由 dawei 副标题#e#
10点左右，同事反馈咨询线上的Sentry 服务器现在是否正常。之后去检查 Sentry 服务，运行正常，但是该应用服务对接的Sentry频道已经很久没有事件进来了。
感觉不太对劲，再去检查下 Sentry worker专用的容器，发现该Worker服务中中有些错误日志：
E, [2020-06-01T04:02:03.670850 #6] ERROR — sentry: ** [Raven] Unable to record event with remote Sentry server (Raven::Error – SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (certificate has expired)):
/usr/local/bundle/gems/sentry-raven-2.7.3/lib/raven/transports/http.rb:34:in `rescue in send_event'
/usr/local/bundle/gems/sentry-raven-2.7.3/lib/raven/transports/http.rb:16:in `send_event'
/usr/local/bundle/gems/sentry-raven-2.7.3/lib/raven/client.rb:37:in `send_event'
/usr/local/bundle/gems/sentry-raven-2.7.3/lib/raven/instance.rb:81:in `send_event'
/app/src/worker.rb:26:in `perform'
/usr/local/bundle/gems/sidekiq-5.1.3/lib/sidekiq/processor.rb:187:in `execute_job'
/usr/local/bundle/gems/sidekiq-5.1.3/lib/sidekiq/processor.rb:169:in `block (2 levels) in process'
/usr/local/bundle/gems/sidekiq-5.1.3/lib/sidekiq/middleware/chain.rb:128:in `block in invoke'
/usr/local/bundle/gems/sentry-raven-2.7.3/lib/raven/integrations/sidekiq.rb:9:in `call'
/usr/local/bundle/gems/sidekiq-5.1.3/lib/sidekiq/middleware/chain.rb:130:in `block in invoke'
/usr/local/bundle/gems/sidekiq-5.1.3/lib/sidekiq/middleware/chain.rb:133:in `invoke'
E, [2020-06-01T04:02:03.671130 #6] ERROR — sentry: ** [Raven] Failed to submit event: <no message value>
奇怪？sentry-worker 在连sentry server 时请求域名的证书过期了？
分析
针对上面的错误信息，先去检查了相关调用的域名证书的有效期，发现都在有效期内。而且印象中都是年初刚更换的。所以排除了是域名证书问题。
然后根据错误日志，尝试在自己电脑上用下curl 命令，巧合的很，也遇到了类似的错误。
$ curl https://sentry.xxx.com
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a Secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
我又去找了其它一台 Centos 主机，发现 curl 返回的结果是正常的，从 web 端和centos 客户端 curl 都成功的看，像是我本机电脑的 curl 和sentry-worker主机出了问题。
之后用到网上找到使用openssl命令排查ssl错误的方法：
$ openssl s_client -showcerts -servername sentry.xxx.com -connect sentry.xxx.com:443
CONNECTED(00000003)
#p#副标题#e#
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify error:num=10:certificate has expired
notAfter=May 30 10:48:38 2020 GMT
—
Certificate chain
0 s:/OU=Domain Control Validated/OU=GoGetSSL Wildcard SSL/CN=*.xxx.com
i:/C=LV/L=Riga/O=GoGetSSL/CN=GoGetSSL RSA DV CA
—–BEGIN CERTIFICATE—–