我有一个运行 IOS XE 版本 16.09.04 的 Cisco ISR4331/K9，我配置了主机名、域名并生成了 2048 位 RSA 密钥，我还验证了时钟设置是否正确。
配置后，ip http secure-server我尝试从运行 Firefox 83.0 的 PC 访问路由器
当 HTTP 访问正常时，HTTPS 会在 Firefox 中遇到错误“SSL_ERROR_NO_CYPHER_OVERLAP”。但是 ash ip http server secure status返回：
HTTP secure server status: Enabled
HTTP secure server port: 443
HTTP secure server ciphersuite: 3des-ede-cbc-sha aes-128-cbc-sha
aes-256-cbc-sha dhe-aes-128-cbc-sha ecdhe-rsa-3des-ede-cbc-sha
rsa-aes-cbc-sha2 rsa-aes-gcm-sha2 dhe-aes-cbc-sha2 dhe-aes-gcm-sha2
ecdhe-rsa-aes-cbc-sha2 ecdhe-rsa-aes-gcm-sha2 ecdhe-ecdsa-aes-gcm-sha2
HTTP secure server TLS version: TLSv1.2 TLSv1.1
HTTP secure server client authentication: Disabled
HTTP secure server PIV authentication: Disabled
HTTP secure server trustpoint:
HTTP secure server peer validation trustpoint:
HTTP secure server ECDHE curve: secp256r1
HTTP secure server active session modules: ALL
这似乎是 Firefox 完全可以接受的密码套件列表。
在 Wireshak 中查看时，路由器似乎在来自客户端的 TLSv1.2 Hello 消息之后立即向浏览器返回 TLSv1.2 致命握手错误消息。
debug ip http all在这次握手期间，我在使用的路由器上根本没有收到任何消息。
知道我在这里缺少什么吗？
请注意，这是我用于复制/调试此问题的实验室路由器，因此缺少大多数配置。路由器配置：
routertest#sh run
Building configuration...
Current configuration : 1787 bytes
!
! Last configuration change at 18:22:01 UTC Fri Jan 29 2021
!
version 16.9
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname routertest
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
!
no aaa new-model
!
no ip domain lookup
ip domain name test.com
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint TP-self-signed-886488406
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-886488406
revocation-check none
rsakeypair TP-self-signed-886488406
!
!
crypto pki certificate chain TP-self-signed-886488406
!
license udi pid ISR4331/K9 sn FDO19370HXL
license boot level securityk9
no license smart enable
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
!
!
redundancy
mode none
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 10.30.0.1 255.255.255.0
negotiation auto
!
interface GigabitEthernet0/0/2
no ip address
shutdown
negotiation auto
!
interface Serial0/1/0
no ip address
!
interface Serial0/1/1
no ip address
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
!
!
!
!
!
!
control-plane
!
!
line con 0
logging synchronous
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login
!
!
!
!
!
!
end