curl：“证书密钥用法不足以进行尝试的操作”

编程问答 2022-06-10

问题描述

我已经阅读了很多有关密钥使用不当的文章，我想我知道如何使curl接受自签名证书，但是我仍然无法使其适用：

我有一个信任存储，其中包含我的证书的CA：

./my.trust.crt

我使用以下方法从服务器中检索了证书./my.server.com.pem 

> openssl s_client -showcerts -servername my.server.com -connect my.server.com:443

我检查了证书是否适合使用：

> openssl verify -purpose sslserver -CAfile ./my.trust.crt my.server.com.pem
my.server.com.pem: OK
>

但是，curl抱怨道：

> curl -v --cacert ./my.trust.crt https://my.server.com
* About to connect() to my.server.com port 443 (#0)
*   Trying 192.168.x.y...
* Connected to my.server.com (192.168.x.y) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: ./my.trust.crt
  CApath: none
* Server certificate:
*       subject: CN=my.server.com,OU=x,O=y,L=z,ST=ZH,C=CH
*       start date: Mar 07 13:19:00 2019 GMT
*       expire date: Mar 07 13:19:00 2029 GMT
*       common name:my.server.com
*       issuer: CN=My Certificate Authority,C=CH
* NSS error -8102 (SEC_ERROR_INADEQUATE_KEY_USAGE)
* Certificate key usage inadequate for attempted operation.
* Closing connection 0
curl: (60) Certificate key usage inadequate for attempted operation.
More details here: http://curl.haxx.se/docs/sslcerts.html
...

关于如何找出问题所在的任何提示？我的openssl验证正确吗？我还有其他地方做错了吗？

其他信息：ca“捆绑包”中有一个CA。根据建议对CA和服务器证书的内容进行匿名处理（谢谢！）

> openssl x509 -in my.server.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c2:48:fb:ed:52:57:1e:24
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CH,L=Z,O=Company,CN=Company Certificate Authority
        Validity
            Not Before: Mar  7 13:19:00 2019 GMT
            Not After : Mar  7 13:19:00 2024 GMT
        Subject: C=CH,OU=Dept,CN=my.server.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    <lots of hex stuff>
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Subject Key Identifier:
                A4:51:53:0C:51:01:2F:51:48:D1:C0:49:B3:8B:CF:BD:7B:91:27:40
            X509v3 Authority Key Identifier:
                keyid:91:E5:80:D7:86:77:4C:B8:16:19:49:DF:74:E4:A7:05:D2:86:12:FE
                DirName:/C=CH/ST=ZH/L=Z/O=Company/CN=Company Certificate Authority
                serial:C2:48:FB:ED:52:57:1D:8B

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: critical
                TLS Web Server Authentication
            X509v3 Subject Alternative Name:
                DNS:my.server.com,DNS:my-1.server.com,DNS:my-2.server.com
    Signature Algorithm: sha256WithRSAEncryption
         <lots of hex stuff>
         
> openssl x509 -in my.trust.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c2:48:fb:ed:52:57:1d:8b
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CH,CN=Company Certificate Authority
        Validity
            Not Before: Sep  9 11:49:46 2015 GMT
            Not After : Sep  9 11:49:46 2025 GMT
        Subject: C=CH,CN=Company Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    <lots of hex stuff>
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                91:E5:80:D7:86:77:4C:B8:16:19:49:DF:74:E4:A7:05:D2:86:12:FE
            X509v3 Authority Key Identifier:
                keyid:91:E5:80:D7:86:77:4C:B8:16:19:49:DF:74:E4:A7:05:D2:86:12:FE

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         <lots of hex stuff>
No Trusted Uses.
No Rejected Uses.
Alias: Company Certificate Authority

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）

certificatecurlself-signedssl