Centos 6. 最近更新 ca-certificates 后,我遇到了一些麻烦。我拥有适用于 centos 6 的最新版本的 curl:
-bash-4.1$ curl -V -v
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp
Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz
然后 wget:
-bash-4.1$ wget -V -v
GNU Wget 1.12 built on linux-gnu.
+digest +ipv6 +nls +ntlm +opie +md5/openssl +https -gnutls +openssl
-iri
Wgetrc:
/etc/wgetrc (system)
Locale: /usr/share/locale
Compile: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc"
-DLOCALEDIR="/usr/share/locale" -I. -I../lib -O2 -g -pipe -Wall
-Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector
--param=ssp-buffer-size=4 -m64 -mtune=generic -fno-strict-aliasing
Link: gcc -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
-fno-strict-aliasing -Wl,-z,relro -lssl -lcrypto
/usr/lib64/libssl.so /usr/lib64/libcrypto.so -ldl -lrt ftp-opie.o
openssl.o http-ntlm.o gen-md5.o ../lib/libgnu.a
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://www.gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Originally written by Hrvoje Niksic <[email protected]>.
Currently maintained by Micah Cowan <[email protected]>.
Please send bug reports and questions to <[email protected]>.
现在我遇到了 CA 证书问题https://www.certum.pl/. curl 工作正常:
-bash-4.1$ curl -v 'https://certum.pl/'
* About to connect() to certum.pl port 443 (#0)
* Trying 213.222.201.147... connected
* Connected to certum.pl (213.222.201.147) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
* subject: CN=certum.pl,businessCategory=Private Organization,serialNumber=0000421310,incorporationState=pomorskie,incorporationLocality=Gdańsk,incorporationCountry=PL,postalCode=81-321,STREET=Podolska 21,ST=pomorskie,L=Gdynia,OU=Certification Authority Division,O=Asseco Data Systems S.A.,C=PL
* start date: Aug 16 09:10:07 2017 GMT
* expire date: Aug 16 09:10:07 2019 GMT
* common name: certum.pl
* issuer: CN=Certum Extended Validation CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: certum.pl
> Accept: */*
>
< HTTP/1.1 302 Found
< Date: Tue, 17 Jul 2018 07:02:41 GMT
< Server: Apache
< Pragma: no-cache
< Location: https://www.certum.pl/pl/
< Content-Length: 209
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://www.certum.pl/pl/">here</a>.</p>
</body></html>
* Closing connection #0
但是 wget 返回ERROR
:
-bash-4.1$ wget -d -O- 'https://certum.pl/'
Setting --output-document (outputdocument) to -
DEBUG output created by Wget 1.12 on linux-gnu.
--2018-07-17 09:04:42-- https://certum.pl/
Resolving certum.pl... 213.222.201.147
Caching certum.pl => 213.222.201.147
Connecting to certum.pl|213.222.201.147|:443... connected.
Created socket 3.
Releasing 0x0000000000d2af00 (new refcount 1).
Initiating SSL handshake.
Handshake successful; connected socket 3 to SSL handle 0x0000000000d4bb40
certificate:
subject: /C=PL/O=Asseco Data Systems S.A./OU=Certification Authority Division/L=Gdynia/ST=pomorskie/street=Podolska 21/postalCode=81-321/1.3.6.1.4.1.311.60.2.1.3=PL/1.3.6.1.4.1.311.60.2.1.1=Gda\\xC5\\x84sk/1.3.6.1.4.1.311.60.2.1.2=pomorskie/serialNumber=0000421310/businessCategory=Private Organization/CN=certum.pl
issuer: /C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Extended Validation CA SHA2
ERROR: cannot verify certum.pl's certificate, issued by `/C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Extended Validation CA SHA2':
Unable to locally verify the issuer's authority.
To connect to certum.pl insecurely, use `--no-check-certificate'.
Closed 3/SSL 0x0000000000d4bb40
当我在命令中指定 CA 证书时也会发生同样的情况 - 对于 wget:--ca-certificate=/etc/pki/tls/certs/ca-bundle.crt
和 curl:--cacert /etc/pki/tls/certs/ca-bundle.crt
ca-certificates 版本现在2018.2.22-65.1.el6
为最新版本。 openssl 版本现在1.0.1e-57.el6
为最新版本。
你知道发生什么事了吗?
答案1
wget
与 OpenSSL 链接,而 curl 与 NSS 加密库链接,这可能解释了为什么它们使用不同的信任库。
我附近没有 RHEL 6 系统,但rpm -ql nss
与 OpenSSL 使用的相比可能会显示不同/额外的信任存储。
此 Red Hat 资源可能相关https://access.redhat.com/solutions/1549003
简而言之:update-ca-trust extract
答案2
我对 Centos 6 中这个问题的解决方案是将“缺失”的 CA 证书添加到由 管理的信任存储中ca-certificates
。我不知道他们为什么在那次更新中删除了它。所以:
- 从页面“复制根 CA 证书”https://certum.pl/“ 到
/etc/pki/ca-trust/source/anchors/
- 执行:
update-ca-trust enable
- 执行:
update-ca-trust extract
但我还是不完全明白为什么wget
它不起作用,为什么又curl
起作用了。当我尝试时rpm -ql nss
,没有关于任何其他信任存储的信息。我不知道它在哪里。