主页 / ubuntu / 问题

问题[ssl](ubuntu)

Martin Hope
cratag
Asked: 2021-03-23 06:44:01 +0800 CST
  • 1

我想在我的操作系统中有两个不同的 OpenSSL 版本。马上，openssl version -v回归

OpenSSL 1.1.1f 2020 年 3 月 31 日

我也想拥有 OpenSSL 1.0.2，因为我需要使用rbenv安装Ruby 2.2.10，而对于 2.4 以下的版本，它需要 OpenSSL 降级。

如何在 Ubuntu 16.04 上使用默认的 openssl (1.1.1) 安装 openssl 1.0.2？- 我在这个线程中关注了 monaye的回答，并设法安装了 OpenSSL：openssl version -v

OpenSSL 1.0.2l 2017 年 5 月 25 日

但是让操作系统使用 OpenSSL 可能会与我的 Ruby 3.0.0 应用程序冲突，因为我需要两个 ssl 版本都可用。这就是我将 OpenSSL 更新回其最新版本的原因

rbenv的文档为 MacOS 中的这种冲突提供了解决方案：

在 macOS 上使用 Homebrew

brew install rbenv/tap/[email protected] RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix [email protected])" rbenv install 2.3.8

我在 Ubuntu 20.04 中需要类似的东西 - 有可能吗？

在 rbenv 论坛中，在OpenSSL 版本兼容性下面它说：

在构建 Ruby 2.3 或更早版本时，您必须确保 OpenSSL 1.0 在系统上的某个位置可用，并通过 --with-openssl-dir 配置标志指向它。目前，大多数带有 OpenSSL 1.1 的 Linux 发行版都有一个单独的 OpenSSL 1.0 包。

但

RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix [email protected])" rbenv install 2.3.8

失败：Command 'brew' not found

ssl
Martin Hope
Attila Naghi
Asked: 2020-11-13 03:53:39 +0800 CST
  • 0

我遵循了本教程：https ://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-20-04#step-3 -%E2%80%93-configuring-apache-to-use-ssl

这是我的文件的内容/etc/apache2/sites-available/nestledevelopment.conf：：

<VirtualHost *:443>
   ServerName nestledevelopment.local
   DocumentRoot /var/www/html/nestledevelopment/

   SSLEngine on
   SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
   SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
</VirtualHost>

is的命令sudo apache2ctl configtest向我展示了： AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message Syntax OK

但是当我访问我的虚拟主机nestledevelopment.local 时，它仍然显示连接不安全。我需要接受风险并继续。

不知道我做错了什么，请您建议在哪里看？我应该尝试什么？谢谢

server ssl apache2
Martin Hope
Siva Sankaran
Asked: 2020-07-14 03:11:00 +0800 CST
  • 0

在此处输入图像描述

我已经在 Oracle VM VirtualBox 中安装了 ubuntu-20.04-desktop-amd64.iso。详情如上。我在安装 Ubuntu 时尝试了最小安装和正常安装类型。在这两种情况下都存在以下问题。

当我早些时候尝试在 Firefox 中打开 Google.com 时，sec_error_unknown_issuer单击高级按钮时出现错误代码。没有按钮接受风险并继续

几分钟后，我在主机操作系统（windows 10）中工作，我再次尝试，现在我得到了错误代码，就像MOZZILA_PKIX_ERROR_MITM_DETECTED接受风险并继续按钮一样。我不明白是什么改变了错误代码并使接受并继续选项可用。

我之前也尝试通过这个命令从终端安装邮递员

sudo snap install postman

总是失败

error: cannot install "postman": Post
       https://api.snapcraft.io/v2/snaps/refresh: x509: certificate signed by unknown authority

在/usr/share/ca-certificates目录中只有一个目录名mozilla

在研究了证书颁发机构之后，我想我可能需要安装一个根证书。但我现在得到了我的问题，“Ubuntu 安装不会负责安装根证书吗？”

安装操作系统（windows、Mac 或任何操作系统）后是否需要安装根证书？

virtualbox ssl https
Martin Hope
nightwatch
Asked: 2020-07-09 03:10:45 +0800 CST
  • 0

如标题所示，我无法将我的一个邮件帐户从 Thunderbird 移动到 Evolution Mail，因为我的电子邮件所在的邮件服务器只接受 SSL 连接。Thunderbird 的“SSL/TLS”默认连接安全选项运行良好，但 Evolution Mail 仅提供“连接后的 STARTTLS”和“专用端口上的 TLS”作为连接安全选项。有人可以提供关于如何让我的 Evolution 邮件支持 SSL 连接的虚假说明吗？

Ubuntu 18.04

进化 3.28.5

找不到任何东西来解释为什么默认情况下没有内置于 Evolution 中的 SSL 支持。甚至 Evolution 自己的帮助文档都说支持 SSL，但 SSL 连接的实际选项根本不存在。

我卸载了进化，安装了 PPA，然后重新安装。没有 SSL 连接安全选项......现在撞墙了。

这就是我所看到的： 在此处输入图像描述

在此处输入图像描述

注意：我已经尝试了所有三种安全加密方法，但都没有奏效。

谢谢

evolution ssl email
Martin Hope
Misko Mali
Asked: 2020-06-16 23:45:58 +0800 CST
  • 9

我在我的 VPS 上安装了 Ubuntu 20。这就是我尝试这样做的原因：

curl -v https://imenik.tportal.hr/show?action=pretraga&type=bijeleStranice
[1] 438975
root@vps:/var/www/html/tportal# *   Trying 195.29.166.100:443...
* TCP_NODELAY set
* Connected to imenik.tportal.hr (195.29.166.100) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS alert, protocol version (582):
* error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
* Closing connection 0
curl: (35) error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol

但是当我这样尝试时，它有点工作

curl -v http://imenik.tportal.hr/show?action=pretraga&type=bijeleStranice
[1] 438977
root@vps:/var/www/html/tportal# *   Trying 195.29.166.100:80...
* TCP_NODELAY set
* Connected to imenik.tportal.hr (195.29.166.100) port 80 (#0)
> GET /show?action=pretraga HTTP/1.1
> Host: imenik.tportal.hr
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Date: Tue, 16 Jun 2020 07:44:32 GMT
< Server: Apache/2.2.3 (CentOS)
< Location: https://imenik.tportal.hr/show?action=pretraga
< Content-Length: 336
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://imenik.tportal.hr/show?action=pretraga">here</a>.</p>
<hr>
<address>Apache/2.2.3 (CentOS) Server at imenik.tportal.hr Port 80</address>
</body></html>
* Closing connection 0

我找不到此 SSL 问题的解决方案

ssl openssl tls curl
Martin Hope
Marco
Asked: 2020-06-15 06:42:39 +0800 CST
  • 0

我正在配置一个 Apache SSL 反向代理，用于从中间件调用后端服务器，我有客户端证书和密钥。不久：

               http               https
middleware -----------> proxy -------------> backend

中间件甚至不知道后端服务器，这是反向代理的技巧。

我（认为我）能够操作代理，因为我收到了

AH02268：代理客户端证书回调：（localhost：80）下游服务器想要客户端证书，但没有配置所以我不明白代理正在尝试调用后端，但最后一个抱怨代理没有通过他也证书。

所以我想念正确配置证书。AFAIK 我必须编译conf.d/modes-enabled/ssl.conf. 我试过这种方式

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLEngine off
SSLProxyEngine on
SSLProtocol all

# proxy
SSLProxyMachineCertificateFile /usr/local/etc/apache2/ssl.crt/certificate.pem
SSLProxyMachineCertificateChainFile /usr/local/etc/apache2/ssl.crt/chain.pem
SSLProxyCACertificateFile /usr/local/etc/apache2/ssl.crt/ca.pem

# certificate
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
SSLCertificateFile /usr/local/etc/apache2/ssl.crt/all.pem
SSLCertificateChainFile /usr/local/etc/apache2/ssl.crt/certificate.pem

# key
SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key
SSLPassPhraseDialog  exec:/usr/local/etc/apache2/pwf.sh

几点注意事项：

  • certificate.pem是服务器证书。
  • chain.pem是证书的中间链，不包括边界。
  • ca.pem是根 CA 证书。
  • server.key是 RSA 私钥

我用 pwf.sh 脚本替换了用于输入密码的正常对话模式但是我什至无法启动 apache，因为我有这个消息

AH02252：为 SSL 代理配置的客户端证书不完整（丢失或加密的私钥？） [ssl:emerg] [pid 12484]
AH02312：初始化 mod_ssl 时出现致命错误，正在退出。AH00016: 配置失败

现在我（遗憾地）读到没有办法克服这个问题，因为正如 apache.org 网站所说，在所有 SSLProxyMachine* 指令下：

（目前不支持加密私钥）

我迷路了吗？

configuration ssl apache2 proxy
Martin Hope
wuarmin
Asked: 2020-06-04 12:36:49 +0800 CST
  • 2

突然我的 /etc/ssl/cert 目录几乎是空的，我不知道它是怎么发生的。 在此处输入图像描述

昨天还剩下大约 400 个（符号链接）。

由于缺少证书，许多事情不再起作用（包括 apt 包管理器）。

运行sudo ca-update-certificates会产生一个非常奇怪的输出：

Updating certificates in /etc/ssl/certs...
find: ‘test’: file or directory not found
find: ‘test’: file or directory not found
find: ‘test’: file or directory not found
... 127 times same message
127 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...

updates of cacerts keystore disabled.
done.

测试文件夹或文件应该在哪里？我可以做些什么来解决我的问题？

ssl certificates openssl 18.04
Martin Hope
Maïeul
Asked: 2020-05-25 05:02:28 +0800 CST
  • 0

Ubuntu 20.04

我使用 lftp 连接到服务器（ftp.domain.xxx）。

我得到“证书验证：无法获得本地颁发者证书”。

阅读此答案 https://stackoverflow.com/a/44095714/3206025 我添加了

set ssl:ca-file "/etc/ssl/certs/ca-certificates.crt

无论是在启动 lftp 中~/.lftp/rc还是在启动 lftp 时，都要确保正确地做这些事情。

但问题仍然存在。

所以我假设/etc/ssl/certs/ca-certificates.crt不包含证书/不足以工作。

我认为证书是真正生成的，让我们加密机制。

Ubuntu 是否能够识别让我们加密证书（在 firefox 之外）。

我该如何解决我的问题？

encryption ftp ssl
Martin Hope
Geoffroy
Asked: 2020-05-18 17:01:51 +0800 CST
  • 1

在尝试更新我的 SSL 证书后，我目前的网站出现问题。

我已经完成了本教程中提到的所有步骤：https ://www.digitalocean.com/community/tutorials/how-to-install-an-ssl-certificate-from-a-commercial-certificate-authority

在最后一部分，当我必须输入sudo service apache2 restart行时，我收到了以下错误消息：

Job for apache2.service failed because the control process exited with error code.
See "systemctl status apache2.service" and "journalctl -xe" for details.


systemctl 状态 apache2.service

● apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/apache2.service.d
           └─apache2-systemd.conf
   Active: failed (Result: exit-code) since Mon 2020-05-18 00:18:34 UTC; 6s ago
  Process: 4867 ExecStop=/usr/sbin/apachectl stop (code=exited, status=0/SUCCESS)
  Process: 7254 ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)
 Main PID: 1045 (code=exited, status=0/SUCCESS)

May 18 00:18:34 systemd[1]: Starting The Apache HTTP Server...
May 18 00:18:34 apachectl[7254]: Action 'start' failed.
May 18 00:18:34 apachectl[7254]: The Apache error log may have more information.
May 18 00:18:34 systemd[1]: apache2.service: Control process exited, code=exited status=1
May 18 00:18:34 systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 00:18:34 systemd[1]: Failed to start The Apache HTTP Server.
apache2ctl configtest
Syntax OK
apachectl configtest
Syntax OK

我尝试了configtest命令来查看是否有任何合成器错误，但一切似乎都很好。

journalctl -xe

May 18 15:33:52 sshd[31542]: Failed password for i
May 18 15:33:53 sudo[31549]:     root : TTY=pts/0
May 18 15:33:53 sudo[31549]: pam_unix(sudo:session
May 18 15:33:53 systemd[1]: Starting The Apache HT
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53 apachectl[31555]: Action 'start' f
May 18 15:33:53 apachectl[31555]: The Apache error
May 18 15:33:53 systemd[1]: apache2.service: Contr
May 18 15:33:53 systemd[1]: apache2.service: Faile
May 18 15:33:53 systemd[1]: Failed to start The Ap
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53 sudo[31549]: pam_unix(sudo:session
May 18 15:33:55 kernel: [UFW BLOCK] IN=eth0 OUT= M
lines 1128-1150/1150 (END)
May 18 15:33:52 sshd[31542]: Failed password for invalid user bdt from 206.18
May 18 15:33:53 sudo[31549]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; C
May 18 15:33:53 sudo[31549]: pam_unix(sudo:session): session opened for user
May 18 15:33:53 systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53 apachectl[31555]: Action 'start' failed.
May 18 15:33:53 apachectl[31555]: The Apache error log may have more informat
May 18 15:33:53 systemd[1]: apache2.service: Control process exited, code=exi
May 18 15:33:53 systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 15:33:53 systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53 sudo[31549]: pam_unix(sudo:session): session closed for user
May 18 15:33:55 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:52:65:0e:6a:71:fe:00:
~
~
~
~
~
~
~
~
~
~
~
lines 1128-1150/1150 (END)
May 18 15:33:52  sshd[31542]: Failed password for invalid user bdt from 206.189.212.33 port 38420 ssh2
May 18 15:33:53  sudo[31549]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/service ap
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session opened for user root by root(uid=0)
May 18 15:33:53  systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53  apachectl[31555]: Action 'start' failed.
May 18 15:33:53  apachectl[31555]: The Apache error log may have more information.
May 18 15:33:53  systemd[1]: apache2.service: Control process exited, code=exited status=1
May 18 15:33:53  systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 15:33:53  systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session closed for user root
May 18 15:33:55  kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:52:65:0e:6a:71:fe:00:00:00:01:01:08:00 SRC=185.1
~
~
~
~
~
~
~
~
~
~
~
~
lines 1128-1150/1150 (END)
May 18 15:33:52  sshd[31542]: Failed password for invalid user bdt from 206.189.212.33 port 38420 ssh2
May 18 15:33:53  sudo[31549]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/service apache2 restart
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session opened for user root by root(uid=0)
May 18 15:33:53  systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53  apachectl[31555]: Action 'start' failed.
May 18 15:33:53  apachectl[31555]: The Apache error log may have more information.
May 18 15:33:53  systemd[1]: apache2.service: Control process exited, code=exited status=1
May 18 15:33:53  systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 15:33:53  systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session closed for user root
May 18 15:33:55  kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:52:65:0e:6a:71:fe:00:00:00:01:01:08:00 SRC=185.151.242.187 DST=167.99.179.159 LEN=40 T
~
~
~
~
~
~
~
~
~
~
~
~
lines 1128-1150/1150 (END)
May 18 15:33:52  sshd[31542]: Failed password for invalid user bdt from 206.189.212.33 port 38420 ssh2
May 18 15:33:53  sudo[31549]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/service apache2 restart
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session opened for user root by root(uid=0)
May 18 15:33:53  systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53  apachectl[31555]: Action 'start' failed.
May 18 15:33:53  apachectl[31555]: The Apache error log may have more information.
May 18 15:33:53  systemd[1]: apache2.service: Control process exited, code=exited status=1
May 18 15:33:53  systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 15:33:53  systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session closed for user root
May 18 15:33:55  kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:52:65:0e:6a:71:fe:00:00:00:01:01:08:00 SRC=185.151.242.187 DST=167.99.179.159 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=15380 PROTO=TCP
~
~
~
~
~
~
~
~
~
~
~
~
lines 1128-1150/1150 (END)
May 18 15:33:52  sshd[31542]: Failed password for invalid user bdt from 206.189.212.33 port 38420 ssh2
May 18 15:33:53  sudo[31549]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/service apache2 restart
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session opened for user root by root(uid=0)
May 18 15:33:53  systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53  apachectl[31555]: Action 'start' failed.
May 18 15:33:53  apachectl[31555]: The Apache error log may have more information.
May 18 15:33:53  systemd[1]: apache2.service: Control process exited, code=exited status=1
May 18 15:33:53  systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 15:33:53  systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session closed for user root
May 18 15:33:55  kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:52:65:0e:6a:71:fe:00:00:00:01:01:08:00 SRC=185.151.242.187 DST=167.99.179.159 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=15380 PROTO=TCP SPT=21789 DPT=3377 WINDOW=1024 R
~
~
~
~
~
~
~
~
~
~
~
~
lines 1128-1150/1150 (END)
May 18 15:33:52  sshd[31542]: Failed password for invalid user bdt from 206.189.212.33 port 38420 ssh2
May 18 15:33:53  sudo[31549]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/service apache2 restart
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session opened for user root by root(uid=0)
May 18 15:33:53  systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit apache2.service has begun start-up
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has begun starting up.
May 18 15:33:53  apachectl[31555]: Action 'start' failed.
May 18 15:33:53  apachectl[31555]: The Apache error log may have more information.
May 18 15:33:53  systemd[1]: apache2.service: Control process exited, code=exited status=1
May 18 15:33:53  systemd[1]: apache2.service: Failed with result 'exit-code'.
May 18 15:33:53  systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit apache2.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- Unit apache2.service has failed.
--
-- The result is RESULT.
May 18 15:33:53  sudo[31549]: pam_unix(sudo:session): session closed for user root
May 18 15:33:55  kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:52:65:0e:6a:71:fe:00:00:00:01:01:08:00 SRC=185.151.242.187 DST=167.99.179.159 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=15380 PROTO=TCP SPT=21789 DPT=3377 WINDOW=1024 RES=0x00 SYN URGP=0


当我尝试通过 sFTP 访问文件夹/usr/sbin/apachectl时，我们可以看到以下错误消息： Directory /usr/sbin/apache2ctl: no such file or directory

在文件/var/log/apache2/error.log中，我有 ：

[Mon May 18 15:33:53.451709 2020] [ssl:error] [pid 31566] AH02579: Init: Private key not found
[Mon May 18 15:33:53.451789 2020] [ssl:error] [pid 31566] SSL Library Error: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
[Mon May 18 15:33:53.451800 2020] [ssl:error] [pid 31566] SSL Library Error: error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error
[Mon May 18 15:33:53.451807 2020] [ssl:error] [pid 31566] SSL Library Error: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
[Mon May 18 15:33:53.451815 2020] [ssl:error] [pid 31566] SSL Library Error: error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error (Type=RSAPrivateKey)
[Mon May 18 15:33:53.451823 2020] [ssl:error] [pid 31566] SSL Library Error: error:04093004:rsa routines:old_rsa_priv_decode:RSA lib
[Mon May 18 15:33:53.451830 2020] [ssl:error] [pid 31566] SSL Library Error: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
[Mon May 18 15:33:53.451837 2020] [ssl:error] [pid 31566] SSL Library Error: error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)
[Mon May 18 15:33:53.451842 2020] [ssl:emerg] [pid 31566] AH02311: Fatal error initialising mod_ssl, exiting. See /var/log/apache2/error.log for more information
[Mon May 18 15:33:53.451846 2020] [ssl:emerg] [pid 31566] AH02564: Failed to configure encrypted (?) private key mydomain.com:443:0, check /root/certificate/mydomain.com.key
AH00016: Configuration Failed

任何帮助将非常感激。如果您需要检查其他内容，请告诉我您需要什么以及我如何获取这些信息。谢谢！

server ssl apache2 restart https
Martin Hope
Łukasz Sypniewski
Asked: 2020-04-30 16:17:01 +0800 CST
  • 60

我想问一下是否有办法在 Ubuntu 20.04 上将 SSL 安全级别降低到 1，因为我收到：

141A318A:SSL routines:tls_process_ske_dhe:dh key too small

尝试卷曲网站时。

如果我添加参数，Curl 可以工作--ciphers 'DEFAULT:!DH'，但是，我无法通过用 C# 编写的客户端应用程序获取网站。该网站在通过浏览器打开时也可以工作。

根据bugs.launchpad.net的说法，Ubuntu 团队故意设置了更高的 SSL 安全级别。

在几个地方，我遇到了更改CipherString = DEFAULT@SECLEVEL=2为1inopenssl.cnf帮助的信息，但是我的配置文件根本没有这样的行，并且添加它没有任何效果。

我不控制网站服务器，因此无法更改其安全配置。

有任何想法吗？安装一些较旧的 openSSL 包会有所帮助吗？

提前致谢

编辑：至于对我的配置文件的更改，我在最后添加了以下内容：

system_default = system_default_sect 

[system_default_sect] 
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1

输出openssl version -a：

OpenSSL 1.1.1f 31 Mar 2020 built on: Mon Apr 20 11:53:50 2020 UTC
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,
--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=. 
-fstack-protector-strong -Wformat -Werror=format-security
-DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE
-DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ
-DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT
-DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m
-DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM
-DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM
-DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
-Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl" ENGINESDIR:
"/usr/lib/x86_64-linux-gnu/engines-1.1" Seeding source: os-specific
security ssl openssl curl 20.04