Question

我已经阅读了关于认证错误的无尽帖子，基本上可以说是关闭验证或修复证书。然而，在我们的项目中，我们确实使用了证书，但是我们无法使用它。 SA和2程序员已经尝试了我们能想到的一切，没有任何工作。很明显，我们不知道我们在做什么。

首先，这是我们在简单连接上得到的错误并获得perl程序。 WEBHOSTNAME替换真实的网络主机名。

perl -MIO::Socket::SSL=debug30 testerTut2.pl
DEBUG: .../IO/Socket/SSL.pm:1784: new ctx 46260896
DEBUG: .../IO/Socket/SSL.pm:446: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:448: socket connected
DEBUG: .../IO/Socket/SSL.pm:466: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:501: using SNI with hostname WEBHOSTNAME
DEBUG: .../IO/Socket/SSL.pm:524: set socket to non-blocking to enforce timeout=10
DEBUG: .../IO/Socket/SSL.pm:537: Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:547: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:557: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:577: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:1772: ok=0 cert=46303216
DEBUG: .../IO/Socket/SSL.pm:537: Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:1408: SSL connect attempt failed with unknown error

DEBUG: .../IO/Socket/SSL.pm:543: fatal SSL error: SSL connect attempt failed with unknown error error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
DEBUG: .../IO/Socket/SSL.pm:1821: free ctx 46260896 open=46260896
DEBUG: .../IO/Socket/SSL.pm:1826: free ctx 46260896 callback
DEBUG: .../IO/Socket/SSL.pm:1829: OK free ctx 46260896
500 Can't connect to WEBHOSTNAME:443 at testerTut2.pl line 34.

这是perl程序：

#!/bin/perl
require LWP::UserAgent;
use LWP::Protocol::https;

#note USERNAME is where the real account name goes
my $ua = LWP::UserAgent->new( ssl_opts => { verify_hostname => 1, SSL_ca_file => '/home/USERNAME/ca-bundle.crt'});
$ua->timeout(10);
$ua->env_proxy;

#note hostname is where the real web host name goes
my $response = $ua->get('https://hostname/tut/ops/data/newtut.dat');
if ($response->is_success) 
{
    print $response->content;
    print $response->decoded_content;  # or whatever
}
else 
{
    die $response->status_line;
}

SA已在Web服务器上签名。再次将webhostname替换为真实的web主机名。

openssl s_client -connect lomweb01:443 -showcerts
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
CONNECTED(00000003)
depth=0 C = US, ST = MD, L = Greenbelt, O = NASA, OU = MMS, CN = webhostname.edtfmmslinux.ecs.nasa.gov
verify error:num=18:self signed certificate
verify return:1
depth=0 C = US, ST = MD, L = Greenbelt, O = NASA, OU = MMS, CN = webhostname.edtfmmslinux.ecs.nasa.gov
verify return:1
---
Certificate chain
 0 s:/C=US/ST=MD/L=Greenbelt/O=NASA/OU=MMS/CN=webhostname .edtfmmslinux.ecs.nasa.gov
   i:/C=US/ST=MD/L=Greenbelt/O=NASA/OU=MMS/CN=webhostname .edtfmmslinux.ecs.nasa.gov
-----BEGIN CERTIFICATE-----
MIIDbDCCAlQC  etc etc k7Pr1nRQG
3/NKQVqaSITGHGZBtlKjpw==
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=MD/L=Greenbelt/O=NASA/OU=MMS/CN=webhostname .edtfmmslinux.ecs.nasa.gov
issuer=/C=US/ST=MD/L=Greenbelt/O=NASA/OU=MMS/CN=webhostname .edtfmmslinux.ecs.nasa.gov
---
No client certificate CA names sent
---
SSL handshake has read 1639 bytes and written 711 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 921941EFFB19FA3158C751D155C012D5A418425BFAE94FEA1D99231A3CEF5D3C
    Session-ID-ctx:
    Master-Key: 13BFF7BE2B8ED18056BA54415026FC1ED133F47BADE2683A5EB3A2FED15F34ABD3F837985A498404A948B7F5B1F4774B
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - d6 99 6e 28 8c 86 5e 9b-e2 e8  etc. etc.
    00b0 - 20 96 ea 05 9

    Start Time: 1466432096
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---

在客户端框中，我在USERNAME主目录中创建了一个本地ca-bundle.crt文件。我“cp /etc/pki/tls/certs/WEBSERVER.crt~/ ca-bundle.crt”并让perl脚本将SSL_ca_file值设置为其路径。

Apache配置文件已更新为使用/etc/pki/tls/cert/WEBSERVER.crt文件并重新启动。

它仍然不起作用。我们尝试过不同的Web主机名模式但没有变化。我们不知道为什么证书不起作用，但我们认为我们正确地遵循了说明。我们接受证书后，Firefox很高兴，但perl不是。那么我们做错了什么？

Answer 1

在使用perl脚本后，它变成了sybase。 sybase客户端附带了一个不兼容的openssl版本。 Net :: SSLeay是openssl的接口。 IO :: Socket :: SSL使用Net :: SSLLeay，LWP :: UserAgent使用IO :: Socket :: SSL。运行perl脚本时，PATH前面有sybase目录。 sybase有自己的CA文件与CA RHEL 7不兼容/过时，并且它会在到达ca.pem时读取sybase CA首先弄乱所有内容。为了解决这个问题，我们更改了perl脚本以从PATH中删除sybase目录，然后SSL_ca_file选项正常工作。

my $ua = LWP::UserAgent->new( ssl_opts => { verify_hostname => 1, SSL_ca_file => '/home/<server account>/certs/ca.pem'});

这是我们进入RHEL 7后的第二个sybase副作用。另一个是sybase，将文件描述符限制增加到4096，而标准1024导致硬编码为1024的数组中的边界溢出。

Linux 7.2上自签名的证书验证失败

1 个答案: