现象：

Windows Edge/Chrome/Firefox 都可以正常访问，浏览器地址栏安全锁显示正常

iPhone Safari 提示“Safari 浏览器打不开该网页，因为已丢失网络连接。”

iPhone Edge 提示“此站点的连接不安全”

MacOS Safari 提示“Safari can't open the page "https://<mydomain>/xx/xxx" because Safari can't establish a secure connection to the server "<mydomain>"”.

问了 OpenAI 家，目前一直在 tls 方向上努力

在服务器

]# openssl s_client -connect 127.0.0.1:443 -servername <mydomain> -tls1_2
]# openssl s_client -connect 127.0.0.1:443 -servername <mydomain> -tls1_3

都可以正常输出 Protocol 、Cipher 、证书链、证书等信息

New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384

在本机（ Windows wsl/MacOS Terminal ） 具体信息如下

$ openssl s_client -connect <myip>:443 -servername <mydomain> -tls1_2
CONNECTED(00000003)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 213 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1747836333
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

$ openssl s_client -connect <myip>:443 -servername <mydomain> -tls1_3
CONNECTED(00000003)
write:errno=0
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 240 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

ECS 后台安全组确认过没问题，443 端口全放

OS 部署的 AlmaLinux 9

Nginx 信息

]# nginx -V
nginx version: nginx/1.27.5
built by gcc 11.5.0 20240719 (Red Hat 11.5.0-5) (GCC) 
built with OpenSSL 3.2.2 4 Jun 2024
TLS SNI support enabled

有没有大佬有什么思路，指导一下~~