Question

如果我尝试使用openssl或wget而不显式传递ca目录，则证书无法验证。我想让ubuntu回到可以轻松验证google.com之类的正常网站的原始状态。是否需要设置环境变量或启用符号链接以正确配置它？

chris@chris:~$ wget --ca-directory=/etc/ssl/certs https://google.com
--2019-04-13 12:42:12--  https://google.com/
Resolving google.com (google.com)... 172.217.4.206, 2607:f8b0:4009:807::200e
Connecting to google.com (google.com)|172.217.4.206|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://www.google.com/ [following]
--2019-04-13 12:42:12--  https://www.google.com/
Resolving www.google.com (www.google.com)... 172.217.4.36, 2607:f8b0:4009:80f::2004
Connecting to www.google.com (www.google.com)|172.217.4.36|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html.5’

index.html.5                                      [ <=>                                                                                             ]  11.07K  --.-KB/s    in 0.004s

2019-04-13 12:42:12 (2.88 MB/s) - ‘index.html.5’ saved [11340]

chris@chris:~$ wget https://google.com
--2019-04-13 12:42:19--  https://google.com/
Resolving google.com (google.com)... 172.217.4.206, 2607:f8b0:4009:807::200e
Connecting to google.com (google.com)|172.217.4.206|:443... connected.
ERROR: cannot verify google.com's certificate, issued by ‘CN=Google Internet Authority G3,O=Google Trust Services,C=US’:
  Unable to locally verify the issuer's authority.
To connect to google.com insecurely, use `--no-check-certificate'.

如果我未明确传递-CApath

，则这与openssl行为相同

-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
issuer=/C=US/O=Google Trust Services/CN=Google Internet Authority G3
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2962 bytes and written 261 bytes
Verification error: unable to get local issuer certificate
---

Answer 1

这解决了我的问题

export SSL_CERT_DIR=/etc/ssl/certs

openssl / wget仅在我明确指定ca目录时有效

1 个答案: