web-dev-qa-db-ja.com

Curl SSLエラー証明書の有効期限が切れています

API URLから結果を取得するためにpythonを使用していますが、次のようになりました：

Traceback (most recent call last):
  File "grafana-utils.py", line 95, in <module>
    grafana_backup_all()
  File "/home/trobz/.local/lib/python2.7/site-packages/click/core.py", line 700, in __call__
    return self.main(*args, **kwargs)
  File "/home/trobz/.local/lib/python2.7/site-packages/click/core.py", line 680, in main
    rv = self.invoke(ctx)
  File "/home/trobz/.local/lib/python2.7/site-packages/click/core.py", line 873, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/trobz/.local/lib/python2.7/site-packages/click/core.py", line 508, in invoke
    return callback(*args, **kwargs)
  File "grafana-utils.py", line 56, in grafana_backup_all
    data = json.loads(api_grafana_get_data(Host, key))
  File "grafana-utils.py", line 15, in api_grafana_get_data
    data = requests.get( Host + '/api/search', headers=key).text
  File "/home/trobz/.local/lib/python2.7/site-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/home/trobz/.local/lib/python2.7/site-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/home/trobz/.local/lib/python2.7/site-packages/requests/sessions.py", line 512, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/trobz/.local/lib/python2.7/site-packages/requests/sessions.py", line 622, in send
    r = adapter.send(request, **kwargs)
  File "/home/trobz/.local/lib/python2.7/site-packages/requests/adapters.py", line 511, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(Host='grafana.trobz.com', port=443): Max retries exceeded with url: /api/search (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))

カールも同じ問題：

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

見た目は https://curl.haxx.se/docs/sslcerts.html ですが、この問題の解決方法がわかりません。

No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3208 bytes and written 295 bytes
Verification error: certificate has expired
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: D84D38798779A0009ED548D3C05188D46793E9BCEF4F79DA65C47CF27110282F
    Session-ID-ctx: 
    Master-Key: 5F60F42E744D123FB51B271E347C9B6690F4E13D4A0D2634D9468B427D5A6C2A6D6DCB855BE2561EF34477A40190890B
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1541057942
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: yes
---
closed

私はこの問題がこのマシンでのみ発生することを理解していません。私のローカルマシンでは、ホストに接続するために機能します。

curl -k Hostと言う人もいますが、安全ではないため、私はそれが好きではありません。

もう1つ、サーバーに問題がないと確信しています。したがって、問題はマシンからのように見えます。

ここにサーバー：

Resolves to   grafana.trobz.com
Expiration date   Dec 31, 2018
Vendor signed Yes
Hostname  Matches
Key length    2048
Server type   nginx
Common name   *.trobz.com
SAN   *.trobz.com, trobz.com
Organization  Let's Encrypt
Common name   Let's Encrypt Authority X3 Let's Encrypt Authority X3
Serial number 03:1b:2d:bb:65:5d:b4:b2:70:c3:18:45:0a:ea:db:05:62:48
Signature algorithm   sha256WithRSAEncryption
Fingerprint (SHA-1)   A35C6987779070AB273471A0E2FA55AB87621822
Fingerprint (MD5) A4BBF42BED757F638CB273095102E807

誰か助けてくれませんか？

nginxsslssl-certificatehttpsopenssl
1
Phan Cường

SSL証明書の問題：証明書の有効期限が切れています

TLS証明書には2つの日付が含まれており、開始日より前は無効および有効期限後は無効となり、クライアントの時刻/日付が外の場合、検証は失敗しますその時間範囲。

これには2つの理由が考えられます。証明書が実際に期限切れであるか、クライアントのクロックがずれていて、かなりの差があるためです。

3
HBruijn