gpt4 book ai didi

ssl - 如何解决 "NSS error -12276 (SSL_ERROR_BAD_CERT_DOMAIN)"

转载 作者:行者123 更新时间:2023-12-04 19:40:31 48 4
gpt4 key购买 nike

我只找到了 one S.O. Post on the error "NSS error -12276 (SSL_ERROR_BAD_CERT_DOMAIN) 。”
我在 CentOS 服务器上的 localhost 上运行一个简单的 python 应用程序。 Python 应用程序只是一个小助手客户端,当 ManageIQ 请求时,它会向外部 API 发出 http 请求,ManageIQ 是在此设备上运行的主应用程序。
出乎意料的是,python 应用程序已停止接受请求。 ManageIQ 记录以下错误:

Errno::ECONNREFUSED: Failed to open TCP connection to localhost:8080 (Connection refused - connect(2) for "localhost" port 8080)
为了调试它,我在命令行上运行了 curl 命令: curl --verbose http://localhost/flavors/Linux?name=Basic_A1输出是:
* About to connect() to localhost port 80 (#0)
* Trying ::1...
* Connected to localhost (::1) port 80 (#0)
> GET /flavors/Linux?name=Basic_A1 HTTP/1.1
> User-Agent: curl/7.29.0
> Host: localhost
> Accept: */*
>
< HTTP/1.1 302 Found
< Date: Wed, 11 Nov 2020 16:17:57 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_auth_gssapi/1.5.1 mod_auth_kerb/5.4
< Location: https://localhost/flavors/Linux?name=Basic_A1
< Content-Length: 229
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://localhost/flavors/Linux?name=Basic_A1">here</a>.</p>
</body></html>
* Connection #0 to host localhost left intact
这表明我需要 https,所以我尝试了 curl --verbose https://localhost/flavors/Linux?name=Basic_A1
* About to connect() to localhost port 443 (#0)
* Trying ::1...
* Connected to localhost (::1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: E=mike.butak@expeditors.com,CN=miq-dev.chq.ei,OU=IS-Systems Administration,O=Expeditors,C=US
* start date: Aug 24 22:20:01 2020 GMT
* expire date: May 11 22:20:01 2040 GMT
* common name: miq-dev.chq.ei
* issuer: CN=Expeditors Server CA,OU=IS Security,O=Expeditors,C=US
* NSS error -12276 (SSL_ERROR_BAD_CERT_DOMAIN)
* Unable to communicate securely with peer: requested domain name does not match the server's certificate.
* Closing connection 0
curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.
一天中的大部分时间都在寻找修复程序。这在过去发生在我身上,通过在 /etc/pki/ca-trust/source/anchors 中重新安装我们的公司根证书很容易解决。文件夹,然后运行 ​​ update-ca-trust enableupdate-ca-trust extract根据 this post on serverfault .但是今天由于某种原因它不起作用。
任何指针?谢谢!

最佳答案

.... requested domain name does not match the server's certificate


此错误表示您已请求 localhost作为 URL 上的域名,但没有为 localhost 颁发证书.这与根 CA 无关,因此对更新这些没有帮助。相反,您用于访问站点的名称与证书中的名称不匹配 - 因此您需要调整其中之一。

Errno::ECONNREFUSED: Failed to open TCP connection to localhost:8080 (Connection refused - connect(2) for "localhost" port 8080)


这是一个完全不同的错误,与 curl 遇到的错误完全无关。使用 curl 您尝试访问 localhost 端口 443 并在证书中获得名称不匹配。使用 Python,您尝试访问 localhost 端口 8080 并收到连接错误,因为该端口上首先没有服务器。

关于ssl - 如何解决 "NSS error -12276 (SSL_ERROR_BAD_CERT_DOMAIN)",我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/64777906/

48 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com