admin@RT-BE88U-8708:/jffs/scripts/lz# ./lz_update_ispip_data.sh

2025-12-30 17:12:29 [9401]: LZ v4.7.6 start to update the ISP IP data files...
--2025-12-30 17:12:29-- https://ispip.clang.cn/all_cn.txt
Resolving ispip.clang.cn... 114.237.67.188, 223.215.161.212
Connecting to ispip.clang.cn|114.237.67.188|:443... connected.
HTTP request sent, awaiting response... No data received.
Retrying.

直接curl 时，提示
admin@RT-BE88U-8708:/jffs/scripts/lz# curl -v https://ispip.clang.cn/all_cn.txt

• Trying 114.237.67.188:443...
• Connected to ispip.clang.cn (114.237.67.188) port 443
• ALPN: curl offers http/1.1
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• CAfile: /etc/ssl/certs/ca-certificates.crt
• CApath: none
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
• ALPN: server accepted http/1.1
• Server certificate:
• subject: CN=ispip.clang.cn
• start date: Oct 24 00:00:00 2025 GMT
• expire date: Jan 21 23:59:59 2026 GMT
• subjectAltName: host "ispip.clang.cn" matched cert's "ispip.clang.cn"
• issuer: C=CN; O=TrustAsia Technologies, Inc.; CN=TrustAsia DV TLS RSA CA 2025
• SSL certificate verify ok.
• using HTTP/1.1

GET /all_cn.txt HTTP/1.1
Host: ispip.clang.cn
User-Agent: curl/8.4.0
Accept: /

• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• old SSL session ID is stale, removing
• TLSv1.3 (OUT), TLS alert, protocol version (582):
• OpenSSL SSL_read: OpenSSL/1.1.1w: error:1408F10B:lib(20):func(143):reason(267), errno 0
• Closing connection
  curl: (56) OpenSSL SSL_read: OpenSSL/1.1.1w: error:1408F10B:lib(20):func(143):reason(267), errno 0
  admin@RT-BE88U-8708:/jffs/scripts/lz#
  日志显示，核心错误是 TLS 协议版本 / 配置不兼容

测试用TLS 1.2访问原地址

curl -k --tlsv1.2 https://ispip.clang.cn/all_cn.txt -o /tmp/all_cn.txt
可以成功下载
排查的原因为 RT-BE88U，固件内置的 curl/OpenSSL 是定制精简版，对部分网站的 TLS 1.3 高级配置兼容性较差。
有什么办法解决？