Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_ssl_tls_https_client_openssl [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:notes_ssl_tls_https_client_openssl [2026/06/10 12:16] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon OpenSSL}}
+# Notes SSL/TLS HTTPS client OpenSSL
+Voir :
+* [[notes_curl_wget]]
+* [FeistyDuck - Bulletproof TLS Guide](https://www.feistyduck.com/library/bulletproof-tls-guide/downloads/bulletproof-tls-guide-20230424-b117.pdf)
+* [FeistyDuck - OpenSSL Cookbook - 3rd Edition](https://www.feistyduck.com/library/openssl-cookbook/downloads/openssl-cookbook-3ed.pdf)
+Voir aussi :
+* [Exemples de conf HTTPS / SSL / TLS pour plusieurs serveurs (nginx, apache, postfix](https://cipherlist.eu/)
+* [[openssl_proxy_http_proxy]]
+Vérif cert
+~~~bash
+openssl s_client -showcerts -CAfile ca.crt -connect 192.168.56.101:7000 -servername acme.fr
+~~~
+Avoir des informations sur le certificat (info cert)
+~~~bash
+openssl x509 -inform PEM -in mycertfile.pem -text -out certdata
+~~~
+Debug
+~~~bash
+curl -v --insecure --show-error --verbose --cacert mycertfile.pem https://acme.fr
+~~~
+Install CA certificat - Debian
+~~~bash
+mv cert.pem acme.fr.crt
+cp acme.fr.crt /usr/local/share/ca-certificates/
+#vim /etc/ca-certificates.conf
+#dpkg-reconfigure ca-certificates
+# RedHat
+# update-ca-trust
+# Debian
+update-ca-certificates
+~~~
+Remove CA certificat - Debian
+~~~bash
+rm /usr/local/share/ca-certificates/plop.crt
+# RedHat
+# update-ca-trust
+# Debian
+#update-ca-certificates
+update-ca-certificates -f
+~~~
+''-f'', ''--fresh'' : Fresh updates.  Remove symlinks in /etc/ssl/certs directory.
+Install CA certificat - RedHat
+Voir :
+ * ''trust'' (paquet RedHat p11-kit-trust ; paquet Debian p11-kit)
+ * ''update-ca-trust'' (paquet ca-certificat)
+~~~bash
+cp ca.crt /etc/pki/ca-trust/source/anchors/
+# Debian
+# update-ca-certificates
+# RedHat
+update-ca-trust
+~~~
+Source :
+cat /etc/pki/ca-trust/source/README
+Requette HTTP over SSL/TLS
+~~~bash
+(echo -ne "GET / HTTP/1.1\r\nHost: acme.fr\r\n\r\n" ; cat ) | openssl s_client -showcerts -CAfile ca.crt -connect acme.fr:443 -servername acme.fr
+~~~
+## Test TLS HTTPS en ligne
+* https://www.ssllabs.com/ssltest/
+* https://www.htbridge.com/ssl/
+## Test TLS HTTPS hors ligne
+[TestSSL.sh](https://testssl.sh/testssl.sh)
+## Python
+''trustflag.py''
+~~~python
+"""Check AddTrust External CA Root
+https://bugzilla.redhat.com/show_bug.cgi?id=1842174
+https://bugzilla-attachments.redhat.com/attachment.cgi?id=1693957
+"""
+from __future__ import print_function
+import socket
+import ssl
+import sys
+try:
+    from urllib2 import urlopen
+except ImportError:
+    from urllib.request import urlopen
+X509_V_FLAG_TRUSTED_FIRST = 0x8000
+URL = "https://addtrust-chain.demo.sslmate.com"
+print(sys.version)
+print(ssl.OPENSSL_VERSION)
+print()
+ctx = ssl.create_default_context()
+assert ctx.verify_mode == ssl.CERT_REQUIRED
+assert ctx.check_hostname == True
+print("Try with default verify flags")
+print("verify_flags", hex(ctx.verify_flags))
+try:
+    urlopen(URL, context=ctx)
+except Exception as e:
+    print("FAILED")
+    print(e)
+else:
+    print("success")
+print()
+print("Try again with X509_V_FLAG_TRUSTED_FIRST")
+ctx.verify_flags |= X509_V_FLAG_TRUSTED_FIRST
+print("verify_flags", hex(ctx.verify_flags))
+try:
+    urlopen(URL, context=ctx)
+except Exception as e:
+    print("FAILED")
+    print(e)
+else:
+    print("success")
+print()
+~~~
+## Pb
+### Le certificat téléchargé ne fonctionne pas
+|            | **Curl** | **Wget**  |
+| ---------- | -------- | --------- |
+| **Debian** |   ✗      |   ✓      |
+| **RedHat** |   ✗      |   ✗      |
+source : https://superuser.com/questions/97201/how-to-save-a-remote-server-ssl-certificate-locally-as-a-file
+~~~bash
+openssl s_client -showcerts -connect acme.fr:443 -servername acme.fr </dev/null 2>/dev/null | openssl x509 -outform PEM >mycertfile.pem
+~~~
+**OK**  sous Debian \\
+**NOK** sous RedHat
+~~~bash
+wget --ca-certificate=mycertfile.pem https://acme.fr:443/somepage
+~~~
+**NOK** sous Debian & RedHat
+~~~bash
+curl --show-error --verbose --cacert mycertfile.pem https://acme.fr:443/somepage
+~~~
+#### Solution
+Utiliser ''-verify'' pour avoir la chaîne complète, c'est-à-dire télécharger nom seulement la clef publique de acme.fr, mais aussi la clef publique de la CA.
+~~~bash
+openssl s_client -showcerts -verify 5 -connect 192.168.56.101:7000 -servername acme.fr </dev/null > mycertfile.pem
+~~~
+Puis ne garder que la CA.
+Note : si la CA existe, dans le cas d'un certificat auto-signé, ça ne marchera pas.
+Pour Debian, il est possible d'installer le certificat comme si c'était celui d'une CA.
+~~~bash
+vim mycertfile.pem
+~~~
+Voir https://unix.stackexchange.com/questions/368123/how-to-extract-the-root-ca-and-subordinate-ca-from-a-certificate-chain-in-linux