我有一个基于Linux的Docker容器,如果这样做的话:
curl https://google.com
...然后我得到一个错误:
卷曲:(60)SSL证书问题:证书链中的自签名证书 此处有更多详细信息:https://curl.haxx.se/docs/sslcerts.html
任何URL都会发生同样的情况-并不是Google错了。
上面引用的链接建议了各种解决方案,除了最后一个建议更新证书存储之外,其他解决方案似乎都不合适。但是,没有关于如何执行此操作的说明(或者至少没有对我有意义的说明)。
这是正确的做法吗?如果可以,怎么办?
更新:根据要求,结果如下:
openssl s_client -showcerts -connect www.google.com:443
CONNECTED(00000003)
depth=3 DC = com, DC = forestroot, CN = SHA256RootCA
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
i:/CN=ssl-decrypt
-----BEGIN CERTIFICATE-----
MIIDXzCCAkegAwIBAgIIXIk3p8xOX/kwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UE
AxMLc3NsLWRlY3J5cHQwHhcNMTgxMjE5MDgxNzAwWhcNMTkwMzEzMDgxNzAwWjBo
...
tq0VAGIoj4+YhO6bktTq3alCRoLstJuuxjVdb1wRkH4YRi0I6ZAB1Cw+M8Lg+2eQ
KuEo
-----END CERTIFICATE-----
1 s:/CN=ssl-decrypt
i:/DC=com/DC=bgs/CN=SHA256IssueCA
-----BEGIN CERTIFICATE-----
MIIGzDCCBLSgAwIBAgITEQAADvB9T7mSaacwDQABAAAO8DANBgkqhkiG9w0BAQsF
ADBCMRMwEQYKCZImiZPyLGQBGRYDY29tMRMwEQYKCZImiZPyLGQBGRYDYmdzMRYw
...
1z9f/nkj2XTRyGeACoy0qRd5uXJHp1iGM27l3RFDR9OjrfPV56pOBUYWAlc9Nn+1
Vr3qUZrcCkROrmYisVF4jg==
-----END CERTIFICATE-----
2 s:/DC=com/DC=MyCompanyServer/CN=SHA256IssueCA
i:/DC=com/DC=MyCompanyServer/CN=SHA256RootCA
-----BEGIN CERTIFICATE-----
MIIH4zCCBcugAwIBAgITOQAAAAOa4wv9nnK0uQAAAAAAAzANBgkqhkiG9w0BAQsF
ADBIMRMwEQYKCZImiZPyLGQBGRYDY29tMRowGAYKCZImiZPyLGQBGRYKZm9yZXN0
...
IomErcbcymIWBmN75PVMsk9EMyqDP394jG8+IOK+lVUVX4pxzhdd7eYbqTAwDE1X
bNWcZZkt/w==
-----END CERTIFICATE-----
3 s:/DC=com/DC=MyCompanyServer/CN=SHA256RootCA
i:/DC=com/DC=MyCompanyServer/CN=SHA256RootCA
-----BEGIN CERTIFICATE-----
MIIFgzCCA2ugAwIBAgIQULxmYXGJ1aFIlIyCHA4NIzANBgkqhkiG9w0BAQsFADBI
MRMwEQYKCZImiZPyLGQBGRYDY29tMRowGAYKCZImiZPyLGQBGRYKZm9yZXN0cm9v
...
jQBLY0/KIjHywv66GhtVWpexgQcXrLxQP2VHW7eXpsylvwkNU5XNQYzHTB7u+w5C
VunfRLt/7mVWyURcwkOre38tVSByKR4=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
issuer=/CN=ssl-decrypt
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 6556 bytes and written 302 bytes
Verification error: self signed certificate in certificate chain
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: 723D9976F985887CA5F256EE3C2E7B44B9C98A6B440AAF4E19564AE101F78D00
Session-ID-ctx:
Master-Key: C3D8759A753C1D269FF9C00854E59B8C10ABC1E94AFE9F0166486A649FE295ACE1AF5E5BEDB0129E557E781BC860D2FA
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1548690163
Timeout : 7200 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
Extended master secret: yes
---
read:errno=0
我从中收集的信息是,该链中存在我所工作的公司的证书(我将其重命名为MyCompanyServer),我想这就是问题所在。
我是否认为我需要为该证书安装某种密钥?对我来说这一切都很希腊,所以为新手问题道歉。
答案 0 :(得分:4)
可能您的容器中没有正确的CA证书,因此无法验证TLS连接。
尝试安装ca-certificates
软件包(软件包的名称可能不同,取决于所使用的发行版)。
更新:
您的公司检查公司网络中的TLS连接,因此原始证书将替换为您的公司证书。您需要将公司CA证书添加到根CA证书。
Linux(Ubuntu,Debian):
/usr/local/share/ca-certificates/
sudo update-ca-certificates
如果您的主机操作系统已经正确地预配置了CA证书(包括公司CA证书),则可以将它们作为卷挂载到容器中:
docker run \
-v /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt \
...
典型的CA证书位置:
/etc/ssl/certs/ca-certificates.crt
Debian / Ubuntu / Gentoo等。/etc/pki/tls/certs/ca-bundle.crt
Fedora / RHEL 6 /etc/ssl/ca-bundle.pem
OpenSUSE /etc/pki/tls/cacert.pem
OpenELEC /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
CentOS / RHEL 7 答案 1 :(得分:1)
好的,我刚刚添加了此语句,现在可以正常工作了。
CURLOPT_SSL_VERIFYPEER => 0,
答案 2 :(得分:0)
我正在使用此代码发送cUrl请求,但没有成功,并引发了此错误:
SSL证书问题:证书链中的自签名证书 php curl
curl_setopt($ch, CURLOPT_URL, "https://test.example.com/v1/authenticate.json?api_key=123456");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch,CURLOPT_SSL_VERIFYHOST,0);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_FAILONERROR, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch,CURLOPT_CAINFO,'cert.embedapp.20191004.pem');
curl_setopt($ch,CURLOPT_CAPATH,'./cert.embedapp.20191004.pem');
尝试所有步骤后,我已将cUrl请求更改为:
curl_setopt($ch, CURLOPT_URL, "https://test.example.com/v1/authenticate.json?api_key=123456");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,0);
curl_setopt($ch, CURLOPT_FAILONERROR, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_SSLCERT,'cert.embedapp.20191004.pem');
最后对我有用:)