Мобильная версияОн работает только с HTTPS и имеет странный сертификат.
Он работает только с HTTPS и имеет странный сертификат.
Он работает только с HTTPS и имеет странный сертификат.
p>
Если я отлаживаю свой проект .net 6 (вызовы с помощью RestSharp) в Windows 10 — все в порядке, но в Ubuntu 22.04 LTS у меня возникают проблемы.
Добавление поддержки TLSv1.0 или TLSv1.1 или TLSv1.2 в /etc/ssl/openssl.cnf – не работает.
Использование curl -k или --insecure — не работает.
root@nginx:/home/xxx# curl -vvv https://192.168.201.111:44301/api/
* Trying 192.168.201.111:44301...
* Connected to 192.168.201.111 (192.168.201.111) port 44301 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, protocol version (582):
* error:0A000102:SSL routines::unsupported protocol
* Closing connection 0
curl: (35) error:0A000102:SSL routines::unsupported protocol
И еще:
root@nginx:/home/xxx# openssl s_client -connect 192.168.201.111:44301
CONNECTED(00000003)
40A77EF2787F0000:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 58 bytes and written 300 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
Помогите мне отключить эту проверку сертификата.
ОБНОВЛЕНИЕ №1
В C# я делаю что-то вроде этого для настройки RestClient (в Windows это работает нормально, но в Ubuntu не получается):
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls;
ServicePointManager.ServerCertificateValidationCallback = (s, ce, ca, p) => true;
FileInfo certFile = new (certFileName);
if (certFile.Exists is false) throw new FileNotFoundException("Certificate file not found");
X509Certificate2Collection certificates = new X509Certificate2Collection();
certificates.Import(certFile.FullName, certPassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);
ServicePointManager.ServerCertificateValidationCallback = (_, _, _, _) => true;
var options = new RestClientOptions(baseUrl)
{
FollowRedirects = true,
ClientCertificates = certificates,
RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true
};
Client = new RestClient(options);
UPD2
root@nginx:/home/xxx# openssl s_client -tls1 -cipher 'DEFAULT:@SECLEVEL=1' -connect 192.168.201.111:44301
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 CN = ORGANIZATION
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=1 CN = ORGANIZATION
verify return:1
depth=0 CN = OFFICE1
verify return:1
405744F5247F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:../ssl/statem/statem_clnt.c
---
Certificate chain
0 s:CN = OFFICE1
i:CN = ORGANIZATION
a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA512
v:NotBefore: Sep 26 12:10:32 2018 GMT; NotAfter: Sep 23 12:10:32 2028 GMT
1 s:CN = ORGANIZATION
i:CN = ORGANIZATION
a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA1
v:NotBefore: Sep 26 12:10:29 2018 GMT; NotAfter: Sep 23 12:10:29 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
(i replace cert with *)
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
-----END CERTIFICATE-----
subject=CN = OFFICE1
issuer=CN = ORGANIZATION
---
No client certificate CA names sent
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 1657 bytes and written 111 bytes
Verification error: self-signed certificate in certificate chain
---
New, (NONE), Cipher is (NONE)
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1654443076
Timeout : 7200 (sec)
Verify return code: 19 (self-signed certificate in certificate chain)
Extended master secret: no
---
Подробнее здесь: https://stackoverflow.com/questions/725 ... -on-ubuntu
