0-0] * [HTTPS-CONNECT] query ALPN
23:16:31.508000 [0-0] * [SSL] query ALPN: returning 'http/1.1'
23:16:31.511000 [0-0] * using HTTP/1.x
23:16:31.513000 [0-0] => Send header, 84 bytes (0x54)
0000: GET / HTTP/1.1
0010: Host: www.example.com
002c: User-Agent: curl/8.17.0
0045: Accept: */*
0052:
23:16:31.523000 [0-0] * Request completely sent off
23:16:31.554000 [0-0] <= Recv header, 15 bytes (0xf)
0000: HTTP/1.1 302
23:16:31.559000 [0-0] * [WRITE] [OUT] wrote 15 header bytes -> 15
23:16:31.563000 [0-0] * [WRITE] [PAUSE] writing 15/15 bytes of type c -> 0
23:16:31.569000 [0-0] * [WRITE] download_write header(type=c, blen=15) -> 0
23:16:31.573000 [0-0] * [WRITE] client_write(type=c, len=15) -> 0
23:16:31.577000 [0-0] <= Recv header, 37 bytes (0x25)
0000: Date: Sat, 30 May 2026 15:16:31 GMT
23:16:31.583000 [0-0] * [WRITE] header_collect pushed(type=1, len=37) -> 0
23:16:31.587000 [0-0] * [WRITE] [OUT] wrote 37 header bytes -> 37
23:16:31.590000 [0-0] * [WRITE] [PAUSE] writing 37/37 bytes of type 4 -> 0
23:16:31.594000 [0-0] * [WRITE] download_write header(type=4, blen=37) -> 0
23:16:31.599000 [0-0] * [WRITE] client_write(type=4, len=37) -> 0
23:16:31.604000 [0-0] <= Recv header, 39 bytes (0x27)
0000: Content-Type: text/html;charset=UTF-8
23:16:31.610000 [0-0] * [WRITE] header_collect pushed(type=1, len=39) -> 0
23:16:31.615000 [0-0] * [WRITE] [OUT] wrote 39 header bytes -> 39
23:16:31.619000 [0-0] * [WRITE] [PAUSE] writing 39/39 bytes of type 4 -> 0
23:16:31.623000 [0-0] * [WRITE] download_write header(type=4, blen=39) -> 0
23:16:31.627000 [0-0] * [WRITE] client_write(type=4, len=39) -> 0
23:16:31.631000 [0-0] <= Recv header, 19 bytes (0x13)
0000: Content-Length: 0
23:16:31.638000 [0-0] * [WRITE] header_collect pushed(type=1, len=19) -> 0
23:16:31.643000 [0-0] * [WRITE] [OUT] wrote 19 header bytes -> 19
23:16:31.647000 [0-0] * [WRITE] [PAUSE] writing 19/19 bytes of type 4 -> 0
23:16:31.651000 [0-0] * [WRITE] download_write header(type=4, blen=19) -> 0
23:16:31.655000 [0-0] * [WRITE] client_write(type=4, len=19) -> 0
23:16:31.659000 [0-0] <= Recv header, 24 bytes (0x18)
0000: Connection: keep-alive
23:16:31.664000 [0-0] * [WRITE] header_collect pushed(type=1, len=24) -> 0
23:16:31.671000 [0-0] * [WRITE] [OUT] wrote 24 header bytes -> 24
23:16:31.674000 [0-0] * [WRITE] [PAUSE] writing 24/24 bytes of type 4 -> 0
23:16:31.678000 [0-0] * [WRITE] download_write header(type=4, blen=24) -> 0
23:16:31.683000 [0-0] * [WRITE] client_write(type=4, len=24) -> 0
23:16:31.686000 [0-0] <= Recv header, 25 bytes (0x19)
0000: Cache-Control: no-cache
23:16:31.691000 [0-0] * [WRITE] header_collect pushed(type=1, len=25) -> 0
23:16:31.695000 [0-0] * [WRITE] [OUT] wrote 25 header bytes -> 25
23:16:31.700000 [0-0] * [WRITE] [PAUSE] writing 25/25 bytes of type 4 -> 0
23:16:31.705000 [0-0] * [WRITE] download_write header(type=4, blen=25) -> 0
23:16:31.709000 [0-0] * [WRITE] client_write(type=4, len=25) -> 0
23:16:31.713000 [0-0] <= Recv header, 25 bytes (0x19)
0000: Cache-Control: no-store
23:16:31.718000 [0-0] * [WRITE] header_collect pushed(type=1, len=25) -> 0
23:16:31.722000 [0-0] * [WRITE] [OUT] wrote 25 header bytes -> 25
23:16:31.725000 [0-0] * [WRITE] [PAUSE] writing 25/25 bytes of type 4 -> 0
23:16:31.730000 [0-0] * [WRITE] download_write header(type=4, blen=25) -> 0
23:16:31.735000 [0-0] * [WRITE] client_write(type=4, len=25) -> 0
23:16:31.739000 [0-0] <= Recv header, 18 bytes (0x12)
0000: Pragma: no-cache
23:16:31.743000 [0-0] * [WRITE] header_collect pushed(type=1, len=18) -> 0
23:16:31.748000 [0-0] * [WRITE] [OUT] wrote 18 header bytes -> 18
23:16:31.751000 [0-0] * [WRITE] [PAUSE] writing 18/18 bytes of type 4 -> 0
23:16:31.755000 [0-0] * [WRITE] download_write header(type=4, blen=18) -> 0
23:16:31.759000 [0-0] * [WRITE] client_write(type=4, len=18) -> 0
23:16:31.763000 [0-0] <= Recv header, 40 bytes (0x28)
0000: Expires: Wed, 31 Dec 1969 23:59:59 GMT
23:16:31.769000 [0-0] * [WRITE] header_collect pushed(type=1, len=40) -> 0
23:16:31.775000 [0-0] * [WRITE] [OUT] wrote 40 header bytes -> 40
23:16:31.779000 [0-0] * [WRITE] [PAUSE] writing 40/40 bytes of type 4 -> 0
23:16:31.784000 [0-0] * [WRITE] download_write header(type=4, blen=40) -> 0
23:16:31.788000 [0-0] * [WRITE] client_write(type=4, len=40) -> 0
23:16:31.791000 [0-0] <= Recv header, 80 bytes (0x50)
0000: Set-Cookie: JSESSIONID=4466A6512A20695A1148DED40170A3BD; Path=/s
0040: pace; HttpOnly
23:16:31.800000 [0-0] * [WRITE] header_collect pushed(type=1, len=80) -> 0
23:16:31.805000 [0-0] * [WRITE] [OUT] wrote 80 header bytes -> 80
23:16:31.809000 [0-0] * [WRITE] [PAUSE] writing 80/80 bytes of type 4 -> 0
23:16:31.814000 [0-0] * [WRITE] download_write header(type=4, blen=80) -> 0
23:16:31.818000 [0-0] * [WRITE] client_write(type=4, len=80) -> 0
23:16:31.822000 [0-0] <= Recv header, 79 bytes (0x4f)
0000: Set-Cookie: toweibologin=login; Expires=Sun, 30-May-2027 15:16:3
0040: 1 GMT; Path=/
23:16:31.829000 [0-0] * [WRITE] header_collect pushed(type=1, len=79) -> 0
23:16:31.836000 [0-0] * [WRITE] [OUT] wrote 79 header bytes -> 79
23:16:31.840000 [0-0] * [WRITE] [PAUSE] writing 79/79 bytes of type 4 -> 0
23:16:31.844000 [0-0] * [WRITE] download_write header(type=4, blen=79) -> 0
23:16:31.848000 [0-0] * [WRITE] client_write(type=4, len=79) -> 0
23:16:31.852000 [0-0] <= Recv header, 17 bytes (0x11)
0000: Location: /home
23:16:31.856000 [0-0] * [WRITE] header_collect pushed(type=1, len=17) -> 0
23:16:31.860000 [0-0] * [WRITE] [OUT] wrote 17 header bytes -> 17
23:16:31.864000 [0-0] * [WRITE] [PAUSE] writing 17/17 bytes of type 4 -> 0
23:16:31.871000 [0-0] * [WRITE] download_write header(type=4, blen=17) -> 0
23:16:31.876000 [0-0] * [WRITE] client_write(type=4, len=17) -> 0
23:16:31.879000 [0-0] <= Recv header, 64 bytes (0x40)
0000: Strict-Transport-Security: max-age=15724800; includeSubDomains
23:16:31.887000 [0-0] * [WRITE] header_collect pushed(type=1, len=64) -> 0
23:16:31.891000 [0-0] * [WRITE] [OUT] wrote 64 header bytes -> 64
23:16:31.894000 [0-0] * [WRITE] [PAUSE] writing 64/64 bytes of type 4 -> 0
23:16:31.899000 [0-0] * [WRITE] download_write header(type=4, blen=64) -> 0
23:16:31.905000 [0-0] * [WRITE] client_write(type=4, len=64) -> 0
23:16:31.908000 [0-0] <= Recv header, 2 bytes (0x2)
0000:
23:16:31.912000 [0-0] * [WRITE] header_collect pushed(type=1, len=2) -> 0
23:16:31.916000 [0-0] * [WRITE] [OUT] wrote 2 header bytes -> 2
23:16:31.919000 [0-0] * [WRITE] [PAUSE] writing 2/2 bytes of type 4 -> 0
23:16:31.923000 [0-0] * [WRITE] download_write header(type=4, blen=2) -> 0
23:16:31.927000 [0-0] * [WRITE] client_write(type=4, len=2) -> 0
23:16:31.931000 [0-0] * [WRITE] xfer_write_resp(len=484, eos=0) -> 0
23:16:31.936000 [0-0] * [WRITE] [OUT] done
23:16:31.939000 [0-0] * [READ] client_reset, clear readers
23:16:31.942000 [0-0] * Connection #0 to host www.example.com:443 left intact
超详细逐段解读（Windows 版 curl + TLS1.0 完整日志）
你这条日志是 Windows 系统下的 curl 8.17.0，用 --tlsv1.0 --tls-max 1.0 强制 TLS1.0 访问 https://www.example.com 的超级详细调试日志（比上一条 Linux 日志更底层，包含时间戳、SSL 内部状态、读写字节数）。
我直接按执行顺序 + 关键信息拆解得清清楚楚，你能一眼看懂整个连接到底发生了什么、是否成功、哪里值得注意。
0. 先给结论（最核心）
✅ 整个请求 100% 成功
✅ TLS 1.0 握手完全成功
✅ 服务器正常响应 302 重定向
✅ 证书验证、会话、Cookie 全部正常
✅ 这是一次 Windows 上的成功访问
唯一需要注意：TLS1.0 是老旧不安全协议。
1. 日志开头：连接准备阶段
23:16:30.890000 [0-x] * [READ] client_reset, clear readers
23:16:30.920000 [0-0] * Host www.example.com:443 was resolved.
23:16:30.925000 [0-0] * IPv4: 10.34.200.12
- 清空旧连接
- 域名解析成功
- 解析到内网 IP：
10.34.200.12
2. TCP 连接建立
23:16:30.939000 [0-0] * Trying 10.34.200.12:443...
23:16:31.495000 [0-0] * Established connection to www.example.com (10.34.200.12 port 443)
✅ TCP 三次握手成功
本地端口：56918
目标端口：443
3. TLS/SSL 握手（最关键）
23:16:30.957000 [0-0] * schannel: disabled automatic use of client certificate
23:16:30.966000 [0-0] * ALPN: curl offers http/1.1
...
23:16:31.476000 [0-0] * ALPN: server accepted http/1.1
23:16:31.479000 [0-0] * [SSL] cf_connect() -> 0, done=1
关键解读：
- 使用 Windows 自带 SSL 库：Schannel
- 未使用客户端证书（正常，大多数网站不需要）
- ALPN 协商使用 http/1.1（不支持 HTTP/2 很正常）
done=1= TLS 握手完全成功
4. 发送 HTTP 请求
23:16:31.513000 [0-0] => Send header, 84 bytes (0x54)
0000: GET / HTTP/1.1
0010: Host: www.example.com
002c: User-Agent: curl/8.17.0
0045: Accept: */*
- 发送 GET 请求到
/ - 浏览器标识：curl/8.17.0
- 请求发送完成：
Request completely sent off
5. 服务器响应（业务结果）
23:16:31.554000 [0-0] <= Recv header, 15 bytes (0xf)
0000: HTTP/1.1 302
核心响应头解读：
HTTP/1.1 302
Location: /home
Set-Cookie: JSESSIONID=4466A6512A20695A1148DED40170A3BD
Set-Cookie: toweibologin=login
Strict-Transport-Security: max-age=15724800; includeSubDomains
Cache-Control: no-cache, no-store
业务含义：
302 重定向
访问/→ 跳转到/home
典型门户/登录页行为-
返回两个 Cookie
-
JSESSIONID：Java 应用会话ID -
toweibologin=login：登录标记
-
HSTS 启用
强制 HTTPS，安全配置正常禁用缓存
登录类系统标准行为
6. 日志结尾
23:16:31.942000 [0-0] * Connection #0 to host www.example.com:443 left intact
✅ 连接保持成功，请求完全结束
7. 这条日志与上一条 Linux 日志的区别
| 项目 | Linux curl | Windows curl |
|---|---|---|
| SSL 库 | OpenSSL | Schannel (Windows 自带) |
| 日志格式 | 标准简洁 | 超详细（时间戳+字节数+状态） |
| 结果 | 成功 | 成功 |
| TLS 版本 | TLS1.0 | TLS1.0 |
| 服务器响应 | 302 /home | 302 /home |
结论完全一致：访问成功！
最终超级精简总结
- Windows 上用 TLS1.0 访问目标服务器完全成功
- 网络、TCP、TLS、证书、业务响应 全部正常
- 服务器返回 302 跳转到 /home
- 服务器支持老旧的 TLS1.0，存在安全风险
