Avec Orange c’est l’enfer, impossible de monter une architecture stable … toujours des problèmes.
Normalement j’ai un NAT vers une IP locale, et ce NAT fait que j’utilise le certificat mis sur l’IP locale.
Quand je fais sur l’IP publique :
openssl s_client -showcerts -connect 80.15.48.50:443 CONNECTED(00000003) Can't use SSL_get_servername depth=1 C = FR, O = Orange, CN = Orange Devices Generic27 CA verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 C = FR, O = Orange, CN = CCD42E-Livebox Fibre-JA20086CN001383 verify return:1 --- Certificate chain 0 s:C = FR, O = Orange, CN = CCD42E-Livebox Fibre-JA20086CN001383 i:C = FR, O = Orange, CN = Orange Devices Generic27 CA
Au vue du nmap c’est la gateway qui a une mauvaise information :
nmap -p 443 --script ssl-cert my.cyber-neurones.org Starting Nmap 7.60 ( https://nmap.org ) at 2020-11-10 10:33 CET Nmap scan report for my.cyber-neurones.org (80.15.48.50) Host is up (0.0013s latency). rDNS record for 80.15.48.50: laubervilliers-658-1-140-50.w80-15.abo.wanadoo.fr PORT STATE SERVICE 443/tcp open https | ssl-cert: Subject: commonName=CCD42E-Livebox Fibre-JA20086CN001383/organizationName=Orange/countryName=FR | Subject Alternative Name: IP Address:192.168.1.1, DNS:livebox | Issuer: commonName=Orange Devices Generic27 CA/organizationName=Orange/countryName=FR | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2020-02-24T10:42:58 | Not valid after: 2035-02-24T10:42:58 | MD5: d286 3014 37db 5f61 3200 bc17 1d06 f386 |_SHA-1: 8d58 ba94 db74 2d01 ca2c a1bd bcef b792 a558 bed1 Nmap done: 1 IP address (1 host up) scanned in 1.97 seconds
Par l’exterieur je n’ai pas de problème. C’est donc le DNS qui fait un mauvais routage :
# nmcli device show wlp64s0 | grep "IP4.DNS" IP4.DNS[1]: 80.10.246.2 IP4.DNS[2]: 80.10.246.129
Quand je fais sur le nom de domaine (en local):
openssl s_client -showcerts -connect sat.cyber-neurones.org:443 CONNECTED(00000003) depth=1 C = FR, O = Orange, CN = Orange Devices Generic27 CA verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 C = FR, O = Orange, CN = CCD42E-Livebox Fibre-JA20086CN001383 verify return:1 --- Certificate chain 0 s:C = FR, O = Orange, CN = CCD42E-Livebox Fibre-JA20086CN001383 i:C = FR, O = Orange, CN = Orange Devices Generic27 CA -----BEGIN CERTIFICATE-----
Quand je fais sur l’IP locale j’ai le bon certificat (pareil si je passe par l’exterieur):
openssl s_client -showcerts -connect 192.168.1.42:443
CONNECTED(00000003)
Can't use SSL_get_servername
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = sat.cyber-neurones.org
verify return:1
---
Certificate chain
0 s:CN = sat.cyber-neurones.org
i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
Voici l’erreur que j’ai :
$ curl https://sat.cyber-neurones.org:443 curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
Le probleme a commencé vers 02h du matin par surement un reboot de la livebox :
Nov 10 02:22:18 cyber-neurones kernel: [228577.565640] r8169 0000:01:00.0 enp1s0: Link is Down Nov 10 02:22:22 cyber-neurones kernel: [228582.503827] Generic PHY r8169-100:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=r8169-100:00, irq=IGNORE) Nov 10 02:22:23 cyber-neurones kernel: [228582.603989] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready Nov 10 02:22:23 cyber-neurones kernel: [228582.810672] Generic PHY r8169-100:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=r8169-100:00, irq=IGNORE) Nov 10 02:22:23 cyber-neurones kernel: [228582.911994] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready Nov 10 02:22:26 cyber-neurones kernel: [228586.152621] r8169 0000:01:00.0 enp1s0: Link is Up - 1Gbps/Full - flow control rx/tx Nov 10 02:22:26 cyber-neurones kernel: [228586.152649] IPv6: ADDRCONF(NETDEV_CHANGE): enp1s0: link becomes ready Nov 10 02:22:29 cyber-neurones kernel: [228588.543092] Generic PHY r8169-100:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=r8169-100:00, irq=IGNORE) Nov 10 02:22:29 cyber-neurones kernel: [228588.644106] r8169 0000:01:00.0 enp1s0: Link is Down Nov 10 02:22:29 cyber-neurones kernel: [228588.801614] Generic PHY r8169-100:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=r8169-100:00, irq=IGNORE) Nov 10 02:22:29 cyber-neurones kernel: [228588.903773] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready Nov 10 02:22:32 cyber-neurones kernel: [228591.795592] r8169 0000:01:00.0 enp1s0: Link is Up - 1Gbps/Full - flow control rx/tx Nov 10 02:22:32 cyber-neurones kernel: [228591.795621] IPv6: ADDRCONF(NETDEV_CHANGE): enp1s0: link becomes ready Nov 10 02:23:26 cyber-neurones kernel: [228646.209283] r8169 0000:01:00.0 enp1s0: Link is Down Nov 10 02:23:29 cyber-neurones kernel: [228649.207082] r8169 0000:01:00.0 enp1s0: Link is Up - 1Gbps/Full - flow control rx/tx Nov 10 02:23:37 cyber-neurones kernel: [228656.568960] Generic PHY r8169-100:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=r8169-100:00, irq=IGNORE) Nov 10 02:23:40 cyber-neurones kernel: [228660.165981] r8169 0000:01:00.0 enp1s0: Link is Up - 1Gbps/Full - flow control rx/tx Nov 10 02:24:05 cyber-neurones kernel: [228684.699180] r8169 0000:01:00.0 enp1s0: Link is Down Nov 10 02:24:08 cyber-neurones kernel: [228687.606366] r8169 0000:01:00.0 enp1s0: Link is Up - 1Gbps/Full - flow control rx/tx