在 Ubuntu 上禁用证书验证

Question

我有一个非常古老的遗留项目，它的 Web API，我确实需要调用它（它托管在 Windows Server 2012 上）。此 API 需要 .p12 预制客户端证书包含在对其的请求中，我有一个。

它仅适用于 HTTPS，并且有一个奇怪的证书。

如果我在 Windows 10 上调试我的

.net 6

项目（使用

RestSharp

调用） - 没问题，但在

Ubuntu 22.04 LTS

上我遇到了问题。

在

TLSv1.0

中添加

TLSv1.1

或

TLSv1.2

或

/etc/ssl/openssl.cnf

支持 - 不起作用。

使用

curl -k

或

--insecure

- 不起作用。

root@nginx:/home/xxx# curl -vvv  https://192.168.201.111:44301/api/
*   Trying 192.168.201.111:44301...
* Connected to 192.168.201.111 (192.168.201.111) port 44301 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, protocol version (582):
* error:0A000102:SSL routines::unsupported protocol
* Closing connection 0
curl: (35) error:0A000102:SSL routines::unsupported protocol

还有：

root@nginx:/home/xxx# openssl s_client -connect 192.168.201.111:44301
CONNECTED(00000003)
40A77EF2787F0000:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1952:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 58 bytes and written 300 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

请帮助我禁用此证书验证。

更新#1

在 C# 中，我执行类似的操作来配置

RestClient

（在 Windows 上工作正常，但在 Ubuntu 上失败）：

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls; 
ServicePointManager.ServerCertificateValidationCallback = (s, ce, ca, p) => true;
FileInfo certFile = new (certFileName);
if (certFile.Exists is false) throw new FileNotFoundException("Certificate file not found");
X509Certificate2Collection certificates = new X509Certificate2Collection();
certificates.Import(certFile.FullName, certPassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);
ServicePointManager.ServerCertificateValidationCallback = (_, _, _, _) => true;

var options = new RestClientOptions(baseUrl)
{
    FollowRedirects = true,
    ClientCertificates = certificates,
    RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true
};
Client = new RestClient(options);

UPD2

root@nginx:/home/xxx# openssl s_client -tls1 -cipher 'DEFAULT:@SECLEVEL=1'  -connect 192.168.201.111:44301
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 CN = ORGANIZATION
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=1 CN = ORGANIZATION
verify return:1
depth=0 CN = OFFICE1
verify return:1
405744F5247F0000:error:0A0C0103:SSL routines:tls_process_key_exchange:internal error:../ssl/statem/statem_clnt.c:2248:
---
Certificate chain
 0 s:CN = OFFICE1
   i:CN = ORGANIZATION
   a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA512
   v:NotBefore: Sep 26 12:10:32 2018 GMT; NotAfter: Sep 23 12:10:32 2028 GMT
 1 s:CN = ORGANIZATION
   i:CN = ORGANIZATION
   a:PKEY: rsaEncryption, 1024 (bit); sigalg: RSA-SHA1
   v:NotBefore: Sep 26 12:10:29 2018 GMT; NotAfter: Sep 23 12:10:29 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
(i replace cert with *)
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
*************************************************
-----END CERTIFICATE-----
subject=CN = OFFICE1
issuer=CN = ORGANIZATION
---
No client certificate CA names sent
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 1657 bytes and written 111 bytes
Verification error: self-signed certificate in certificate chain
---
New, (NONE), Cipher is (NONE)
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1654443076
    Timeout   : 7200 (sec)
    Verify return code: 19 (self-signed certificate in certificate chain)
    Extended master secret: no
---

Answer 1

... routines:ssl_choose_client_version:unsupported protocol: ...
...

请帮助我禁用此证书验证。

该错误与证书验证无关，而是与 TLS 协议版本有关。人们可以通过

强制执行 TLS 1.0

openssl s_client -tls1 -cipher 'DEFAULT:@SECLEVEL=1' ... 

此 API 要求在请求中包含 .p12 预制客户端证书，我有一个。

您还需要添加客户端证书：

openssl s_client -cert cert.p12 -inform p12 ...

verify error:num=19:self-signed certificate in certificate chain

您需要添加 CA

openssl s_client -CAfile ca.pem ...

CA 不是由服务器发送的，因此您必须询问负责人才能获得 CA。