Статус: Сотрудник
Группы: Администраторы, Участники
Зарегистрирован: 16.04.2008(UTC)
Сообщений: 1,500
Сказал(а) «Спасибо»: 42 раз
Поблагодарили: 609 раз в 421 постах
|
Отмена: у первого URL проблема не в редиректе, мы его поддерживаем. Проблема в том, что редирект делается на https и именно https соединение не устанавливается: Код:user@test-x86-deb9:/home/user/tmp$ /opt/cprocsp/bin/ia32/cryptcp -copycert -thumb 143fe93ada1b49e17c740f7860221966bfdcc39d -df /tmp/t2.cer
CryptCP 5.0 (Debug version) (c) "Crypto-Pro", 2002-2019.
Command prompt Utility for file signature and encryption.
Parameters: -copycert -thumb 143fe93ada1b49e17c740f7860221966bfdcc39d -df /tmp/t2.cer
The following certificate will be used:
RDN:sk-formula.ai@mail.ru
Valid from 23.01.2019 06:40:09 to 23.04.2020 06:50:09
* 06-21-2019 12:44:02.437358 0 About to connect() to izhtender.ru port 80 (#0)
* 06-21-2019 12:44:02.437646 1 Trying 77.246.145.194... * 06-21-2019 12:44:02.440642 2 connected
* 06-21-2019 12:44:02.440857 3 Connected to izhtender.ru (77.246.145.194) port 80 (#0)
> 06-21-2019 12:44:02.441113 4 GET /help/02994f73db9396c4402b941e5bef05a6b061886a.cer HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: izhtender.ru
Accept: */*
* 06-21-2019 12:44:02.443981 5 HTTP 1.1 or later with persistent connection, pipelining supported
< 06-21-2019 12:44:02.444191 6 HTTP/1.1 301 Moved Permanently
< 06-21-2019 12:44:02.444418 7 Server: nginx
< 06-21-2019 12:44:02.444635 8 Date: Fri, 21 Jun 2019 09:44:02 GMT
< 06-21-2019 12:44:02.444847 9 Content-Type: text/html
< 06-21-2019 12:44:02.445061 10 Content-Length: 178
< 06-21-2019 12:44:02.445267 11 Connection: keep-alive
< 06-21-2019 12:44:02.445478 12 Location: https://izhtender.ru:443/help/02994f73db9396c4402b941e5bef05a6b061886a.cer
< 06-21-2019 12:44:02.445683 13
* 06-21-2019 12:44:02.445880 14 Ignoring the response-body
* 06-21-2019 12:44:02.446109 15 Connection #0 to host izhtender.ru left intact
* 06-21-2019 12:44:02.446286 16 Issue another request to this URL: 'https://izhtender.ru:443/help/02994f73db9396c4402b941e5bef05a6b061886a.cer'
* 06-21-2019 12:44:02.446956 17 About to connect() to izhtender.ru port 443 (#1)
* 06-21-2019 12:44:02.447321 18 Trying 77.246.145.194... * 06-21-2019 12:44:02.450524 19 connected
* 06-21-2019 12:44:02.450760 20 Connected to izhtender.ru (77.246.145.194) port 443 (#1)
* 06-21-2019 12:44:02.492220 21 Closing connection #1
* 06-21-2019 12:44:02.492592 22 Problem with the local SSL certificate
* 06-21-2019 12:44:02.492851 23 Closing connection #0
* 06-21-2019 12:44:02.500748 24 About to connect() to ca.izhtender.ru port 80 (#0)
* 06-21-2019 12:44:02.501002 25 Trying 37.140.192.211... * 06-21-2019 12:44:02.503271 26 connected
* 06-21-2019 12:44:02.503514 27 Connected to ca.izhtender.ru (37.140.192.211) port 80 (#0)
> 06-21-2019 12:44:02.503757 28 GET /help/02994f73db9396c4402b941e5bef05a6b061886a.cer HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: ca.izhtender.ru
Accept: */*
...
Раздача CRL и AIA по https является логической ошибкой. Но мы и это поддерживаем, причём в КриптоПро CSP 4.0 - только ГОСТ TLS, а в КриптоПро CSP 5.0 - и ГОСТ TLS и TLS на иностранных алгоритмах. Но проблема в том, что сертификат веб-сервера у вас выпущен на УЦ Let's Encrypt: Код:user@test-x86-deb9:/tmp$ /opt/cprocsp/bin/ia32/csptest -tlsc -server izhtender.ru -port 443 -file /help/02994f73db9396c4402b941e5bef05a6b061886a.cer -v -nosave -savecert /tmp/lets.cer
11 algorithms supported:
Aglid Class OID
[00] 0x661e 0x6000 1.2.643.2.2.21 (ГОСТ 28147-89)
[01] 0x6631 0x6000 1.2.643.7.1.1.5.2.1 (ГОСТ Р 34.12-2015 Кузнечик CTR-ACPKM)
[02] 0x6630 0x6000 1.2.643.7.1.1.5.1.1 (ГОСТ Р 34.12-2015 Магма CTR-ACPKM)
...
Server certificate:
Subject: CN=izhtender.ru
Valid : 22.06.2019 08:14:46 - 20.09.2019 08:14:46 (UTC)
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Error 0x800b0109 (CERT_E_UNTRUSTEDROOT) returned by CertVerifyCertificateChainPolicy!
An error occurred in running the program.
/dailybuilds/CSPbuild/CSP/samples/csptest/WebClient.c:858:Error authenticating server credentials!
Error number 0x800b0109 (-2146762487).
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Total: SYS: 0.000 sec USR: 0.140 sec UTC: 0.190 sec
[ErrorCode: 0x800b0109]
CERT_E_UNTRUSTEDROOT означает, что надо поставить корневой, ставим: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/bin/ia32/certmgr -inst -store mroot -file /tmp/lets.cer
Certmgr 1.1 (debug version) (c) "Crypto-Pro", 2007-2019.
program for managing certificates, CRLs and stores
=============================================================================
1-------
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Subject : CN=izhtender.ru
Serial : 0x037E027A64CC0A21A466733DF05832D06E77
SHA1 Hash : 514b963f2bd641a6760892d118243268393e0627
SubjKeyID : d0f6c0fcbbb5b4f8d679a51bc5685e2a145d44e7
Signature Algorithm : sha256RSA
PublicKey Algorithm : RSA (4096 bits)
Not valid before : 22/06/2019 08:14:46 UTC
Not valid after : 20/09/2019 08:14:46 UTC
PrivateKey Link : No
OCSP URL : http://ocsp.int-x3.letsencrypt.org
CA cert URL : http://cert.int-x3.letsencrypt.org/
Extended Key Usage : 1.3.6.1.5.5.7.3.1 Проверка подлинности сервера
1.3.6.1.5.5.7.3.2 Проверка подлинности клиента
2-------
Issuer : O=Digital Signature Trust Co., CN=DST Root CA X3
Subject : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Serial : 0x0A0141420000015385736A0B85ECA708
SHA1 Hash : e6a3b45b062d509b3382282d196efe97d5956ccb
SubjKeyID : a84a6a63047dddbae6d139b7a64565eff3a8eca1
Signature Algorithm : sha256RSA
PublicKey Algorithm : RSA (2048 bits)
Not valid before : 17/03/2016 16:40:46 UTC
Not valid after : 17/03/2021 16:40:46 UTC
PrivateKey Link : No
OCSP URL : http://isrg.trustid.ocsp.identrust.com
CA cert URL : http://apps.identrust.com/roots/dstrootcax3.p7c
CDP : http://crl.identrust.com/DSTROOTCAX3CRL.crl
=============================================================================
Please choose index
2
Installing:
=============================================================================
1-------
Issuer : O=Digital Signature Trust Co., CN=DST Root CA X3
Subject : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Serial : 0x0A0141420000015385736A0B85ECA708
SHA1 Hash : e6a3b45b062d509b3382282d196efe97d5956ccb
SubjKeyID : a84a6a63047dddbae6d139b7a64565eff3a8eca1
Signature Algorithm : sha256RSA
PublicKey Algorithm : RSA (2048 bits)
Not valid before : 17/03/2016 16:40:46 UTC
Not valid after : 17/03/2021 16:40:46 UTC
PrivateKey Link : No
OCSP URL : http://isrg.trustid.ocsp.identrust.com
CA cert URL : http://apps.identrust.com/roots/dstrootcax3.p7c
CDP : http://crl.identrust.com/DSTROOTCAX3CRL.crl
=============================================================================
[ErrorCode: 0x00000000]
Это почему-то не устраняет проблему, цепочка строится до реального корня и то, что Let's Encrypt (промежуточный) лежит в mroot не спасает (похоже на ошибку у нас): Код:root@test-x86-deb9:/tmp# CP_PRINT_CHAIN_DETAIL=1 /opt/cprocsp/bin/ia32/csptest -tlsc -server izhtender.ru -port 443 -file /help/02994f73db9396c4402b941e5bef05a6b061886a.cer -v -nosave -savecert /tmp/lets.cer
11 algorithms supported:
Aglid Class OID
[00] 0x661e 0x6000 1.2.643.2.2.21 (ГОСТ 28147-89)
[01] 0x6631 0x6000 1.2.643.7.1.1.5.2.1 (ГОСТ Р 34.12-2015 Кузнечик CTR-ACPKM)
[02] 0x6630 0x6000 1.2.643.7.1.1.5.1.1 (ГОСТ Р 34.12-2015 Магма CTR-ACPKM)
...
Server certificate:
Subject: CN=izhtender.ru
Valid : 22.06.2019 08:14:46 - 20.09.2019 08:14:46 (UTC)
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
1.Find path for:
Subject:'CN=izhtender.ru'
AltName:dNSName=izhtender.ru
Issuer:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Found at store 0x8689008:
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Found at store 0x86a6fe8:
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Downloaded:
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
2.Find path for:
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Downloaded:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
3.Find path for:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Downloaded:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
3.Find path for:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
There is no valid issuer.
Downloaded:
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
2.Find path for:
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Found at attached list:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Downloaded:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
3.Find path for:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
3.Find path for:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Downloaded:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
3.Find path for:
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
There is no valid issuer.
There is no valid issuer.
----------- Error chain -----------
Chain status:IS_UNTRUSTED_ROOT
Revocation reason:unspecified
1.
Subject:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Cert status:IS_UNTRUSTED_ROOT
2.
Subject:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Issuer:'O=Digital Signature Trust Co., CN=DST Root CA X3'
Cert status:CERT_TRUST_NO_ERROR
3.
Subject:'CN=izhtender.ru'
AltName:dNSName=izhtender.ru
Issuer:'C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3'
Cert status:CERT_TRUST_NO_ERROR
Error 0x800b0109 (CERT_E_UNTRUSTEDROOT) returned by CertVerifyCertificateChainPolicy!
An error occurred in running the program.
/dailybuilds/CSPbuild/CSP/samples/csptest/WebClient.c:858:Error authenticating server credentials!
Error number 0x800b0109 (-2146762487).
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Total: SYS: 0.030 sec USR: 0.160 sec UTC: 0.240 sec
[ErrorCode: 0x800b0109]
Хорошо, возьмём из кэша реальный рут и поставим его в корневые: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/bin/ia32/certmgr -export -dn 'Digital Signature Trust Co., CN=DST Root CA X3' -store ucache -dest /tmp/ds_root.cer
Certmgr 1.1 (debug version) (c) "Crypto-Pro", 2007-2019.
program for managing certificates, CRLs and stores
Exporting:
=============================================================================
1-------
Issuer : O=Digital Signature Trust Co., CN=DST Root CA X3
Subject : O=Digital Signature Trust Co., CN=DST Root CA X3
Serial : 0x44AFB080D6A327BA893039862EF8406B
SHA1 Hash : dac9024f54d8f6df94935fb1732638ca6ad77c13
SubjKeyID : c4a7b1a47b2c71fadbe14b9075ffc41560858910
Signature Algorithm : sha1RSA
PublicKey Algorithm : RSA (2048 bits)
Not valid before : 30/09/2000 21:12:19 UTC
Not valid after : 30/09/2021 14:01:15 UTC
PrivateKey Link : No
=============================================================================
Export complete
[ErrorCode: 0x00000000]
root@test-x86-deb9:/tmp# /opt/cprocsp/bin/ia32/certmgr -inst -store mroot -file /tmp/ds_root.cer
Certmgr 1.1 (debug version) (c) "Crypto-Pro", 2007-2019.
program for managing certificates, CRLs and stores
Installing:
=============================================================================
1-------
Issuer : O=Digital Signature Trust Co., CN=DST Root CA X3
Subject : O=Digital Signature Trust Co., CN=DST Root CA X3
Serial : 0x44AFB080D6A327BA893039862EF8406B
SHA1 Hash : dac9024f54d8f6df94935fb1732638ca6ad77c13
SubjKeyID : c4a7b1a47b2c71fadbe14b9075ffc41560858910
Signature Algorithm : sha1RSA
PublicKey Algorithm : RSA (2048 bits)
Not valid before : 30/09/2000 21:12:19 UTC
Not valid after : 30/09/2021 14:01:15 UTC
PrivateKey Link : No
=============================================================================
[ErrorCode: 0x00000000]
Теперь ошибка при проверке цепочки меняется на CERT_E_REVOCATION_FAILURE: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/bin/ia32/csptest -tlsc -server izhtender.ru -port 443 -file /help/02994f73db9396c4402b941e5bef05a6b061886a.cer -v -nosave -savecert /tmp/lets.cer
11 algorithms supported:
Aglid Class OID
[00] 0x661e 0x6000 1.2.643.2.2.21 (ГОСТ 28147-89)
[01] 0x6631 0x6000 1.2.643.7.1.1.5.2.1 (ГОСТ Р 34.12-2015 Кузнечик CTR-ACPKM)
[02] 0x6630 0x6000 1.2.643.7.1.1.5.1.1 (ГОСТ Р 34.12-2015 Магма CTR-ACPKM)
...
Server certificate:
Subject: CN=izhtender.ru
Valid : 22.06.2019 08:14:46 - 20.09.2019 08:14:46 (UTC)
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Error 0x800b010e (CERT_E_REVOCATION_FAILURE) returned by CertVerifyCertificateChainPolicy!
An error occurred in running the program.
/dailybuilds/CSPbuild/CSP/samples/csptest/WebClient.c:858:Error authenticating server credentials!
Error number 0x800b010e (-2146762482).
The revocation process could not continue - the certificate(s) could not be checked.
Total: SYS: 0.010 sec USR: 0.180 sec UTC: 0.260 sec
[ErrorCode: 0x800b010e]
В Let's Encrypt листовые сертификаты можно проверить только по OCSP: Код:user@test-x86-deb9:/tmp$ /opt/cprocsp/bin/ia32/certmgr -list -file /tmp/lets.cer
Certmgr 1.1 (debug version) (c) "Crypto-Pro", 2007-2019.
program for managing certificates, CRLs and stores
=============================================================================
1-------
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Subject : CN=izhtender.ru
Serial : 0x037E027A64CC0A21A466733DF05832D06E77
SHA1 Hash : 514b963f2bd641a6760892d118243268393e0627
SubjKeyID : d0f6c0fcbbb5b4f8d679a51bc5685e2a145d44e7
Signature Algorithm : sha256RSA
PublicKey Algorithm : RSA (4096 bits)
Not valid before : 22/06/2019 08:14:46 UTC
Not valid after : 20/09/2019 08:14:46 UTC
PrivateKey Link : No
OCSP URL : http://ocsp.int-x3.letsencrypt.org
CA cert URL : http://cert.int-x3.letsencrypt.org/
Extended Key Usage : 1.3.6.1.5.5.7.3.1 Проверка подлинности сервера
1.3.6.1.5.5.7.3.2 Проверка подлинности клиента
2-------
Issuer : O=Digital Signature Trust Co., CN=DST Root CA X3
Subject : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Serial : 0x0A0141420000015385736A0B85ECA708
SHA1 Hash : e6a3b45b062d509b3382282d196efe97d5956ccb
SubjKeyID : a84a6a63047dddbae6d139b7a64565eff3a8eca1
Signature Algorithm : sha256RSA
PublicKey Algorithm : RSA (2048 bits)
Not valid before : 17/03/2016 16:40:46 UTC
Not valid after : 17/03/2021 16:40:46 UTC
PrivateKey Link : No
OCSP URL : http://isrg.trustid.ocsp.identrust.com
CA cert URL : http://apps.identrust.com/roots/dstrootcax3.p7c
CDP : http://crl.identrust.com/DSTROOTCAX3CRL.crl
=============================================================================
[ErrorCode: 0x00000000]
Проверку сертификата по OCSP мы тоже поддерживаем, но для этого требуется установить пакет cprocsp-pki-cades из состава КриптоПро ЭЦП SDK: Код:root@test-x86-deb9:/tmp# dpkg -i /tmp/cprocsp-pki-cades_2.0.0-1_i386.deb
Selecting previously unselected package cprocsp-pki-cades.
(Reading database ... 38763 files and directories currently installed.)
Preparing to unpack .../cprocsp-pki-cades_2.0.0-1_i386.deb ...
Unpacking cprocsp-pki-cades (2.0.0-1) ...
Setting up cprocsp-pki-cades (2.0.0-1) ...
License 0A202-U0030-00ECW-RRLMF-UU2WK is set
[ErrorCode: 0x00000000]
License TA200-G0030-00ECW-RRLNE-BTDVV is set
[ReturnCode: 0x00000000]
Пробуем ещё, обращение к службе OCSP есть, но сертификат всё равно не проверяется: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/bin/ia32/csptest -tlsc -server izhtender.ru -port 443 -file /help/02994f73db9396c4402b941e5bef05a6b061886a.cer -v -nosave -savecert /tmp/lets.cer
11 algorithms supported:
Aglid Class OID
[00] 0x661e 0x6000 1.2.643.2.2.21 (ГОСТ 28147-89)
[01] 0x6631 0x6000 1.2.643.7.1.1.5.2.1 (ГОСТ Р 34.12-2015 Кузнечик CTR-ACPKM)
[02] 0x6630 0x6000 1.2.643.7.1.1.5.1.1 (ГОСТ Р 34.12-2015 Магма CTR-ACPKM)
...
Server certificate:
Subject: CN=izhtender.ru
Valid : 22.06.2019 08:14:46 - 20.09.2019 08:14:46 (UTC)
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
* 06-26-2019 18:25:45.993981 0 About to connect() to ocsp.int-x3.letsencrypt.org port 80 (#0)
* 06-26-2019 18:25:45.994634 1 Trying 188.43.76.56... * 06-26-2019 18:25:45.996460 2 connected
* 06-26-2019 18:25:45.996888 3 Connected to ocsp.int-x3.letsencrypt.org (188.43.76.56) port 80 (#0)
> 06-26-2019 18:25:45.997538 4 POST / HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: ocsp.int-x3.letsencrypt.org
Accept: */*
Content-type: application/ocsp-request
Content-Length: 83
* 06-26-2019 18:25:46.188394 5 HTTP 1.1 or later with persistent connection, pipelining supported
< 06-26-2019 18:25:46.188930 6 HTTP/1.1 200 OK
< 06-26-2019 18:25:46.189425 7 Server: nginx
< 06-26-2019 18:25:46.189861 8 Content-Type: application/ocsp-response
< 06-26-2019 18:25:46.190353 9 Content-Length: 527
< 06-26-2019 18:25:46.190795 10 ETag: "6D7CD96566BDE09E0C5DB46D46BA3A5EE8358A53411F16864F2A3A4EC2A7F559"
< 06-26-2019 18:25:46.191277 11 Last-Modified: Tue, 25 Jun 2019 09:00:00 UTC
< 06-26-2019 18:25:46.191632 12 Cache-Control: public, no-transform, must-revalidate, max-age=43200
< 06-26-2019 18:25:46.191766 13 Expires: Thu, 27 Jun 2019 03:25:46 GMT
< 06-26-2019 18:25:46.191898 14 Date: Wed, 26 Jun 2019 15:25:46 GMT
< 06-26-2019 18:25:46.191950 15 Connection: keep-alive
< 06-26-2019 18:25:46.192050 16
* 06-26-2019 18:25:46.192211 17 Connection #0 to host ocsp.int-x3.letsencrypt.org left intact
* 06-26-2019 18:25:46.192336 18 Closing connection #0
* 06-26-2019 18:25:46.223254 19 About to connect() to ocsp.int-x3.letsencrypt.org port 80 (#0)
* 06-26-2019 18:25:46.223608 20 Trying 188.43.76.74... * 06-26-2019 18:25:46.225209 21 connected
* 06-26-2019 18:25:46.225463 22 Connected to ocsp.int-x3.letsencrypt.org (188.43.76.74) port 80 (#0)
> 06-26-2019 18:25:46.225764 23 POST / HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: ocsp.int-x3.letsencrypt.org
Accept: */*
Content-type: application/ocsp-request
Content-Length: 83
* 06-26-2019 18:25:46.414807 24 HTTP 1.1 or later with persistent connection, pipelining supported
< 06-26-2019 18:25:46.415322 25 HTTP/1.1 200 OK
< 06-26-2019 18:25:46.415814 26 Server: nginx
< 06-26-2019 18:25:46.416214 27 Content-Type: application/ocsp-response
< 06-26-2019 18:25:46.416650 28 Content-Length: 527
< 06-26-2019 18:25:46.417090 29 ETag: "6D7CD96566BDE09E0C5DB46D46BA3A5EE8358A53411F16864F2A3A4EC2A7F559"
< 06-26-2019 18:25:46.417572 30 Last-Modified: Tue, 25 Jun 2019 09:00:00 UTC
< 06-26-2019 18:25:46.418001 31 Cache-Control: public, no-transform, must-revalidate, max-age=43200
< 06-26-2019 18:25:46.418429 32 Expires: Thu, 27 Jun 2019 03:25:46 GMT
< 06-26-2019 18:25:46.418882 33 Date: Wed, 26 Jun 2019 15:25:46 GMT
< 06-26-2019 18:25:46.419308 34 Connection: keep-alive
< 06-26-2019 18:25:46.419738 35
* 06-26-2019 18:25:46.420062 36 Connection #0 to host ocsp.int-x3.letsencrypt.org left intact
* 06-26-2019 18:25:46.420187 37 Closing connection #0
* 06-26-2019 18:25:46.453943 38 About to connect() to ocsp.int-x3.letsencrypt.org port 80 (#0)
* 06-26-2019 18:25:46.454277 39 Trying 188.43.76.56... * 06-26-2019 18:25:46.455758 40 connected
* 06-26-2019 18:25:46.455996 41 Connected to ocsp.int-x3.letsencrypt.org (188.43.76.56) port 80 (#0)
> 06-26-2019 18:25:46.456264 42 POST / HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: ocsp.int-x3.letsencrypt.org
Accept: */*
Content-type: application/ocsp-request
Content-Length: 83
* 06-26-2019 18:25:46.460962 43 HTTP 1.1 or later with persistent connection, pipelining supported
< 06-26-2019 18:25:46.461386 44 HTTP/1.1 200 OK
< 06-26-2019 18:25:46.461631 45 Server: nginx
< 06-26-2019 18:25:46.461884 46 Content-Type: application/ocsp-response
< 06-26-2019 18:25:46.462165 47 Content-Length: 527
< 06-26-2019 18:25:46.462408 48 ETag: "6D7CD96566BDE09E0C5DB46D46BA3A5EE8358A53411F16864F2A3A4EC2A7F559"
< 06-26-2019 18:25:46.462650 49 Last-Modified: Tue, 25 Jun 2019 09:00:00 UTC
< 06-26-2019 18:25:46.462890 50 Cache-Control: public, no-transform, must-revalidate, max-age=43200
< 06-26-2019 18:25:46.463155 51 Expires: Thu, 27 Jun 2019 03:25:46 GMT
< 06-26-2019 18:25:46.463436 52 Date: Wed, 26 Jun 2019 15:25:46 GMT
< 06-26-2019 18:25:46.463612 53 Connection: keep-alive
< 06-26-2019 18:25:46.463845 54
* 06-26-2019 18:25:46.464114 55 Connection #0 to host ocsp.int-x3.letsencrypt.org left intact
* 06-26-2019 18:25:46.464362 56 Closing connection #0
* 06-26-2019 18:25:46.491621 57 About to connect() to ocsp.int-x3.letsencrypt.org port 80 (#0)
* 06-26-2019 18:25:46.491998 58 Trying 188.43.76.74... * 06-26-2019 18:25:46.493570 59 connected
* 06-26-2019 18:25:46.493927 60 Connected to ocsp.int-x3.letsencrypt.org (188.43.76.74) port 80 (#0)
> 06-26-2019 18:25:46.494190 61 POST / HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: ocsp.int-x3.letsencrypt.org
Accept: */*
Content-type: application/ocsp-request
Content-Length: 83
* 06-26-2019 18:25:46.497523 62 HTTP 1.1 or later with persistent connection, pipelining supported
< 06-26-2019 18:25:46.497761 63 HTTP/1.1 200 OK
< 06-26-2019 18:25:46.497984 64 Server: nginx
< 06-26-2019 18:25:46.498247 65 Content-Type: application/ocsp-response
< 06-26-2019 18:25:46.498491 66 Content-Length: 527
< 06-26-2019 18:25:46.498740 67 ETag: "6D7CD96566BDE09E0C5DB46D46BA3A5EE8358A53411F16864F2A3A4EC2A7F559"
< 06-26-2019 18:25:46.498993 68 Last-Modified: Tue, 25 Jun 2019 09:00:00 UTC
< 06-26-2019 18:25:46.499254 69 Cache-Control: public, no-transform, must-revalidate, max-age=43200
< 06-26-2019 18:25:46.499546 70 Expires: Thu, 27 Jun 2019 03:25:46 GMT
< 06-26-2019 18:25:46.499833 71 Date: Wed, 26 Jun 2019 15:25:46 GMT
< 06-26-2019 18:25:46.500087 72 Connection: keep-alive
< 06-26-2019 18:25:46.500324 73
* 06-26-2019 18:25:46.500632 74 Connection #0 to host ocsp.int-x3.letsencrypt.org left intact
* 06-26-2019 18:25:46.500864 75 Closing connection #0
Error 0x800b010e (CERT_E_REVOCATION_FAILURE) returned by CertVerifyCertificateChainPolicy!
An error occurred in running the program.
/dailybuilds/CSPbuild/CSP/samples/csptest/WebClient.c:858:Error authenticating server credentials!
Error number 0x800b010e (-2146762482).
The revocation process could not continue - the certificate(s) could not be checked.
Total: SYS: 0.050 sec USR: 0.220 sec UTC: 0.760 sec
[ErrorCode: 0x800b010e]
OCSP сервер Lets Encrypt (http://ocsp.int-x3.letsencrypt.org) не отправляет в ответ nonce когда он есть в запросе. А по RFC должен: https://www.ietf.org/rfc/rfc6960.txt:Цитата:4.4.1. Nonce
The nonce cryptographically binds a request and a response to prevent
replay attacks. The nonce is included as one of the
requestExtensions in requests, while in responses it would be
included as one of the responseExtensions.
Отключить это можно с помощью: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/sbin/ia32/cpconfig -ini '\config\cades\ocsppolicy' -add bool DisableNonce true
Но и этого недостаточно. OCSP-ответы Let's Encrypt имеют слишком большой срок действия: Код:ProducedAt - 2019-06-25 07:04:00 (UTC)
thisUpdate: 2019-06-25 06:00:00 (UTC)
nextUpdate: 2019-07-01 06:00:00 (UTC)
А мы требуем интервал 3 минуты. Это тоже можно отключить: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/sbin/ia32/cpconfig -ini '\config\cades\ocsppolicy' -add long ResponseAccuracy 0
Наконец, успех: Код:root@test-x86-deb9:/tmp# /opt/cprocsp/bin/ia32/csptest -tlsc -server izhtender.ru -port 443 -file /help/02994f73db9396c4402b941e5bef05a6b061886a.cer -v -nosave -savecert /tmp/lets.cer
11 algorithms supported:
Aglid Class OID
[00] 0x661e 0x6000 1.2.643.2.2.21 (ГОСТ 28147-89)
[01] 0x6631 0x6000 1.2.643.7.1.1.5.2.1 (ГОСТ Р 34.12-2015 Кузнечик CTR-ACPKM)
[02] 0x6630 0x6000 1.2.643.7.1.1.5.1.1 (ГОСТ Р 34.12-2015 Магма CTR-ACPKM)
[03] 0x801e 0x8000 1.2.643.2.2.3 (ГОСТ Р 34.11/34.10-2001)
[04] 0x8021 0x8000 1.2.643.7.1.1.2.2 (ГОСТ Р 34.11-2012 256 бит)
[05] 0x801f 0x8000
[06] 0x803d 0x8000
[07] 0x803c 0x8000
[08] 0x2e23 0x2000 1.2.643.2.2.19 (ГОСТ Р 34.10-2001)
[09] 0x2e49 0x2000 1.2.643.7.1.1.1.1 (ГОСТ Р 34.10-2012)
[10] 0x2e3d 0x2000 1.2.643.7.1.1.1.2 (ГОСТ Р 34.10-2012)
Cipher strengths: 256..256
Supported protocols: 0xa80:
Transport Layer Security 1.0 client side
Transport Layer Security 1.1 client side
Transport Layer Security 1.2 client side
dwProtocolMask: 0x800e2aaa
Protocol version: 3.3
ClientHello: RecordLayer: TLS, Len: 111
SessionId: (empty)
Cipher Suites: (ff 85) (00 81) (00 3d) (00 3c) (00 35) (00 2f) (00 0a)
116 bytes of handshake data sent
1448 bytes of handshake data received
Handshake extra buffer: 1382 bytes
1455 bytes of handshake data received
614 bytes of handshake data sent
298 bytes of handshake data received
Handshake was successful
SECPKG_ATTR_SESSION_INFO: Reuse: 0, SessionId:
SECPKG_ATTR_CONNECTION_INFO: Protocol: 800
SECPKG_ATTR_CIPHER_INFO: Protocol: 800, Suite: 3D (TLS_RSA_WITH_AES_256_CBC_SHA256)
SECPKG_ATTR_CIPHER_INFO: Cipher: (AES), Len: 256, BlockLen: 16
SECPKG_ATTR_CIPHER_INFO: Hash: (SHA256), Len: 256
SECPKG_ATTR_CIPHER_INFO: Exchange: (RSA), MinLen: 16384, MaxLen: 16384
SECPKG_ATTR_CIPHER_INFO: Certificate: (RSA), KeyType: 0
SECPKG_ATTR_NAMES: CN=izhtender.ru
SECPKG_ATTR_PACKAGE_INFO# fCapabilities: 0x107B3
SECPKG_ATTR_PACKAGE_INFO# wVersion: 1
SECPKG_ATTR_PACKAGE_INFO# wRPCID: 65535
SECPKG_ATTR_PACKAGE_INFO# cbMaxToken: 16379
SECPKG_ATTR_PACKAGE_INFO# Name: CryptoPro SSP
SECPKG_ATTR_PACKAGE_INFO# Comment: CryptoPro Security Package
Server certificate:
Subject: CN=izhtender.ru
Valid : 22.06.2019 08:14:46 - 20.09.2019 08:14:46 (UTC)
Issuer : C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
* 06-26-2019 18:39:33.472088 0 About to connect() to ocsp.int-x3.letsencrypt.org port 80 (#0)
* 06-26-2019 18:39:33.472325 1 Trying 188.43.76.49... * 06-26-2019 18:39:33.473985 2 connected
* 06-26-2019 18:39:33.474212 3 Connected to ocsp.int-x3.letsencrypt.org (188.43.76.49) port 80 (#0)
> 06-26-2019 18:39:33.474476 4 POST / HTTP/1.1
User-Agent: UrlRetriever (Mozilla MSIE 6 Win 2000)
Host: ocsp.int-x3.letsencrypt.org
Accept: */*
Content-type: application/ocsp-request
Content-Length: 83
* 06-26-2019 18:39:33.665899 5 HTTP 1.1 or later with persistent connection, pipelining supported
< 06-26-2019 18:39:33.665936 6 HTTP/1.1 200 OK
< 06-26-2019 18:39:33.665958 7 Server: nginx
< 06-26-2019 18:39:33.665972 8 Content-Type: application/ocsp-response
< 06-26-2019 18:39:33.665984 9 Content-Length: 527
< 06-26-2019 18:39:33.665994 10 ETag: "6D7CD96566BDE09E0C5DB46D46BA3A5EE8358A53411F16864F2A3A4EC2A7F559"
< 06-26-2019 18:39:33.666013 11 Last-Modified: Tue, 25 Jun 2019 09:00:00 UTC
< 06-26-2019 18:39:33.666024 12 Cache-Control: public, no-transform, must-revalidate, max-age=43200
< 06-26-2019 18:39:33.666035 13 Expires: Thu, 27 Jun 2019 03:39:33 GMT
< 06-26-2019 18:39:33.666050 14 Date: Wed, 26 Jun 2019 15:39:33 GMT
< 06-26-2019 18:39:33.666073 15 Connection: keep-alive
< 06-26-2019 18:39:33.666084 16
* 06-26-2019 18:39:33.666121 17 Connection #0 to host ocsp.int-x3.letsencrypt.org left intact
* 06-26-2019 18:39:33.666143 18 Closing connection #0
Protocol: TLS 1.2
Cipher: 0x6610
Cipher strength: 256
Hash: 0x800c
Hash strength: 256
Key exchange: RSA
Key exchange strength: 4096
Supported signatures: (ee ee) (ef ef) (ed ed) (01 02)
Header: 21, Trailer: 48, MaxMessage: 16384
HTTP request: GET /help/02994f73db9396c4402b941e5bef05a6b061886a.cer HTTP/1.1
User-Agent: Webclient
Accept:*/*
Host: izhtender.ru
Connection: close
Sending plaintext: 141 bytes
266 bytes of application data sent
2378 bytes of (encrypted) application data received
Decrypted data: 2243 bytes
Extra data: 69 bytes
Context expired: OK if file is completely downloaded
Reply status: HTTP/1.1 200 OK
Sending Close Notify
69 bytes of handshake data sent
1 connections, 2243 bytes in 0.335 seconds;
Total: SYS: 0.010 sec USR: 0.200 sec UTC: 0.480 sec
[ErrorCode: 0x00000000]
Всё это я подробно рассказал, так как наши серверы тоже пока сидят на сертификатах Let's Encrypt dss.cryptopro.ru
simdss.cryptopro.ru
P.S. Через proxy мы тоже можем работать. Для этого настройка proxy должна быть "системной". Например, через переменную окружения http_proxy. Проверять правильность настройки можно с помощью
Код:/opt/cprocsp/bin/ia32/curl URL > /dev/null
|
