我在Kubernetes集群中运行了一个容器化的gunicorn服务器。我只希望gunicorn服务器响应使用TLS_AES_256_GCM_SHA384密码套件连接的用户。我不知道如何有效地传递--cipher参数来限制所有非TLS_AES_256_GCM_SHA384密码。
如果我在启动gunicorn时没有指定这样的密码

gunicorn --workers=2 \
--bind=0.0.0.0:443 \
--timeout 600 \
--error-logfile gunicorn.log \
--log-level debug \
--certfile ./cert.pem \
--keyfile ./key.pem \
--ssl-version=5 \
main_server:app

字符串
我可以使用curl连接到服务器

$ curl --insecure --tls13-ciphers TLS_AES_256_GCM_SHA384 -v https://192.168.49.2/serve
*   Trying 192.168.49.2:443...
* TCP_NODELAY set
* Connected to 192.168.49.2 (192.168.49.2) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLS 1.3 cipher selection: TLS_AES_256_GCM_SHA384
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: O=Acme Co; CN=Kubernetes Ingress Controller Fake Certificate
*  start date: Dec  5 17:21:58 2023 GMT
*  expire date: Dec  4 17:21:58 2024 GMT
*  issuer: O=Acme Co; CN=Kubernetes Ingress Controller Fake Certificate
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55cc709790c0)
> GET /serve HTTP/2
> Host: 192.168.49.2
> user-agent: curl/7.68.0
> accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200 
< date: Wed, 06 Dec 2023 16:37:41 GMT
< content-type: text/html; charset=utf-8
< content-length: 37
< 
* Connection #0 to host 192.168.49.2 left intact
<h1><center>Hello World!</center><h1>

型
此外，协商实际上选择了我想要的默认密码（使用上面的TLSv1.3 / TLS_AES_256_GCM_SHA384的SSL连接），所以我知道服务器和curl都支持它。
如果我以gunicorn开头指定密码，如下所示：

gunicorn --workers=2 \
--bind=0.0.0.0:443 \
--timeout 600 \
--error-logfile gunicorn.log \
--log-level debug \
--certfile ./cert.pem \
--keyfile ./key.pem \
--ssl-version=5 \
--ciphers="TLS_AES_256_GCM_SHA384" \
main_server:app

型
Gunicorn服务器的日志给了我给予：

[2023-12-06 17:51:39 +0000] [8] [DEBUG] Error processing SSL request.

[2023-12-06 17:51:39 +0000] [8] [WARNING] Invalid request from ip=10.244.0.5: ('No cipher can be selected.',)

型
curl返回：

$ curl --insecure --tls13-ciphers TLS_AES_256_GCM_SHA384 -v https://192.168.49.2/serve
*   Trying 192.168.49.2:443...
* TCP_NODELAY set
* Connected to 192.168.49.2 (192.168.49.2) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLS 1.3 cipher selection: TLS_AES_256_GCM_SHA384
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: O=Acme Co; CN=Kubernetes Ingress Controller Fake Certificate
*  start date: Dec  5 17:21:58 2023 GMT
*  expire date: Dec  4 17:21:58 2024 GMT
*  issuer: O=Acme Co; CN=Kubernetes Ingress Controller Fake Certificate
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x559bae1090c0)
> GET /serve HTTP/2
> Host: 192.168.49.2
> user-agent: curl/7.68.0
> accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 502 
< date: Wed, 06 Dec 2023 17:51:39 GMT
< content-type: text/html
< content-length: 150
< 
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host 192.168.49.2 left intact

型
我试过用双引号、单引号和不加引号的方式来发出密码。我试过用等号和空格加上密码名。
我知道Kubernetes入口和服务网络是好的，否则当我不指定确切的密码时，事情就无法工作。
我已经看了https://venafi.com/blog/what-are-cipher-suites/，https://docs.gunicorn.org/en/20.1.0/settings.html，https://github.com/benoitc/gunicorn/issues/2579，How to disable SSLv3.0 and use TLS1.0 in Gunicorn，和其他一些地方试图找到一个例子，如何强制这一点，但还没有能够弄清楚到底是怎么回事.我可以告诉我最混乱的格式为密码.
我正在寻找一个答案，它将告诉我如何启动gunicorn，以便它只在请求用户尝试使用TLS_AES_256_GCM_SHA384密码连接时才会响应。