常见的异常日志如下:
# SSL client hello包中未携带SPA扩展字段,可能原因:客户端未输入安全码、用户直接通过浏览器访问登录页面等等
2022/03/25 16:41:01 [warn] 3841#0: *211270 [lua] init.lua:149: ssl_certificate(): verify SPA in unique mode failed: no spa extension in SSL, connection will be closed, context: ssl_certificate_by_lua*, client: 172.22.73.26, server: 0.0.0.0:443
# SSL client hello包中携带了SPA扩展字段,但扩展字段中没有SPA hash,可能原因是:使用的是老的客户端
2022/03/25 16:41:01 [warn] 3841#0: *211270 [lua] init.lua:149: ssl_certificate(): verify SPA in unique mode failed: carried no spa hash in SSL, connection will be closed, context: ssl_certificate_by_lua*, client: 172.22.73.26, server: 0.0.0.0:443
# 客户端使用的安全码在服务端不存在,可能原因是:安全码被管理员重置
2022/03/26 14:31:43 [warn] 4526#0: *3435441 [lua] init.lua:172: ssl_certificate(): verify SPA in unique mode failed: found no spa key: 50b31ceb005a04e2f912ad64874a7b83126034100236fdf6b6b401ac2a72044b, connection will be closed, context: ssl_certificate_by_lua*, client: 172.22.73.26, server: 0.0.0.0:443
# 种子过期
2022/03/25 15:30:59 [warn] 3842#0: *47611 [lua] init.lua:186: ssl_certificate(): verify SPA in unique mode failed: spa seed expired, connection will be closed, SPA hash: ca8e16c79bd6f9646161b7787d71d6ac2d5413103f8b752e7775af5450ece3e6, user: daf dfad, group: /, context: ssl_certificate_by_lua*, client: 172.22.73.26, server: 0.0.0.0:443
# TOTP校验失败,可能原因是:客户端时间与服务端时间不一致、伪造攻击
2022/03/25 15:30:59 [warn] 3842#0: *47611 [lua] init.lua:186: ssl_certificate(): verify SPA in unique mode failed: verify SPA failed: match none totp, connection will be closed, SPA hash: ca8e16c79bd6f9646161b7787d71d6ac2d5413103f8b752e7775af5450ece3e6, user: daf dfad, group: /, context: ssl_certificate_by_lua*, client: 172.22.73.26, server: 0.0.0.0:443